wssxsxxsx
8894ebc76f
Add Automatic Tank Gauge protocol ( #2527 )
...
See also #2523
---------
Co-authored-by: Nardi Ivan <nardi.ivan@gmail.com>
2024-08-23 22:35:08 +02:00
Vladimir Gavrilov
a10c48c80a
Add CNP/IP protocol support ( #2521 )
...
ISO/IEC 14908-4 defines how to tunnel Control Network Protocol (CNP) over IP networks. It encapsulates protocols like EIA-709, EIA-600, and CNP, making it a versatile solution for building automation and control systems.
2024-08-22 15:26:32 +02:00
Luca Deri
fc4fb4d409
Fixed probing attempt risk that was creating false positives
2024-08-07 11:38:41 +02:00
Ivan Nardi
85501c9aaa
FPC: add DPI information ( #2514 )
...
If the flow is classified (via DPI) after the first packet, we should
use this information as FPC
2024-07-23 08:50:27 +02:00
Vladimir Gavrilov
b15337a32b
Add OpenWire support ( #2513 )
2024-07-22 19:20:44 +02:00
Ivan Nardi
65e31b0ea3
FPC: small improvements ( #2512 )
...
Add printing of fpc_dns statistics and add a general cconfiguration option.
Rework the code to be more generic and ready to handle other logics.
2024-07-22 17:42:23 +02:00
Vladimir Gavrilov
6a77a891a8
Add Nano (XNO) protocol support ( #2508 )
2024-07-18 16:18:12 +02:00
Ivan Nardi
456f0fd427
Improve detection of Cloudflare WARP traffic ( #2491 )
...
See: #2484
2024-07-04 08:59:04 +02:00
Ivan Nardi
843e487270
Add infrastructure for explicit support of Fist Packet Classification ( #2488 )
...
Let's start with some basic helpers and with FPC based on flow addresses.
See: #2322
2024-07-03 18:02:07 +02:00
Ivan Nardi
4f05d21441
Improve detection of Twitter/X ( #2482 )
2024-07-01 08:20:04 +02:00
Toni
8fd649ab1e
Add Ripe Atlas probe protocol. ( #2473 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-06-17 11:00:38 +02:00
Nardi Ivan
526cf6f291
Zoom: remove "stun_zoom" LRU cache
...
Since 070a0908b
2024-06-17 10:19:55 +02:00
Mark Jeffery
f796c94375
Added protocol - JRMI - Java Remote Method Invocation ( #2470 )
2024-06-15 10:52:28 +02:00
Maatuq
6127e04900
support rtp/rtcp over tcp ( #2422 ) ( #2457 )
...
Support rtp/rtcp over tcp as per rfc4571.
Signed-off-by: mmaatuq <mahmoudmatook.mm@gmail.com>
2024-05-28 22:01:08 +02:00
Toni
80171dbcf3
Add ZUG consensus protocol dissector. ( #2458 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-05-28 20:29:48 +02:00
Ivan Nardi
25f8964a23
CiscoVPN: we detect it only over UDP ( #2454 )
...
The original code handled also TCP/TLS, but it was removed in 6fc29b3ae
2024-05-28 14:07:48 +02:00
Luca
44a290286b
More NDPI_PROBING_ATTEMPT changes
2024-05-22 18:04:33 +02:00
Ivan Nardi
0109014f2c
Follow-up of 2093ac5bf ( #2451 )
2024-05-21 12:47:25 +02:00
Luca Deri
2093ac5bf6
Minor dissector optimizations
2024-05-20 12:17:04 +02:00
Vladimir Gavrilov
3d1da00d8d
Add Call of Duty Mobile support ( #2438 )
2024-05-15 12:46:02 +02:00
Ivan Nardi
0110623b4e
H323: improve detection and avoid false positives ( #2432 )
2024-05-11 23:39:54 +02:00
Vladimir Gavrilov
2d33431948
Add Ethernet Global Data support ( #2437 )
2024-05-11 16:49:16 +02:00
Toni
18e03a26ca
Add extra entropy checks and more precise(?) analysis. ( #2383 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-05-09 15:24:11 +02:00
Ivan Nardi
95fe21015d
Remove "zoom" cache ( #2420 )
...
This cache was added in b6b4967aa63f349319
2024-05-06 12:51:45 +02:00
Ivan Nardi
266af02752
Merge RTP and RTCP logic ( #2416 )
...
Avoid code duplication between these two protocols.
We remove support for RTCP over TCP; it is quite rare to find this kind
of traffic and, more important, we have never had support for RTP
over TCP: we should try to add both detecion as follow-up.
Fix a message log in the LINE code
2024-05-06 10:19:46 +02:00
Ivan Nardi
a6fd981fcf
eDonkey: improve/update classification ( #2410 )
...
eDonkey is definitely not as used as >10 years ago, but it seems it is
still active.
