Commit graph

69 commits

Author SHA1 Message Date
Luca Deri
669fdf6b5f Improved skype, teredo, netbios heuristics
Changed ndpi_detection_giveup() API: guess is now part of the call
2018-11-21 00:32:32 +01:00
Luca Deri
71b2c19cf2 Added DPDK support to ndpiReader 2018-11-10 16:10:22 +01:00
Luca Deri
326a2fb7ed Fix for https://github.com/ntop/nDPI/issues/572 2018-05-28 18:18:19 +02:00
Luca Deri
6dd42d19f7 Implemented Facebook Messenger (mobile) support
Code cleanup
2018-05-18 23:10:00 +02:00
Luca Deri
66b759ca69 Hidden ndpi_detection_module_struct definition 2018-05-14 22:58:14 +02:00
Luca Deri
50216991bd Improved hyperscan support and category definition 2018-05-10 23:46:35 +02:00
Luca
3adccc98f7 Implemented custom category loading.
Modified ndpiReader with -c <file> (use mining_hosts.txt as example) for loading name-based categories
2018-04-26 21:10:59 +02:00
Darryl Sokoloski
c54a8f8cfa Moved ndpi_config.h from ndpi_main.h to ndpi_main.c, and example source files. 2018-04-24 10:21:47 -04:00
Campus
9e47e49ade fix wrong increment for MPLS double header 2018-02-15 21:26:38 +01:00
Ludovico Cavedon
35dc6e27ae Fix MPLS header parsing in ndpiReader.
Reported at https://bugs.debian.org/886133.
The current parsing for the MPLS header in examples/ndpi_util.c has
multiple issues:
- the bitfield order is incorrect for little endian architectures
- ntohl() is applied to a 20 bit label, which has unclear purpose
- if multiple labels are detected, the while loop parsing labels will
never exit due to a missing re-read of the mpls label
- the last label is identified by looking inside the label field, while
it should be done by looking at the S bit

This change fixes the above issues.
Notice that bitfield ordering is implementation-dependent, so C
bitfields should not be used in the first place to parse network
packets.
2018-01-09 10:26:10 -08:00
qianguozheng
9561f37998 Fix ndpiReader long run crash due to dupilicate nodes exist, cause
double free failed.
2017-12-19 17:37:46 +08:00
Luca Deri
61bc528159 Simplified IPv6 datatypes 2017-12-08 18:13:31 +01:00
Vitaly Lavrov
2787c2390c Refactoring the debugging output.
levels of debug output:
 0 - ERROR: Only for errors.
 1 - TRACE: Start of each packets and if found protocol.
 2 - DEBUG: Start of searching each protocol and excluding protocols.
 3 - DEBUG_EXTRA: For all other messages.

Added field ndpi_struct->debug_logging for enable debug output of each protocols.

