Commit graph

100 commits

Author SHA1 Message Date
Luca Deri
3aadd4e8be Added tracings
Added details parameter to NetworkInterface::lua() and subclasses
2024-02-15 07:10:24 +01:00
Luca Deri
55870e97b9 (C) Update 2024-01-12 11:44:18 +01:00
Luca Deri
a5d1c92cdc Now with PF_RING in case of merged interfaces (e.g. -i virbr0,virbr1,eno1) ntopng keeps
track of the interface where a flow/host has been first observed
2023-12-01 20:48:40 +01:00
Luca Deri
3659793e48 Code cleanup
Reworked score code
2023-07-15 00:13:15 +02:00
Matteo Biscosi
577b3f2d0d Added deferred initialization to hosts 2023-06-05 15:01:20 +00:00
Nicolò Maio
fbae5e861b
Add Server Ports Analysis page. (#7493) (#7498)
* Add Server Ports Analysis page. (#7493)

* Add num hosts in server ports rest. (#7493)

* Fix memory leak and fix GUI bug. (#7493)

* Minor Fix. (#7493)

* Minor fix.

* Minor Fix.

* Fix paths
2023-05-29 16:26:03 +02:00
lucaderi
37dbf7f059 Automated commit of clang-format CI changes. 2023-04-08 12:28:11 +00:00
Luca Deri
dfb41880d5 Reworked nDPI stats (and dependencies)
Removed deserialization code
2023-04-08 14:27:05 +02:00
lucaderi
d395deac4e Automated commit of clang-format CI changes. 2023-04-07 14:20:44 +00:00
Matteo Biscosi
f77cc9e8d0 Removed some memory wasting 2023-03-03 17:36:16 +00:00
Luca Deri
d69af67a61 Removed support for data serialisation in redis
Fixes #2965
2023-02-24 10:04:37 +01:00
Luca Deri
9618eee614 Reworked host rx-only accounting 2023-02-21 13:14:21 +01:00
Luca Deri
05ecf9eb90 Remove un-necessary VLANid type in order to simplify code and avoid un-necessary and's 2023-02-20 22:30:12 +01:00
Matteo Biscosi
725a0a9640 Added rtt network timeseries 2023-02-16 16:17:26 +01:00
Luca Deri
0fae8eb3ce Improved Host no-TX statistics now available also for remote hosts 2023-02-15 22:38:21 +01:00
Luca Deri
3945f44021 Improvements for No-RX traffic analysis 2023-02-15 00:38:45 +01:00
Luca Deri
1db1c68fd5 Host page now reports Unicast local hosts 2023-02-14 00:34:37 +01:00
Luca Deri
8b65046017 Implemented count of incoming tx peers with TCP flows unanswered 2023-01-23 15:36:16 +01:00
Luca Deri
6bc62dcf0c Updated TCP connections with not success list 2023-01-23 11:51:07 +01:00
Luca Deri
9340087892 Added support for estimating the number of TCP contacted servers with no reply. This is useful to detect scans or network issues 2023-01-22 20:04:05 +01:00
MatteoBiscosi
7f17bc775c Implemented server and client ports into NetworkInterfaces 2023-01-17 16:21:14 +01:00
Luca Deri
f726b867c7 Updated (C) 2023-01-01 16:37:57 +01:00
Luca Deri
45b7a1c931 Reworked local hosts port handling 2022-10-29 14:19:57 +02:00
Luca Deri
75aece27e0 Implemented interace.getLocalServerPorts() 2022-10-23 23:22:44 +02:00
Luca Deri
7456607b53 Reworked host ports implementation 2022-10-23 22:13:33 +02:00
Luca Deri
93d4d923af Removed prefs for behaviour analysis
Tiny method signature changes
2022-09-25 18:49:52 +02:00
Luca Deri
db3cdd1d15 Added IMAP/POP stats 2022-08-18 19:17:38 +02:00
Luca Deri
f7180631f5 Added router information 2022-08-18 12:54:09 +02:00
Luca Deri
bee57c0f57 Changes in redis serialization key 2022-08-18 11:31:06 +02:00
Luca Deri
5c17fa1099 Improved asset management 2022-08-17 17:35:36 +02:00
Alfredo Cardigliano
f2060f2488 Copyright update (C) 2022-01-03 09:35:09 +01:00
Francesco Amodeo
de27966413
Implemented countries host check (#5713)
* Added check and alert implementation

