vrr/nDPI
2
0
Fork 0
mirror of https://github.com/vel21ripn/nDPI.git synced 2026-05-05 19:15:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 6
2937 commits 9 branches 12 tags 263 MiB
Commit graph

413 commits

Author SHA1 Message Date
Luca Deri
d19bad1581 Added pcap for testing fragments reassembly 2021-02-03 11:48:53 +01:00
Luca
0809956e5f Rewored UPnP protocol that in essence was WSD hence it has been renamed 
Cleaned up TLS code for DTLS detection by defining a new DTLS protocol
 2021-01-20 09:53:30 +01:00
Luca Deri
e9f43516ec Improves STUN dissection removing an invalid termination condition that prevented Skype calls to be properly identified 2021-01-13 16:46:51 +01:00
Ivan Nardi
2080cc7365
QUIC: add suppport for DNS-over-QUIC (#1107) 
Even if it is only an early internet draft, DoQ has already (at least)
one deployed implementation.
See: https://www.zdnet.com/article/ad-blocker-adguard-deploys-worlds-first-dns-over-quic-resolver/
Draft: https://tools.ietf.org/html/draft-huitema-dprive-dnsoquic-00

In the future, if this protocol will be really used, it might be worth to
rename NDPI_PROTOCOL_DOH_DOT in NDPI_PROTOCOL_DOH_DOT_DOQ
 2021-01-07 10:56:39 +01:00
Ivan Nardi
b8a5358e80
QUIC: improve handling of SNI (#1105) 
* QUIC: SNI should be always saved in flow->protos.stun_ssl.ssl.client_requested_server_name

Close #1077

* QUIC: fix matching of custom categories

* QUIC: add NDPI_TLS_MISSING_SNI support for older GQUIC versions

* QUIC: fix serialization

* QUIC: add DGA check for older GQUIC versions
 2021-01-07 10:55:23 +01:00
Luca Deri
eb37f8f1fb Split HTTP request from response Content-Type. Request Content-Type should be present with POSTs and not with other methods such as GET 2021-01-06 18:28:24 +01:00
Ivan Nardi
1b524f5538
QUIC: update to draft-33 (#1104) 
QUIC (final!?) constants for v1 are defined in draft-33
 2021-01-04 15:50:14 +01:00
Ivan Nardi
23b84cd3ee
Remove FB_ZERO protocol (#1102) 
FB_ZERO was an experimental protocol run by Facebook.
They switched to QUIC/TLS1.3 more than 2 years ago; no one ever used it but
them so it is definitely dead.
See: https://engineering.fb.com/2018/08/06/security/fizz/
 2021-01-04 15:49:19 +01:00
Luca Deri
4ddb5f4245 Added TLS test with long certificate 2021-01-04 11:31:25 +01:00
Luca Deri
05d76525b0 Added HTTP suspicious content securirty risk (useful for tracking trickbot) 2021-01-02 21:11:42 +01:00
Luca Deri
b7376cc690 Restored QUIC stats 2020-12-30 12:12:33 +01:00
Luca Deri
9c1827a77b Fixed output when tLS (nad not QUIC) is used 2020-12-28 09:19:39 +01:00
Luca Deri
34fc9d5d50 Introduced fix on TLS for discarding traffic out of sequence that might invalidate dissection 2020-12-22 09:47:39 +01:00
Luca Deri
2768da0637 Improved HTTP dissection 2020-12-16 14:45:29 +01:00
rafaliusz
1ecc6d323e
Add a connectionless DCE/RPC detection (#1078) 
* Add connectionless DCE/RPC detection

* Add DCE/RPC pcap file as well as its test result

Co-authored-by: rafal <rafal.burzynski@cryptomage.com>
 2020-12-08 15:48:53 +01:00
Luca Deri
23a15bae5f Fixes #1029 2020-11-27 18:51:56 +01:00
Ivan Nardi
53a5c354d8
Quic fixes (#1067) 
* QUIC: fix return value on error path on quic_cipher_init()

* QUIC: allow dissection of sessions forcing version negotiation

Enhance heuristic to avoid false positives.
 2020-11-22 11:04:10 +01:00
Luca Deri
d670850f55 Updated results 2020-11-16 21:25:59 +01:00
Zied Aouini
bfabb0ddf4
Add Virtual Asssitant (Alexa, Siri) support. (#1057) 
* Add AmazonAlexa protocol.

* Add AmazonAlexa test file and result.

* Include pcapng as file format.

* Rename Category to VirtualAssistant.

* Add AppleSiri virtual assistant.

* Fix pcapng test files format support.

Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
 2020-11-16 21:19:38 +01:00
Zied Aouini
76bb83085b
Improve subprotocols detection. (#1062) 
* Improve Spotify detection.

* Improve Skype detection.

* Improve Microsoft detection.

* Fix Microsoft detection categories.

* Improve Waze detection.

* Improve Apple detection.

* Improve WindowsUpdate detection.

* Improve TikTok detection.

* Improve Teams detection.

* Improve Youtube detection.

* Improve Messenger detection.

* Improve Twitch detection.

* Improve Hulu detection.

* Improve Facebook detection.

