mirror of
https://github.com/vel21ripn/nDPI.git
synced 2026-05-02 00:40:17 +00:00
acb1de69aa
`ndpiReader` is only an example, aiming to show nDPI capabilities
and integration, without any claim about performances.
Nonetheless its memory usage per flow is *huge*, limiting the kinds
of traces that we can test on a "normal" hardware (example: scan
attacks).
The key reason of that behaviour is that we preallocate all the memory
needed for *all* the available features.
Try to reduce memory usage simply allocating some structures only
when they are really needed. Most significant example: JOY algorithms.
This way we should use a lot less memory in the two most common
user-cases:
* `ndpiReader` invoked without any particular flag (i.e `ndpiReader -i
$FILENAME_OR_IFACE`)
* internal unit tests
Before (on x86_64):
```
struct ndpi_flow_info {
[...]
/* size: 7320, cachelines: 115, members: 72 */
```
After:
```
struct ndpi_flow_info {
[...]
/* size: 2128, cachelines: 34, members: 75 */
```
|
||
|---|---|---|
| .. | ||
| MacOS | ||
| categories.txt | ||
| intrusion_detection.c | ||
| intrusion_detection.h | ||
| ja3_fingerprints.csv | ||
| Makefile.dpdk.in | ||
| Makefile.in | ||
| mining_hosts.txt | ||
| ndpi2timeline.py | ||
| ndpiReader.c | ||
| ndpiSimpleIntegration.c | ||
| protos.txt | ||
| reader_util.c | ||
| reader_util.h | ||
| README.DPDK | ||
| risky_domains.txt | ||
| sha1_fingerprints.csv | ||
Prerequisites ------------- You need to install and compile DPDK in your HOME directory as explained in See http://core.dpdk.org/doc/quick-start/ for DPDK installation and setup Once DPDK is built make sure to create a symbolic link $ cd $ ln -s dpdk-18.08 DPDK so the build process will use the DPDK directory letting you have multiple DPDK versions available on your system Build ----- Everything will happen automagically but if you want to do it by hand do: make -f Makefile.dpdk Run Application --------------- Supposing to capture packets from device eno1 you can start the application as follows: sudo ./build/ndpiReader -c 1 --vdev=net_pcap0,iface=eno1 -- -v 1 NOTE: - ndpiReader without DPDK support sits in this directory - ndpiReader with DPDK support can be found inside the ./build directory