Commit graph

109 commits

Author SHA1 Message Date
Simone Mainardi
b2c89117df Implements logic to discard ZMQ probing flows 2019-12-31 10:44:59 +01:00
Simone Mainardi
fcbdd58a52 Implements custom protocols for ZMQ interfaces 2019-12-19 19:58:11 +01:00
Simone Mainardi
562ac1d0f8 Fixes custom categories detection and concurrency issues 2019-12-19 18:38:14 +01:00
Simone Mainardi
e0c247bfca Implements tcp stats for view interfaces 2019-12-13 15:28:02 +01:00
Simone Mainardi
993fcc2fc3 Fixes interfaces TCP timeseries
Fixes #3077
2019-11-25 15:53:30 +01:00
Alfredo Cardigliano
e38835a603 Rename SSL to TLS (fix #3013) 2019-11-15 12:40:01 +01:00
Alfredo Cardigliano
d05777df1e External alerts API update and cleanup 2019-10-22 15:08:06 +02:00
Alfredo Cardigliano
87ac1b0bb6 New Duplicate Disaggregated Traffic option to show disaggregated traffic in the master interface 2019-10-16 04:50:47 +02:00
Alfredo Cardigliano
3290bd803b Propagating additional fields to companion interface 2019-10-15 16:41:42 +02:00
Simone Mainardi
167c40582a Avoids multiple setDetectedProtocol calls for ZMQ flows 2019-10-11 11:25:57 +02:00
Luca
9870eee2e7 Revisited state hangling 2019-10-10 20:09:42 +02:00
Alfredo Cardigliano
a2e74e16a3 New Lua interface.processFlow API, moved processFlow from NetworkInterface to ParserInterface, code cleanup 2019-10-10 12:49:32 +02:00
Alfredo Cardigliano
f8af84df2d SyslogParserInterface now supports the companion interface for delivering Suricata alerts to a packet interface (#1928) 2019-08-27 17:53:34 +02:00
Alfredo Cardigliano
dc9978c68d Moved companion interface to ParserInterface to be used by any *ParserInterface 2019-08-27 16:24:46 +02:00
Simone Mainardi
ab92ee7926 Converts ZMQ PODs to classes 2019-05-10 19:32:34 +02:00
Simone Mainardi
2309e6df5e Initial work to parse nProbe mini eBPF fields via ZMQ 2019-04-23 20:18:01 +02:00
Simone Mainardi
4ed935547e Fixes memsets on Parsed_Flow members of type class
Fixes #2521
2019-04-09 16:17:07 +02:00
Alfredo Cardigliano
61a8ce9a76 Implemented SyslogCollectorInterface/SyslogParserInterface
Implemented TCP-based syslog collector (multi producer)
Initial Suricata EVE events parsing (basic flows)
Reworked ZMQ CollectorInterface/Parser interface hierarchy
2019-04-02 18:32:52 +02:00
Simone Mainardi
3fcb15cda2 Handles TCP flags via nProbe 2019-03-25 20:31:13 +01:00
Simone Mainardi
34b36422ad Parses nProbe application latency 2019-03-25 17:34:54 +01:00
Simone Mainardi
d9d21462cd Parses nProbe client/server network latencies 2019-03-25 16:55:14 +01:00
Simone Mainardi
1975d68e91 Handles backward ZMQ compat with new <PEN.FIELD> format 2019-02-18 12:01:37 +01:00
Simone Mainardi
c4fda59b0c Adds INPUT_SNMP and OUTPUT_SNMP as default ZMQ fields 2019-02-12 15:17:10 +01:00
Simone Mainardi
b32368afd6 Overrides NPROBE_IPV4_ADDRESS with EXPORTER_IPV4_ADDRESS (when both are present) 2019-02-12 14:46:22 +01:00
Simone Mainardi
01bad09a88 Implements handling of PEN fields from nProbe 2019-02-11 18:14:13 +01:00
Simone Mainardi
19a4b03478 ParserInterface sprobe cleanup 2019-02-11 15:15:48 +01:00
Simone Mainardi
e5eff5b30f Initial sprobe code cleanup 2019-02-11 14:22:36 +01:00
Simone Mainardi
7a1b2dc887 Parses nProbe options topic and handles custom applications 2019-02-07 16:11:11 +01:00
Simone Mainardi
300e6c4672 Parses new template ZMQ topic 2019-02-06 19:10:00 +01:00
Simone Mainardi
5317d23fc2 Disables ZMQ flow collection drop alerts (waiting to make them engaged)
Revert "Implements ZMQ flow collection drops alerts"

This reverts commit d21e8d6f3e.
2019-01-24 15:02:22 +01:00
Simone Mainardi
d21e8d6f3e Implements ZMQ flow collection drops alerts 2019-01-23 19:42:18 +01:00
Simone Mainardi
a11257482b Removes a debug trace 2019-01-23 16:19:08 +01:00
Simone Mainardi
fa3d346f58 Adds historical charts of flow collection drops 2019-01-23 16:16:55 +01:00
Simone Mainardi
16cd644f4f Adds flow collection drops to the GUI when present 2019-01-23 15:40:31 +01:00
Simone Mainardi
3819af0037 Honours --ignore-vlans in collector mode 2019-01-18 10:29:03 +01:00
Luca Deri
bedff2c8e2 Updated (C) 2019-01-07 19:28:49 +01:00
Simone Mainardi
d69237c0cd Initial work to add support to custom fields via ZMQ 2018-12-31 18:11:18 +01:00
Simone Mainardi
9ceb104114 Adds nProbe queue full dropped flows to ntopng 2018-12-18 18:05:53 +01:00
Simone Mainardi
859e85c7ce Fixes C to Lua integer types conversions affecting OS X 2018-11-23 15:58:38 +01:00
Luca Deri
4130484d1b Process info: work in progress 2018-10-16 09:06:31 +02:00
Luca Deri
757341a0bb Improved process info in flows 2018-10-15 22:13:33 +02:00
Simone Mainardi
889729495e Implements support for collected custom applications 2018-10-01 00:22:49 +02:00
Simone Mainardi
025295da9d Parses ZMQ <master>.<app> in L7_PROTO 2018-09-17 20:11:38 +02:00
Simone Mainardi
b724cc4518 Uses struct ndpi_proto when collecting ZMQ flows 2018-09-17 18:00:06 +02:00
Luca Deri
f0c936c368 Updated (C) to 2018 2018-03-22 21:59:42 +01:00
emanuele-f
99b67b16ad Remove old nedge define and move to new one 2018-02-09 13:01:08 +01:00
Luca Deri
5b54d43690 Added handling of IP_PROTOCOL_VERSION ZMQ export 2017-12-19 12:50:39 +01:00
emanuele-f
5d22c6fbd2 Fix crash on zmq when source ip is zero and destination ip is ipv4
The source ip is sometimes set as ipv6, and this tricks code thinking the flow is ipv6.
This caused a crash in FlowProfiles, where get_ipv6 was called on an ipv4 address
2017-12-19 11:48:29 +01:00
Luca Deri
c9ecd931d9 Code cleanup 2017-12-16 08:23:56 +01:00
Luca Deri
ac8a06617f Fixed leak in flow collection 2017-11-21 18:00:55 +01:00