Simple macros for debugging output are added:
NDPI_LOG_ERR(), NDPI_LOG_INFO(), NDPI_LOG_DBG(), NDPI_LOG_DBG2(),
NDPI_EXCLUDE_PROTO()
2017-10-26 20:41:22 +03:00
Luca Deri
1a4e57e736 Code rework 2017-09-17 23:34:46 +02:00
Luca
3ba3a08141 Implemented flow sort based on total bytes so that we can (with -v X) immediately spot elephants and mice 2017-08-02 20:15:21 +02:00
Campus
a90b97bc10 fix wrong datalink type for Cisco PPP 2017-07-29 23:44:47 +02:00
Micah Lyle
55d1362924 Updated tests to match new SSL server certificate fix/addition 2017-07-18 12:53:02 -07:00
Micah Lyle
6e85b93442 Implementation for extra packet processing if desired 2017-07-17 18:06:07 -07:00
Luca
993605d4f3 Fixed bug that was forcing the reader to pass several times the same flow
renamed some variables
2017-05-24 18:53:51 +02:00
Luca Deri
904210e87c Split src2dst / dst2src traffic 2017-05-24 16:06:23 +02:00
Alfredo Cardigliano
1a20029c82 compilation fixes 2017-05-23 18:56:43 +02:00
Alfredo Cardigliano
26bd42a71c crc32 fix 2017-05-23 18:02:53 +02:00
Pavlos Antoniou
73b3ee51d1 Remove unused variable and clarify operator precedence in ndpi_util.c 2017-05-18 14:08:01 +03:00
Luca Deri
0091f35e02 Reworked flow structure handler 2017-05-17 15:50:59 +02:00
alexei-argus
8a7dc10f51 Fix out-of-bounds heap read caused by using header->len instead of header->caplen (as provided in pcap_loop) 2017-05-10 14:16:46 +03:00
Luca
21567e8686 Added missing direction update with non TCP-UDP protocols 2017-05-08 08:29:18 +02:00
Luca Deri
064b50df81 Added -m for splitting analysis in sub-analysis steps 2017-04-30 10:12:28 +02:00
Luca
e1b905124f Improved SSL dissection 2017-04-27 14:57:04 +02:00
Luca Deri
b9a2511ea8 Initial Wireshark nDPI integration 2017-04-23 19:58:41 +02:00
Campus
9a94c34b91 fix for https://github.com/ntop/nDPI/issues/364 2017-04-20 23:00:11 +02:00
Luca Deri
a9c01ded17 ndpiReader now prints (-v) the flows with the correct direction 2017-04-19 21:55:49 +02:00
Luca
c1db9a830d Compilation fix for old compilers 2017-04-18 17:20:43 +02:00
Luca
4c5de9ef8e Added ethernet checksum reforging and nDPI protocol export in nDPI-extcap reader 2017-04-17 09:38:30 +02:00
Campus
2b0809f3dc name correction for llc_snap header and minor fix 2017-04-15 00:40:01 +02:00
Campus
29cd6ef994 fix segmentation fault caused by missing spanning tree check - add control for threads return values 2017-04-15 00:29:53 +02:00
Luca Deri
d8b2189cc3 Initial wireshark integration via extcap interface 2017-04-14 00:07:46 +02:00
Luca Deri
281ba768ec Added Ookla (SpeedTest) protocol detection 2017-04-01 21:33:15 +02:00
Campus
65359e53d8 Merge branch 'set_memory_functions' of https://github.com/vpiserchia/nDPI into vpiserchia-set_memory_functions 2017-03-29 10:46:38 +02:00
Luca Deri
92b1b46fa6 SSL server certificate is now detected 2017-03-21 00:48:16 +01:00
Vito Piserchia
4300208642 Added ndpi_flow_ free/malloc and set_ functions:
Ideally these two new functions will provide more flexibility
in regards of application that want to use specific allocation
approaches, for example storage queues for this structures
from where the application can pop and release the data it
needs.
Semantically they can be set up as the other ndpi_malloc and ndpi_free
functions, that is via the set_ndpi_flow_malloc and set_ndpi_flow_free.
In case a NULL parameter is passed to the above functions the old
approach will be used, that means that the ndpi_malloc will be used as
the ndpi_flow_malloc function and ndpi_free_flow as the ndpi_flow_free one.

Application that use the old functions will be not affected by this change,
and the ndpi_free_flow can be deprecated in the future and made private.
2017-03-16 17:35:10 +01:00
Campus
5de6a96af5 change behaviour for https://github.com/ntop/nDPI/issues/344 - fix skype detection deleting parts that detect host name and ip addr (duplicate behaviour) - improved any detection after fix - added skype host name 2017-03-15 17:28:31 +01:00
Josh Soref
fbe1fb285d spelling: platform 2017-03-12 22:00:21 +00:00
Campus
c2c92b2e9b added double tagging 802.1Q in dissection of vlan pkt 2017-02-21 13:04:17 +01:00
Campus
787ca096e6 Merge branch 'dev-numeronove-openbsd' of https://github.com/numeronove/nDPI into numeronove-dev-numeronove-openbsd 2017-02-13 13:11:54 +01:00
Luca Deri
e2cfc96577 Improvements for exporting info in MDNS and UBNTAC2 protocols
Added test pcap file for UBNTAC2
2017-02-13 01:29:25 +01:00
Numeronove
ffbe5d1e22 Easing OpenBSD build
Addedd macro AM_PROG_CC_C_O in configure.ac, needed to have autogen.sh
manage the error:

    C objects in subdir but `AM_PROG_CC_C_O' not in `configure.ac'

Modified case instance in example/ndpi_util.c, since DLT_LINUX_SLL
isn't defined in OpenBSD pcap.h.
2017-02-11 11:04:59 +01:00
Luca Deri
1d2e67d38c Dissected SSH client/server versions and reported in data structures 2017-02-11 10:48:08 +01:00
Denis Volpato Martins
483eb63408 Removed some magic numbers 2016-12-06 18:48:26 -02:00
Campus
5f672dfb42 added comment to function process_packet 2016-12-02 02:32:46 +01:00
Luca Deri
45ca2ace0b Code cleanup. Added coveralls badge 2016-11-27 10:57:42 +01:00