* Fixed size of estimation and some typo

* Added HLL counters and DES structure
Co-authored-by: Paolo Junior Mollica <p.mollica@studenti.unipi.it>

* fixes according comments of PR

* decreased memory footprint

* resolved conflicts

* fixed HostCheckID

* Removed wrongly committed file

Co-authored-by: paolo-junior-mollica <paolo.junior.mollica@gmail.com>
Co-authored-by: Matteo Biscosi <49585191+MatteoBiscosi@users.noreply.github.com>
2021-08-25 15:50:07 +02:00
Gaetano Barresi
f650a3700a
Domain Names host check (#5723)
* Adding/modifying .cpp for Domain Names host check

* Adding/modifying .h/.lua for Domain Names host check

* minor synstax fix

* dns_contacts

Co-authored-by: Stefano Russo <55586218+D0kken@users.noreply.github.com>
Co-authored-by: Stefano Russo <s.russo41@studenti.unipi.it>
2021-08-25 11:22:41 +02:00
Luca
112c931226 Observation point code cleanup (WIP) 2021-07-01 23:26:15 +02:00
Luca Deri
846d24c5e9 Initial VLANid rework 2021-06-15 23:01:59 +02:00
Luca
a4047c5a1c Implements flow callbacks and alerts in C++
Scaffolding code of the host scripts

Scaffolding code for host alerts

Adds host_callbacks/ for .cpp files

Implements all classes for host callbacks

Removes pro/enterprise host callbacks

Adds typedefs with callback deltas

Compilation fix

Creates instances of host callbacks in loader

Link fix

Removes redundant/non-necessary host alerts

Merges Scan and Flood callbacks together

Removes outdated API files

Refactors alert keys into entity|id

Refactors all flow alert_{...} into flow_alert_{...}

Refactors C++ flow alert_{...} into flow_alert_{...}

Reworks alert ids to include an entity type

Cleanup and merge alertTypeRaw with getAlertType

Minor fix

Refactors alert definitions and keys into sub directories

Implement host alert callback execution and trigger/release logic

Update callbacks API

Adds base CallbacksLoader for {Host,Flow}CallbacksLoader

Implements load of host user scripts with periodicities

Implements runtime reload of host callbacks

Add logic for periodic callbacks

Add 'expired' flag to host alerts

Implements execution of host callbacks and SYN flood checks

Adds triggerAlertAsync calls to SYNFlood

Implements JSON host alert generation info

Handle callback getPeriod. Optimize callback lookup.

Implements host recipients in C++

Add callback status

Define destructor

Iterator fixes

Cleanup host Lua calls (now performed in C++)

Changes to show new host alerts in SQLite

Adds release/engage action on alert JSON

Move AlertableEntity to OtherAlertableEntity, inheriting from a new AlertableEntity. Add HostAlertableEntity.

Implements SYN Flood Attacker with params

Uses parametrized thresholds to trigger syn flood alerts

Implements build alert of both attacker and victim

Implement HostAlertableEntity

Implements SYN scan attacker/victim alerts

Implements flow flood attacker/victim alerts

Removes a debug flag

Add virtual allocStatus

Add HostAlert disableAutoRelease()

Add Ãexplicit releaseAlert()

Implements SYNFloodHostCallbackStatus

Implements SYNScanHostCallbackStatus

Implements FlowFloodHostCallbackStatus

Change trigger API to handle cli/src score

Implements {DNS,SMTP,NTP}ServerContactsAlert

Reworks ServerContacts host alerts

Implement exclusion bitmaps for host alerts

Implements {SMTP,DNS,NTP}ServerContactsAlert

Adds host_info to the generated alert JSON

Minor cleanup

Optimize access to callback status

Move RepliesRequestsRatio to pro

Rework triggerAlert on host to avoid multiple call and unneeded status data

Compilation fix

Reworked host alerts API (wip)

