mirror of
https://github.com/utoni/nDPId.git
synced 2026-08-11 01:14:25 +00:00
28c3275cd4
Some checks failed
ArchLinux PKGBUILD / build (push) Has been cancelled
CentOs / centos8 (push) Has been cancelled
Docker Build / docker (push) Has been cancelled
FreeBSD Build / Build and Test (push) Has been cancelled
Build OpenWrt Packages / build (armsr-armv8) (push) Has been cancelled
Build OpenWrt Packages / build (malta-be) (push) Has been cancelled
Build OpenWrt Packages / build (ramips-mt7621) (push) Has been cancelled
Build OpenWrt Packages / build (x86-64) (push) Has been cancelled
RPM Build / build (push) Has been cancelled
Build / macOS-14 cc (push) Has been cancelled
Build / ubuntu-latest clang (push) Has been cancelled
Build / ubuntu-latest clang-1 (push) Has been cancelled
Build / ubuntu-22.04 clang-12 (push) Has been cancelled
Build / ubuntu-latest gcc (push) Has been cancelled
Build / ubuntu-latest gcc-1 (push) Has been cancelled
Build / ubuntu-latest gcc-2 (push) Has been cancelled
Build / ubuntu-22.04 gcc-10 (push) Has been cancelled
Build / ubuntu-22.04 gcc-9 (push) Has been cancelled
SonarQube Scan / Build and analyze (push) Has been cancelled
Add support for nDPIsrvd TCP/TLS collectors. * Removed fallback-to-blocking nonsense; a single-threaded event-io forwarding application is useless with such an option * Fix missing poll-in / poll-out handling for TLS / OpenSSL * Fix I/O (out)event handling * Fix error for select in NIO and fixed event mod ops in nDPIsrvd Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
107 lines
3.7 KiB
Text
107 lines
3.7 KiB
Text
[general]
|
|
# Set the network interface from which packets are captured and processed.
|
|
# Leave it empty to let nDPId choose the default network interface.
|
|
#netif = eth0
|
|
|
|
# Set a Berkeley Packet Filter.
|
|
# This will work for libpcap as well as with PF_RING.
|
|
#bpf = udp or tcp
|
|
|
|
# Decapsulate Layer4 tunnel protocols.
|
|
# Supported protocols: GRE
|
|
#decode-tunnel = true
|
|
|
|
#pidfile = /tmp/ndpid.pid
|
|
#user = nobody
|
|
#group = daemon
|
|
#riskdomains = /path/to/libnDPI/example/risky_domains.txt
|
|
#protocols = /path/to/libnDPI/example/protos.txt
|
|
#categories = /path/to/libnDPI/example/categories.txt
|
|
#ja4 = /path/to/libnDPI/example/ja4_fingerprints.csv
|
|
#sha1 = /path/to/libnDPI/example/sha1_fingerprints.csv
|
|
|
|
# Collector endpoint as UNIX socket (usually nDPIsrvd)
|
|
#collector = /run/nDPIsrvd/collector
|
|
# Collector endpoint as TCP socket (usually nDPIsrvd or a custom application)
|
|
#collector = 127.0.0.1:7777
|
|
|
|
# Setup TLS for TCP Collector (PEMs preferably generated with scripts/gen-cacerts.sh)
|
|
#cert-pem-file = /path/to/client-crt.pem
|
|
#key-pem-file = /path/to/client-key.pem
|
|
#ca-pem-file = /path/to/ca.pem
|
|
|
|
# Set a name for this nDPId instance
|
|
#alias = myhostname
|
|
|
|
# Set an optional UUID for this instance
|
|
# If the value starts with a '/' or '.', it is interpreted as a path
|
|
# from which the uuid is read from.
|
|
#uuid = 00000000-dead-c0de-0000-123456789abc
|
|
#uuid = ./path/to/some/file
|
|
#uuid = /proc/sys/kernel/random/uuid
|
|
#uuid = /sys/class/dmi/id/product_uuid
|
|
|
|
# Process only internal initial connections (src->dst)
|
|
#internal = true
|
|
|
|
# Process only external initial connections (dst->src)
|
|
#external = true
|
|
|
|
# Enable zLib compression of flow memory for long lasting flows
|
|
compression = true
|
|
|
|
# Enable "analyse" events, which can be used for machine learning.
|
|
# The daemon will generate some statistical values for every single flow.
|
|
# An "analyse" event is thrown after "max-packets-per-flow-to-analyse".
|
|
# Please note that the daemon will require a lot more heap memory for every flow.
|
|
#analysis = true
|
|
|
|
# Force poll() on systems that support epoll() as well
|
|
#poll = false
|
|
|
|
# Enable PF_RING packet capture instead of libpcap
|
|
#pfring = false
|
|
|
|
[tuning]
|
|
max-flows-per-thread = 2048
|
|
max-idle-flows-per-thread = 64
|
|
max-reader-threads = 10
|
|
daemon-status-interval = 600000000
|
|
#memory-profiling-log-interval = 5
|
|
compression-scan-interval = 20000000
|
|
compression-flow-inactivity = 30000000
|
|
flow-scan-interval = 10000000
|
|
generic-max-idle-time = 600000000
|
|
icmp-max-idle-time = 120000000
|
|
tcp-max-idle-time = 180000000
|
|
udp-max-idle-time = 7440000000
|
|
tcp-max-post-end-flow-time = 120000000
|
|
max-packets-per-flow-to-send = 15
|
|
max-packets-per-flow-to-process = 32
|
|
max-packets-per-flow-to-analyse = 32
|
|
error-event-threshold-n = 16
|
|
error-event-threshold-time = 10000000
|
|
|
|
# Please note that the following options are libnDPI related and can only be set via config file,
|
|
# not as commnand line parameter.
|
|
# See libnDPI/doc/configuration_parameters.md for detailed information.
|
|
|
|
[ndpi]
|
|
packets_limit_per_flow = 32
|
|
flow.direction_detection = enable
|
|
flow.track_payload = disable
|
|
tcp_ack_payload_heuristic = disable
|
|
fully_encrypted_heuristic = enable
|
|
libgcrypt.init = 1
|
|
dpi.compute_entropy = 1
|
|
fpc = disable
|
|
dpi.guess_on_giveup = 0x03
|
|
flow_risk_lists.load = 1
|
|
# Currently broken (upstream)
|
|
#flow_risk.crawler_bot.list.load = 1
|
|
log.level = 0
|
|
|
|
[protos]
|
|
tls.certificate_expiration_threshold = 7
|
|
tls.application_blocks_tracking = enable
|
|
stun.max_packets_extra_dissection = 8
|