While having a basic TCP support seems easy, identification over UDP doesn't
work and it is hard to do it rightly (packets might be only 2 bytes long):
remove it.
Credits to V.G <v.gavrilov@securitycode.ru>
2024-05-04 19:11:31 +02:00
Luca Deri
57ecbf38c0
Updated JA4 test results
2024-05-02 17:40:24 +02:00
0x41CEA55
fd388845d5
Add BFCP protocol support ( #2401 )
2024-04-23 15:35:19 +02:00
0x41CEA55
905120588b
Remove obsolete protocols: tuenty, tvuplayer and kontiki ( #2398 )
2024-04-19 21:35:32 +02:00
0x41CEA55
e75d7a620e
Add KNXnet/IP protocol support ( #2397 )
...
* Add KNXnet/IP protocol support
* Improve KNXnet/IP over TCP detection
2024-04-19 12:54:00 +02:00
Vladimir Gavrilov
c63697205b
Add Label Distribution Protocol support ( #2385 )
...
* Add Label Distribution Protocol support
* Fix typo
* Update unit test results
2024-04-12 17:44:36 +02:00
Vladimir Gavrilov
9ff4bece33
Add The Elder Scrolls Online support ( #2376 )
...
* Add The Elder Scrolls Online support
* Use ndpi_memmem instead of memmem from libc
* Add protocol description
* Change selection bitmask to V4_V6
* Update protocols.rst
2024-04-10 18:04:02 +02:00
Toni
727e72d1f1
Calculate packet entropy for unknown protocols. ( #2369 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-04-06 17:01:19 +02:00
Vladimir Gavrilov
5b32c98a21
Add LoL: Wild Rift detection ( #2356 )
2024-03-26 08:11:14 +01:00
Nardi Ivan
15a80527c6
STUN: remove workaround to identify RTP traffic
...
We are able to demultiplex RTP packets in STUN flows since 3608ab01b
2024-03-20 09:39:15 +01:00
Vladimir Gavrilov
e6474d835f
Add FLUTE protocol dissector ( #2351 )
...
* Add FLUTE protocol dissector
* Add flute.c to MSVC project
2024-03-19 09:11:04 +01:00
Vladimir Gavrilov
8fad77991d
Add PFCP protocol dissector ( #2342 )
2024-03-13 20:18:43 +01:00
Vladimir Gavrilov
e2949048e0
Add Path of Exile protocol dissector ( #2337 )
...
* Add Path of Exile protocol dissector
* Update protocols.rst
2024-03-06 19:59:09 +01:00
Vladimir Gavrilov
58fdc9fafb
Add Naraka Bladepoint detection support ( #2334 )
2024-03-04 08:30:54 +01:00
Vladimir Gavrilov
f2e3c7fb90
Add BFD protocol dissector ( #2332 )
2024-02-29 08:19:00 +01:00
Vladimir Gavrilov
66b6e2b3f2
Add DLEP protocol dissector ( #2326 )
2024-02-20 16:05:41 +01:00
Vladimir Gavrilov
e93bcfd619
Add ANSI C12.22 protocol dissector ( #2317 )
...
* Add ANSI C12.22 protocol dissector
* Add UDP sample
2024-02-15 09:36:06 +01:00
Ivan Nardi
ae36648c6c
Skype: remove old detection logic ( #1954 )
...
Skype has been using standard protocols (STUN/ICE or TLS) for a long,
long time, now. Long gone are the days of Skype as a distribuited
protocol.
See: #2166
2024-02-12 18:39:24 +01:00
Vladimir Gavrilov
f5cec001f3
Add detection of Gaijin Entertainment games ( #2311 )
...
* Add detection of Gaijin Entertainment games
* Short NDPI_PROTOCOL_GAIJINENTERTAINMENT to NDPI_PROTOCOL_GAIJIN
* Add default UDP port for Gaijin Entertainment games
* Remove NDPI_PROTOCOL_CROSSOUT protocol id
2024-02-09 11:07:48 +01:00
Vladimir Gavrilov
6207be43fa
Add TencentGames protocol dissector ( #2306 )
2024-02-08 08:10:35 +01:00
Vladimir Gavrilov
4c9446379f
Add Gearman protocol dissector ( #2297 )
2024-02-01 19:46:57 +01:00
Luca Deri
47f72443fa
Implemented CIP I/O (UDP version of the CIP protocol), Common Industrial protocol
2024-01-29 13:28:41 +01:00
Vladimir Gavrilov
c807d84054
Fix RESP detection ( #2289 )
...
* Rename redis_net.c to resp.c
* Fix RESP detection
2024-01-27 21:19:34 +01:00
Toni
bcca89b78c
Add Raft protocol dissector. ( #2286 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-01-25 20:26:18 +01:00
Vladimir Gavrilov
4e712e3ab5
Add Radmin protocol dissector ( #2283 )
...
* Add Radmin protocol dissector
* Update test results
2024-01-25 08:10:29 +01:00
