mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-05-08 06:24:44 +00:00
7a7e4ee69f
The main goal of a DPI engine is usually to determine "what", i.e. which types of traffic flow on the network. However the applications using DPI are often interested also in "who", i.e. which "user/subscriber" generated that traffic. The association between a flow and a subscriber is usually done via some kind of DHCP/GTP/RADIUS/NAT mappings. In all these cases the key element of the flow used to identify the user is the source ip address. That usually happens for the vast majority of the traffic. However, depending on the protocols involved and on the position on the net where the traffic is captured, the source ip address might have been changed/anonymized. In that case, that address is useless for any flow-username association. Example: iCloud Private Relay traffic captured between the exit relay and the server. See the picture at page 5 on: https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF This commit adds new generic flow risk `NDPI_ANONYMOUS_SUBSCRIBER` hinting that the ip addresses shouldn't be used to identify the user associated with the flow. As a first example of this new feature, the entire list of the relay ip addresses used by Private Relay is added. A key point to note is that list is NOT used for flow classification (unlike all the other ip lists present in nDPI) but only for setting this new flow risk. TODO: IPv6 |
||
|---|---|---|
| .. | ||
| flow_printer.py | ||
| Makefile.in | ||
| ndpi.py | ||
| ndpi_example.py | ||
| ndpi_typestruct.py | ||
| ndpi_wrap.c | ||
| python_extensions_guide.pdf | ||
| README.rst | ||
nDPI Python bindings
--------------------
This directory contains the Python3 bindings for nDPI. We provide both cffi and ctypes based bindings.
**cffi bindings**
Files:
* ndpi.py
Example (using `nfstream <https://github.com/aouinizied/nfstream>`_ package):
.. code-block:: bash
pip3 install nfstream
python3 flow_printer.py <interface>
python3 flow_printer.py <pcap_file>
Code courtesy:
* Zied Aouini
**ctypes bindings**
Files:
* ndpi_typestruct.py
* ndpi_wrap.c
* Makefile.in
Example:
.. code-block:: bash
pip3 install scapy
python3 ndpi_example.py <interface>
python3 ndpi_example.py <pcap_file>
Code courtesy:
* Massimo Puddu
* Zied Aouini