mirror of
https://github.com/nfstream/nfstream.git
synced 2026-05-20 09:23:51 +00:00
68dfdb6120
* Upgrade nDPI from 4.7.0 to 5.0 with Windows build fix (#230) - Upgrade nDPI submodule from 4.7.0 to 5.0 - Fix all 9 nDPI 5.0 API breaking changes: * Protocol structure: .app_protocol -> .proto.app_protocol * Protocol structure: .master_protocol -> .proto.master_protocol * ndpi_protocol2name() signature change * ndpi_detection_giveup() signature change (removed enable_guess/guessed params) * ndpi_extra_dissection_possible() replaced with state check * ndpi_init_detection_module() now expects NULL * Protocol bitmask removed (all protocols enabled by default) * TCP/UDP struct size checks removed * Fingerprint extraction: ja3_client -> ja4_client - Maintain backward compatibility by keeping field names: * client_fingerprint: Now JA4 (TLS), HASSH client (SSH), DHCP fingerprint * server_fingerprint: Now JA3S (TLS), HASSH server (SSH) - Update build system for nDPI 5.0: * Add --with-only-libndpi flag to build.sh * Make CFFI marker extraction optional in engine_build.py - Update tests for nDPI 5.0: * Update fingerprint assertions (JA3 MD5 -> JA4 format) * Regenerate all 228 baseline test results * Remove invalid test file (memcached.cap) - All 29 tests passing * Fix memcpy buffer overreads and enable DNS subclassification - Fix buffer overread in fingerprint memcpy calls by using source size instead of destination size: - HASSH client/server: 33 bytes (was reading 48) - JA4 client: 37 bytes (was reading 48) - JA3 server: 33 bytes (was reading 48) - DHCP: 48 bytes (consistent with others) - Enable DNS subclassification (disabled by default in nDPI 5.0) to restore detection of DNS.Apple, DNS.Google, etc. - Regenerate test baselines with fixes applied * Replace outdated Steam test pcaps with nDPI 5.0 version - Remove steam.pcap and steam_datagram_relay_ping.pcapng (obsolete) - Add steam.pcapng from nDPI 5.0 test suite - nDPI 5.0 reworked Steam detection (ntop/nDPI#2264) * Fix Windows build: add missing configure step for nDPI 5.0 The Windows build script was missing the ./configure --with-only-libndpi step before make, causing nDPI headers to not be properly installed. This resulted in the CFFI preprocessing marker //CFFI.NDPI_PACKED_STRUCTURES being absent from ndpi_cdefinitions_packed.h, crashing engine_build.py. Aligns build_windows.sh with build.sh which already had this step. * Fix Windows build: install libpcap-dev for nDPI 5.0 configure nDPI 5.0 configure requires libpcap when --with-only-libndpi is used on MinGW (see ntop/nDPI#3114). Install mingw-w64-x86_64-libpcap via pacman to satisfy this dependency.
122 lines
3.3 KiB
Text
122 lines
3.3 KiB
Text
id,bidirectional_packets,bidirectional_bytes,application_name,application_category_name,application_is_guessed,application_confidence
|
|
0,6,1000,TLS,Web,1,1
|
|
1,20,1640,MDNS,Network,0,6
|
|
2,20,2040,MDNS,Network,0,6
|
|
3,2,366,DNS.Google,Network,0,6
|
|
4,34,8681,TLS.Google,Web,0,6
|
|
5,7,517,TLS,Web,0,6
|
|
6,8,583,TLS,Web,0,6
|
|
7,2,309,DNS.Google,Network,0,6
|
|
8,13,6836,QUIC.Google,Web,0,6
|
|
9,2,302,DNS.GoogleDocs,Network,0,6
|
|
10,13,4812,QUIC.GoogleDocs,Collaborative,0,6
|
|
11,6,396,Google,Web,1,7
|
|
12,86,37554,TLS,Web,0,6
|
|
13,4,216,TLS,Web,1,1
|
|
14,3,198,TLS,Web,1,1
|
|