Cleanup unused host callbacks

Compilation fixes

Finishes backend implementation of host alerts exclusions

Rework host callbacks executor

Implements disable of host alerts

Port SYNFlood to the new api

Cleanup

Reduce duplicated code

Comments

Port ServerContacts to the new api

Clenaup

Adds parsing of configuration for host callbacks

Port SYNScanAlert to the new API

Port FlowFlood to the new API

Cleanup unused HostAlert getName

Reworks DNSRequestsErrorsRatioAlert

Adds JSON for DNSTrafficAlert

Adds FlowsAlert

Adds P2PTrafficAlert

Add RepliesRequestsRatioAlert

Adds ScoreAlert

Adds ThroughputAlert

Adds TrafficAlert

Fixes for scan/flood alerts

DNS ratio alert support

Add HTTP stats getters

Implements deltas for many host callbacks

Host score inc

Adds missing Alert params to host alerts

Release all host alerts on idle

Refactors score classes

Implements class Score to contain scores for hosts, flows, etc

Adds scores to VLANs, Networks, ASes and Countries

Host callbacks can trigger a single alert now

FlowFlood, SYNFloo, SYNScan now inherit from FlowHits

Move severity and score to constructor

Add else branch to hits callbacks

Alert definition update for flows_flood, syn_flood, syn_scan

Update field name

Engaged alert init

Adds score incs/decs for AS, VLAN, country, os and network

Restore network scripts

Restored other alert definitions for floods

Handle decreasing alert score

Removes include

Rename flows_flood to flow_flood for consistency

Restored alert_tcp_syn_flood_victim alert_tcp_syn_scan_victim definitions

Fixes for non-host engaged/release alerts

Cleanup LuaEngineFlow and LuaEngineHost classes

Fixes old calls to host lua during shutdown

Removes AlertCheckLuaEngine instance

Fixes purging of flows

Fixes alerts release upon shutdown causing wrong uses

Removes a debug flag

Fix getNumEngagedAlerts

Cleanup unnecessary host callbacks

Removes array of callback statuses inside host

Bitmap fixes

Refactors Bitmap into Bitmap128

Implements 16-bits bitmaps for host alerts

Adds class HostCallbacksStatus

Moves callback status p2p and DNS inside HostCallbacksStatus

Removes unused callbacks in typedefs

Minor cleanup

Adds trigger/release for DNS/p2p alerts

Reworks UI of hosts user scripts

Rename HostCallbackType to HostCallbackID, getType to getID, others
2021-04-03 09:53:15 +02:00
Matteo Biscosi
dbfdec34fe Implements Local Host behaviour analysis and it's alert
Alert in case the host has an unexpected behaviour
2021-02-25 12:04:05 +01:00
Simone Mainardi
bdf3069227 Fixes for interface/host.lua [attempt to index a function value] 2021-02-03 15:06:07 +01:00
Matteo Biscosi
eba1aaa359 Implements #4984 core Internet resources misuse script 2021-02-03 12:41:18 +01:00
Matteo Biscosi
fe01117324 Implements #4006 alerts when host contacts an unusual number of peers
Partial implementation, the rest is under the Pro Repository
2021-02-02 13:31:21 +01:00
Luca Deri
0b4e2757c1 Added host contact counters for core servers 2021-01-28 23:42:03 +01:00
Matteo Biscosi
43fa8cf6e9 Implements OperatingSystem Hash
Implements #1599
2021-01-21 11:14:52 +01:00
Luca Deri
a1178a0791 Updated (C) 2021-01-02 12:08:23 +01:00
Luca Deri
2884cc9794 Reworked Doh/DoT handling 2020-11-11 18:55:12 +01:00
Luca Deri
7758e0dea1 Reworked DoH code 2020-11-11 16:19:39 +01:00
Matteo Biscosi
5a8fd8efd7
Fixes #2115 and added shell script user guide (#4702)
* Added shell endpoint user guide

* Fixes #2115 std::new exceptions not always handled

* Removed a nothrow due to the insert of a try-catch statement

* Trying to implement #4421

Co-authored-by: matteo <biscosi@ntop.org>
2020-11-11 12:28:18 +01:00
Simone Mainardi
fa96c5e2f5 Code cleanup 2020-10-01 14:20:07 +02:00
Luca Deri
80dfd37e04 Reworked baheviour analysis code 2020-09-28 12:55:37 +02:00
Simone Mainardi
1baa7d6cc4 Avoids double 5-sec HT-walks to update stats 2020-07-27 14:22:59 +02:00
Luca Deri
dd062dcc09 Behaviour analysis is not disabled by default 2020-07-22 09:39:47 +02:00