* Improve AmazonVideo detection.
 2020-11-16 21:16:38 +01:00
Zied Aouini
3529268df8
Add Tumblr support. (#1061) 
* Add Tumblr protocol.

* Add Tumblr test file and result.

Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
 2020-11-16 21:14:06 +01:00
Zied Aouini
22780da8d5
Add Reddit support. (#1060) 
* Add Reddit protocol.

* Add Reddit test file and result.

Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
 2020-11-16 21:13:01 +01:00
Zied Aouini
13dab51cc7
Add Pinterest support. (#1059) 
* Add Pinterest protocol.

* Add Pinterest test file and result.

Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
 2020-11-16 21:11:43 +01:00
Luca Deri
328ff24657 Renumbered AmongUs protocol 2020-11-09 16:23:01 +01:00
Toni
6b5bdf773d
Added support for AmongUs. (#1054) 
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
 2020-11-09 16:19:00 +01:00
Luca Deri
89a363aff6 Updated ESNI/SNI alarm generation prolicy 2020-11-08 10:07:35 +01:00
Leonn
0576dc2a49
💡 Add mongodb protocol dissector (#1048) 2020-11-03 16:16:02 +01:00
Ivan Nardi
a9547da138
QUIC: fix dissection of Initial packets coalesced with 0-RTT one (#1044) 
* QUIC: fix dissection of Initial packets coalesced with 0-RTT one

* QUIC: fix a memory leak
 2020-11-03 11:35:52 +01:00
Luca Deri
92b80e2468 Updated results with numeric IP detection 2020-11-01 13:31:00 +01:00
Igor Duarte
ba6a48c9fe
Improve skype detection (#1039) 
* Add new skype pcap

PCAP extracted from SkypeIRC.cap (available in https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=SkypeIRC.cap)

* Improve skype detection
 2020-10-27 08:45:09 +01:00
Luca Deri
948a906037 Added -D flag for detecting DoH in the wild 
Removed heuristic from CiscoVPN as it leads to false positives
 2020-10-26 21:40:59 +01:00
Luca Deri
833d0eee53 Added CPHA - CheckPoint High Availability Protocol protocl support 2020-10-22 18:39:13 +02:00
Ivan Nardi
6027a7c799
Fix parsing of DLT_PPP datalink type (#1042) 2020-10-21 22:27:42 +02:00
Luca Deri
9dac9945c9 Fixes #1033 2020-10-21 20:59:02 +02:00
Zied Aouini
43c1f6a3fd
CAPWAP tunnel decoding fix (#1038) 
* Fix CAPWAP processing.

* Update result.
 2020-10-21 15:07:20 +02:00
Luca Deri
d4d82c27a5 Tests update 2020-10-02 21:35:15 +02:00
Luca Deri
044ed14b4f Various optimizations to reduce not-necessary calls 
Optimized various UDP dissectors
Removed dead protocols such as pando and pplive
 2020-09-24 23:26:03 +02:00
Luca Deri
60a9f6610d Added risks for checking 
- invalid DNS traffic (probably carrying exfiltrated data)
- TLS traffic with no SNI extension
 2020-09-21 19:57:23 +02:00
Nardi Ivan
dcac633878 QUIC: add support for MVFST EXPERIMENTAL version 2020-09-20 16:38:28 +02:00
Luca Deri
6a7139bb24 Updated results 2020-09-18 00:17:43 +02:00
Luca Deri
d81bc1add6 Reworked MDNS dissector that is not based on the DNS dissector 2020-09-17 23:24:02 +02:00
Luca Deri
753b5dde16
Merge pull request #1012 from IvanNardi/ua 
QUIC: extract User Agent information
 2020-09-17 21:32:25 +02:00
Luca Deri
5ac870074b
Merge pull request #1014 from lnslbrty/improved/teamspeak 
Improved Teamspeak(3) protocol detection.
 2020-09-09 23:28:21 +02:00
Luca Deri
7086197047 Added extension to detect nested subdomains as used in Browsertunnel attack tool 
https://github.com/veggiedefender/browsertunnel
 2020-09-09 23:25:19 +02:00
Toni Uhlig
8ca13bc46a
Improved Teamspeak(3) protocol detection. 
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
 2020-09-09 21:57:31 +02:00
Nardi Ivan
7d5a0e1f04 QUIC: extract User Agent information 2020-09-08 11:03:22 +02:00
Toni Uhlig
df14d225f6
Added pcap file which contains dnscrypt-v1 data and resolver update requests/responses (v1/v2). 
* Renamed dnscrypt.pcap to simple-dnscrypt.pcap

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
 2020-09-07 21:04:23 +02:00
Toni Uhlig
fe5aa7ebca
Added dnscrypt-v2-doh resolver test pcaps. 
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
 2020-09-07 20:22:52 +02:00
Toni Uhlig
580859a47d
Fixed false positive detection for Skype.SkypeCall (affects at least Cisco HSRP and RADIUS). 
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
 2020-09-02 07:29:33 +02:00
Luca Deri
029448759b
Merge pull request #999 from IvanNardi/quic 
QUIC: add support for GQUIC T050 and T051
 2020-08-30 20:56:15 +02:00