15,41,26587,TLS.WeChat,Chat,0,6
|
|
16,17,4669,TLS.WeChat,Chat,0,6
|
|
17,15,4537,TLS.WeChat,Chat,0,6
|
|
18,26,11506,TLS.WeChat,Chat,0,6
|
|
19,8,552,TLS,Web,1,1
|
|
20,6,396,TLS,Web,1,1
|
|
21,40,18455,TLS.WeChat,Chat,0,6
|
|
22,39,25723,TLS.WeChat,Chat,0,6
|
|
23,17,4669,TLS.WeChat,Chat,0,6
|
|
24,8,469,TLS,Web,0,6
|
|
25,44,19995,TLS.WeChat,Chat,0,6
|
|
26,38,15082,TLS.WeChat,Chat,0,6
|
|
27,1,50,IGMP,Network,0,6
|
|
28,4,216,IGMP,Network,0,6
|
|
29,1,54,IGMP,Network,0,6
|
|
30,54,36453,TLS.WeChat,Chat,0,6
|
|
31,27,10532,TLS.WeChat,Chat,0,6
|
|
32,86,65999,TLS.WeChat,Chat,0,6
|
|
33,28,18041,TLS.WeChat,Chat,0,6
|
|
34,96,63642,TLS.WeChat,Chat,0,6
|
|
35,17,4669,TLS.WeChat,Chat,0,6
|
|
36,2,132,TLS,Web,1,1
|
|
37,2,132,TLS,Web,1,1
|
|
38,26,9761,TLS.WeChat,Chat,0,6
|
|
39,9,618,TLS,Web,1,1
|
|
40,1,50,IGMP,Network,0,6
|
|
41,4,216,IGMP,Network,0,6
|
|
42,1,54,IGMP,Network,0,6
|
|
43,1,254,NetBIOS.SMBv1,System,0,6
|
|
44,93,39402,TLS,Web,0,6
|
|
45,2,132,TLS,Web,1,1
|
|
46,14,924,Google,Web,1,7
|
|
47,73,44045,TLS.WeChat,Chat,0,6
|
|
48,9,618,TLS,Web,1,1
|
|
49,20,1640,MDNS,Network,0,6
|
|
50,20,2040,MDNS,Network,0,6
|
|
51,2,610,DNS.QQ,Network,0,6
|
|
52,24,8792,TLS.QQ,Chat,0,6
|
|
53,9,524,TLS,Web,1,1
|
|
54,2,309,DNS.Google,Network,0,6
|
|
55,10,3972,QUIC.Google,Web,0,6
|
|
56,36,14963,TLS.WeChat,Chat,0,6
|
|
57,18,4735,TLS.WeChat,Chat,0,6
|
|
58,50,30965,TLS.WeChat,Chat,0,6
|
|
59,18,4743,TLS.WeChat,Chat,0,6
|
|
60,2,465,DNS.WeChat,Network,0,6
|
|
61,26,11518,TLS.WeChat,Chat,0,6
|
|
62,8,552,TLS,Web,1,1
|
|
63,59,29728,TLS.WeChat,Chat,0,6
|
|
64,17,1146,TLS,Web,1,1
|
|
65,14,1148,MDNS,Network,0,6
|
|
66,14,1428,MDNS,Network,0,6
|
|
67,2,140,LLMNR,Network,0,6
|
|
68,2,136,LLMNR,Network,0,6
|
|
69,2,136,LLMNR,Network,0,6
|
|
70,2,180,LLMNR,Network,0,6
|
|
71,2,176,LLMNR,Network,0,6
|
|
72,2,176,LLMNR,Network,0,6
|
|
73,9,828,NetBIOS,System,0,6
|
|
74,1,50,IGMP,Network,0,6
|
|
75,4,216,IGMP,Network,0,6
|
|
76,1,54,IGMP,Network,0,6
|
|
77,1,243,NetBIOS.SMBv1,System,0,6
|
|
78,2,132,ICMPV6,Network,0,6
|
|
79,1,342,DHCP,Network,0,6
|
|
80,1,86,ICMPV6,Network,0,6
|
|
81,1,110,ICMPV6,Network,0,6
|
|
82,49,24468,TLS.WeChat,Chat,0,6
|
|
83,18,4743,TLS.WeChat,Chat,0,6
|
|
84,22,9520,TLS.WeChat,Chat,0,6
|
|
85,5,354,TLS,Web,1,1
|
|
86,1,66,TLS,Web,1,1
|
|
87,2,2508,TLS,Web,0,6
|
|
88,9,594,HTTP,Web,1,1
|
|
89,9,594,HTTP,Web,1,1
|
|
90,9,594,HTTP,Web,1,1
|
|
91,9,594,HTTP,Web,1,1
|
|
92,9,594,HTTP,Web,1,1
|
|
93,9,594,HTTP,Web,1,1
|
|
94,1,90,NTP,System,0,6
|
|
95,3,1078,TLS,Web,0,6
|
|
96,8,528,HTTP,Web,1,1
|
|
97,8,528,HTTP,Web,1,1
|
|
98,6,396,TLS,Web,1,1
|
|
99,1,82,DNS.WeChat,Network,0,6
|
|
100,1,82,DNS.WeChat,Network,0,6
|
|
101,2,164,DNS.WeChat,Network,0,6
|
|
102,1,82,DNS.WeChat,Network,0,6
|
|
103,1,50,IGMP,Network,0,6
|
|
104,1,54,IGMP,Network,0,6
|
|
105,3,162,IGMP,Network,0,6
|
|
106,1,54,IGMP,Network,0,6
|
|
107,4,328,MDNS,Network,0,6
|
|
108,4,408,MDNS,Network,0,6
|
|
109,2,164,DNS.WeChat,Network,0,6
|
|
110,1,79,DNS,Network,0,6
|
|
111,2,158,DNS,Network,0,6
|
|
112,2,172,DNS,Network,0,6
|
|
113,2,162,DNS,Network,0,6
|
|
114,1,254,NetBIOS.SMBv1,System,0,6
|
|
115,1,75,DNS.Google,Network,0,6
|
|
116,2,170,DNS,Network,0,6
|
|
117,1,86,DNS,Network,0,6
|
|
118,2,162,DNS,Network,0,6
|
|
119,1,66,TLS,Web,1,1
|
|
120,1,86,DNS,Network,0,6
|