mirror of
https://github.com/nfstream/nfstream.git
synced 2026-05-20 17:52:00 +00:00
68dfdb6120
* Upgrade nDPI from 4.7.0 to 5.0 with Windows build fix (#230) - Upgrade nDPI submodule from 4.7.0 to 5.0 - Fix all 9 nDPI 5.0 API breaking changes: * Protocol structure: .app_protocol -> .proto.app_protocol * Protocol structure: .master_protocol -> .proto.master_protocol * ndpi_protocol2name() signature change * ndpi_detection_giveup() signature change (removed enable_guess/guessed params) * ndpi_extra_dissection_possible() replaced with state check * ndpi_init_detection_module() now expects NULL * Protocol bitmask removed (all protocols enabled by default) * TCP/UDP struct size checks removed * Fingerprint extraction: ja3_client -> ja4_client - Maintain backward compatibility by keeping field names: * client_fingerprint: Now JA4 (TLS), HASSH client (SSH), DHCP fingerprint * server_fingerprint: Now JA3S (TLS), HASSH server (SSH) - Update build system for nDPI 5.0: * Add --with-only-libndpi flag to build.sh * Make CFFI marker extraction optional in engine_build.py - Update tests for nDPI 5.0: * Update fingerprint assertions (JA3 MD5 -> JA4 format) * Regenerate all 228 baseline test results * Remove invalid test file (memcached.cap) - All 29 tests passing * Fix memcpy buffer overreads and enable DNS subclassification - Fix buffer overread in fingerprint memcpy calls by using source size instead of destination size: - HASSH client/server: 33 bytes (was reading 48) - JA4 client: 37 bytes (was reading 48) - JA3 server: 33 bytes (was reading 48) - DHCP: 48 bytes (consistent with others) - Enable DNS subclassification (disabled by default in nDPI 5.0) to restore detection of DNS.Apple, DNS.Google, etc. - Regenerate test baselines with fixes applied * Replace outdated Steam test pcaps with nDPI 5.0 version - Remove steam.pcap and steam_datagram_relay_ping.pcapng (obsolete) - Add steam.pcapng from nDPI 5.0 test suite - nDPI 5.0 reworked Steam detection (ntop/nDPI#2264) * Fix Windows build: add missing configure step for nDPI 5.0 The Windows build script was missing the ./configure --with-only-libndpi step before make, causing nDPI headers to not be properly installed. This resulted in the CFFI preprocessing marker //CFFI.NDPI_PACKED_STRUCTURES being absent from ndpi_cdefinitions_packed.h, crashing engine_build.py. Aligns build_windows.sh with build.sh which already had this step. * Fix Windows build: install libpcap-dev for nDPI 5.0 configure nDPI 5.0 configure requires libpcap when --with-only-libndpi is used on MinGW (see ntop/nDPI#3114). Install mingw-w64-x86_64-libpcap via pacman to satisfy this dependency.
64 lines
2 KiB
Text
64 lines
2 KiB
Text
id,bidirectional_packets,bidirectional_bytes,application_name,application_category_name,application_is_guessed,application_confidence
|
|
0,1,90,TLS,Web,0,6
|
|
1,8,1067,TLS,Web,0,6
|
|
2,8,1067,TLS,Web,0,6
|
|
3,12,4088,DHCP,Network,0,6
|
|
4,7,648,TLS,Web,0,6
|
|
5,3,1656,Dropbox,Cloud,0,6
|
|
6,3,258,Spotify,Music,0,6
|
|
7,1,87,MDNS,Network,0,6
|
|
8,1,87,MDNS,Network,0,6
|
|
9,1,168,SSDP,System,0,6
|
|
10,1,168,SSDP,System,0,6
|
|
11,1,78,ICMPV6,Network,0,6
|
|
12,2,180,ICMPV6,Network,0,6
|
|
13,2,684,DHCP,Network,0,6
|
|
14,2,228,DHCPV6,Network,0,6
|
|
15,2,180,ICMPV6,Network,0,6
|
|
16,2,140,ICMPV6,Network,0,6
|
|
17,2,298,DNS.Apple,Network,0,6
|
|
18,11,1660,HTTP.Apple,ConnCheck,0,6
|
|
19,2,216,DNS,Network,0,6
|
|
20,2,180,NTP,System,0,6
|
|
21,2,174,DNS.Google,Network,0,6
|
|
22,23,7031,TLS.Google,Web,0,6
|
|
23,2,174,DNS.PlayStore,Network,0,6
|
|
24,22,6484,TLS.PlayStore,SoftwareUpdate,0,6
|
|
25,2,194,DNS.Google,Network,0,6
|
|
26,16,5937,TLS.Google,ConnCheck,0,6
|
|
27,16,5913,TLS.Google,ConnCheck,0,6
|
|
28,2,174,DNS.Google,Network,0,6
|
|
29,2,168,DNS.GoogleServices,Network,0,6
|
|
30,20,6730,TLS.Google,Web,0,6
|
|
31,2,148,Google,Web,1,7
|
|
32,2,188,DNS.PlayStore,Network,0,6
|
|
33,21,8026,TLS.PlayStore,SoftwareUpdate,0,6
|
|
34,2,174,DNS.DataSaver,Network,0,6
|
|
35,2,184,DNS.DataSaver,Network,0,6
|
|
36,15,6331,TLS.PlayStore,SoftwareUpdate,0,6
|
|
37,21,8204,TLS.PlayStore,SoftwareUpdate,0,6
|
|
38,13,2384,HTTP.DataSaver,Web,0,6
|
|
39,27,7459,TLS.DataSaver,Web,0,6
|
|
40,2,164,DNS.Google,Network,0,6
|
|
41,32,13775,TLS.Google,Web,0,6
|
|
42,2,174,DNS.Google,Network,0,6
|
|
43,14,4454,TLS.Google,Web,0,6
|
|
44,2,204,DNS.GoogleServices,Network,0,6
|
|
45,2,174,DNS.DataSaver,Network,0,6
|
|
46,14,4465,TLS.DataSaver,Web,0,6
|
|
47,2,174,DNS.Google,Network,0,6
|
|
48,30,8376,TLS.Google,Web,0,6
|
|
49,2,174,DNS.DataSaver,Network,0,6
|
|
50,4,797,TLS.GoogleServices,Web,0,6
|
|
51,7,1233,HTTP.DataSaver,Web,0,6
|
|
52,3,214,HTTP,Web,1,1
|
|
53,2,184,DNS.DataSaver,Network,0,6
|
|
54,24,4876,TLS.DataSaver,Web,0,6
|
|
55,2,174,DNS.DataSaver,Network,0,6
|
|
56,2,164,DNS.Google,Network,0,6
|
|
57,14,4513,TLS.DataSaver,Web,0,6
|
|
58,18,5585,TLS.Google,Web,0,6
|
|
59,2,180,DNS.GoogleServices,Network,0,6
|
|
60,6,2347,TLS.GoogleServices,Web,0,6
|
|
61,2,174,DNS.DataSaver,Network,0,6
|
|
62,1,74,TLS,Web,1,1
|