Simone Mainardi
88693f5f6a
Adds flow tcp seq issues (ooo, retx, lost) over ZMQ
2020-03-04 15:01:24 +01:00
Alfredo Cardigliano
c3d3984285
Add more info to flow serialize (json)
2020-02-26 13:23:07 +01:00
emanuele-f
15898e8dad
Flow dissection code cleanup.
...
The Flow API is now composed of the following methods:
- Flow::setDetectedProtocol to manually set a protocol on the flow
and terminate the dissection
- Flow::processPacket to run the nDPI dissection on the raw packets
- Flow::endProtocolDissection to terminate or give up the dissection
Also fixes the flow sampling rate preference, which was never used.
2020-02-17 17:36:06 +01:00
Luca Deri
8786c9fb30
Added support for ALPN and Client Supported TLS Protocols reported by nDPI
2020-02-17 16:29:24 +01:00
emanuele-f
107c9e50f2
Add shadow dns query to prevent use after free
2020-02-14 11:01:05 +01:00
Simone Mainardi
f7d79e50f9
Implements anti stall when dumping flows (MySQL, nIndex, ES, ...)
...
Implements #3411
2020-02-13 11:36:48 +01:00
emanuele-f
7105cb8a65
Add score and user script config link into the flow details additional status
2020-02-07 20:02:19 +01:00
emanuele-f
e3d3d3992f
Replace an existing flow alert if a more critical problem is found
...
Also add the flow score into the database
2020-02-07 19:20:57 +01:00
emanuele-f
0a0a3c4537
Rework flow status accounting
2020-02-07 19:17:07 +01:00
Simone Mainardi
38ee7f8439
Fixes for idle transitions not performed
...
Fixes #3394
Commit also affects #3106 as now DNS flows are adjusted
periodically when they contain more than one query
2020-02-07 19:13:45 +01:00
Luca Deri
f1d8fb00f4
Handled partial protocol detection
2020-02-06 22:01:32 +01:00
Simone Mainardi
05750cf3ef
Fixes and cleanup
2020-02-05 18:07:54 +01:00
emanuele-f
8d51dae0e5
Implement Misbehaving vs Alerted flows chart
2020-01-27 15:37:36 +01:00
emanuele-f
566b9ece0b
Score changes
...
- Move score from status definition to user scripts
- Separate flow score counter from the peers score
- Create a new HostScore class to hold the score data
2020-01-16 18:11:14 +01:00
emanuele-f
01d5d83f21
Account host score also on volatile flows (e.g. scans)
...
Such flows may go idle too early and miss the minute.lua iteration
2020-01-16 14:08:49 +01:00
emanuele-f
c336cca0e7
Improve host score calculation
2020-01-15 18:42:48 +01:00
emanuele-f
d7528e1628
Score improvements
...
The score is now calculated differently on the client and on the server of the flow.
The hosts flow is updated every minute and charted.
It's now possible to trigger an alert when the score threshold is exceeded
2020-01-15 12:34:16 +01:00
emanuele-f
93a96eb214
Code cleanup
2020-01-13 15:20:38 +01:00
Simone Mainardi
76391ff6a5
Resores flow alerts for view interfaces
2020-01-08 18:18:00 +01:00
Simone Mainardi
8cb1db967a
Improvements to the probing traffic detection algorithm
2020-01-08 10:46:53 +01:00
Luca Deri
57e6a93065
Improved scheduling algorithm to guarantee minimum service time when number of entries allow
...
Updated (C)
2020-01-06 23:36:36 +01:00
Simone Mainardi
1b73a89dae
Fixes detection of TCP connection-refused flow status
2020-01-03 12:37:41 +01:00
Simone Mainardi
417c4a3146
Reworks handling of TCP flags for both ZMQ and packet interfaces
...
This commit allows simplifies the code and also allows flags-based alerts
to be triggered for packet and non-packet interfaces
Fixes #3167
2020-01-02 19:21:44 +01:00
Simone Mainardi
0fc220bd0a
Removes unused cli2srv_direction Flow class member
2020-01-02 15:04:49 +01:00
Luca
92ea3cf5a0
TLS certificate improvements
2020-01-02 09:36:31 +01:00
emanuele-f
87c336a4aa
Reduce cpu usage due to the loading of flow.lua
...
The FlowAlertCheckLuaEngine is now cached into the (reused) vm, so it is reloaded
only when needed (e.g. a script on disk changes).
2019-12-31 18:27:14 +01:00
Simone Mainardi
2abb8cfde5
Reworks flow scripts deadlines
2019-12-27 20:50:53 +01:00
Luca Deri
c5fbb49bfd
Fix for memory corruption in flow initialization
2019-12-26 23:00:45 +01:00
emanuele-f
8b7d711a36
Add option to disable flow user scripts invocation
2019-12-23 18:03:19 +01:00
Simone Mainardi
0de06c5db8
Hides sub interfaces menu on view / disaggregated faces
2019-12-20 15:21:19 +01:00
Simone Mainardi
562ac1d0f8
Fixes custom categories detection and concurrency issues
2019-12-19 18:38:14 +01:00
Simone Mainardi
ba13e49856
Updates vlans, pools, ases stats for view interfaces
2019-12-13 18:49:29 +01:00
Simone Mainardi
0ebc64cf71
Handles offline NetBIOS updates
2019-12-13 17:08:35 +01:00
Simone Mainardi
0a7d677beb
Handles offline MDNS updates
2019-12-13 16:54:13 +01:00
Simone Mainardi
69453397a5
Handles offline MDNS updates
2019-12-13 16:47:18 +01:00
Simone Mainardi
e0c247bfca
Implements tcp stats for view interfaces
2019-12-13 15:28:02 +01:00
Simone Mainardi
a65b6efc7c
Implements icmp hosts stats for view interfaces
2019-12-13 13:06:26 +01:00
Simone Mainardi
4a9ac03cb4
Implements dns hosts stats for view interfaces
2019-12-13 09:58:09 +01:00
Simone Mainardi
371fec9fb0
Allows flows info to be shown for view interface flows
2019-12-12 17:22:17 +01:00
Simone Mainardi
8b0869da46
Implements http hosts stats for view interfaces
2019-12-12 17:11:56 +01:00
Simone Mainardi
1eb3bf9335
Moves hosts HTTP updates offline
2019-12-12 15:54:23 +01:00
Simone Mainardi
0140318856
Reworks Flow::periodic_stats_update using PartializableFlowTrafficStats
2019-12-11 12:51:23 +01:00
Simone Mainardi
df8351ec83
Implements PartializableFlowTrafficStats for flow periodic updates
2019-12-11 10:42:15 +01:00
Simone Mainardi
dd7a96d71b
Simplifies flow stats access
2019-12-11 09:56:33 +01:00
Simone Mainardi
e2ed60bf3a
Reworks FlowTrafficStats from POD to class
2019-12-10 19:27:45 +01:00
Simone Mainardi
4afa348f89
Fixes possibly invalid icmp echo id
2019-12-10 14:26:27 +01:00
Simone Mainardi
993fcc2fc3
Fixes interfaces TCP timeseries
...
Fixes #3077
2019-11-25 15:53:30 +01:00
Simone Mainardi
5b81a3ab9e
Implements low goodput calculation in lua
2019-11-21 16:37:33 +01:00
Simone Mainardi
8b9b7b8b19
Reworks and simplifies flow lua calls code
2019-11-18 19:02:24 +01:00
emanuele-f
7d0888d302
Flow user scripts optimizations
2019-11-15 15:52:36 +01:00
