Commit graph

14 commits

Author SHA1 Message Date
Ivan Nardi
39f3cd9558 test: rework main script
The issue about `config.txt` files is that they contains paths:
* to configuration files, which are in the source tree
* to the dynamic plugins, which are in the build tree

Solution:
* copy all configuration files into the build tree
* all those paths are about the build tree
* tests run from the build tree, no from the source tree anymore
2025-12-08 17:51:32 +01:00
Luca Deri
3f2f1f8ce4
Added ability to define protocol dissectors in shared libraries (#3047)
* Added ability to define protocol dissectors in shred libraries and load them at runtime

---------

Co-authored-by: Ivan Nardi <nardi.ivan@gmail.com>
2025-12-04 15:26:15 +01:00
Ivan Nardi
faca0a6565 ndpiReader: improve statistics 2025-10-22 20:34:29 +02:00
Luca Deri
d69446893d Added NDPI_MISMATCHING_PROTOCOL_WITH_IP flow risk
Fixed host protocol matching
Added NDPI_PROTOCOL_AKAMAI protocol
2025-10-17 23:48:44 +02:00
Ivan Nardi
9d22805954
Add statistics about hash data structures (#2995) 2025-10-17 20:39:15 +02:00
Ivan Nardi
113170cca4
New protocols for Amazon/AWS sub-classification (#2975)
Add:
* Cognito
* API Gateway
* Kinesis
* EC2
* EMR
* S3
* Cloudfront
* DynamoDB

Keep `NDPI_PROTOCOL_AMAZON_AWS` for generic AWS traffic
2025-10-02 11:48:25 +02:00
Ivan Nardi
f4995e5d5f Revert "Always compute nDPI fingerprint (#2950)"
This reverts commit 2531c2555e.
2025-08-31 19:07:13 +02:00
Ivan Nardi
2531c2555e
Always compute nDPI fingerprint (#2950) 2025-08-31 16:11:56 +02:00
Luca Deri
0aca481a0a Tests update 2025-08-29 11:53:35 +02:00
Luca Deri
d403d900de
nDPI Fingerprint Changes (#2946)
* Modified boundary check
nDPI fingeprint now defaults on client only (it can be changed via runtime configuration)

* Undated testcases

* Added lenght check

* Typo
2025-08-21 14:58:20 +02:00
Luca Deri
11d74ea286 Implemented nDPI fingerprint that is computed using
- TCP fingerprint
- JA4 fingepriint
- TLS SHA1 certificate (if present), or JA3S fingerprint (is SHA1 is missing)

By default the fingerprint uses the client and server fingerprints (format 0)
and combines them. However you can chnge it format (eg. use only the client info,
format 1) with

--cfg NULL,metadata.ndpi_fingerprint_format,X

where X is the fingerprint format.

By default nDPI fingerprint is enabled but you can enable/disble it as follows

--cfg NULL,metadata.ndpi_fingerprint,0
2025-08-21 10:34:49 +02:00
Toni
470d0d6323
Add Mudfish protocol dissector (#2932)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2025-08-06 21:07:27 +02:00
Ivan Nardi
aa78258425 Sync unit tests results 2025-08-05 20:06:04 +02:00
Ivan Nardi
b7cb6cf408
Follow-up of 8e1b17215: NDPI_UNRESOLVED_HOSTNAME (#2933)
Add fuzzing, documentation and unit tests
2025-08-05 11:32:29 +02:00