Commit graph

219 commits

Author SHA1 Message Date
Luca Deri
ee400ef10f Added better handling of blacklisted hosts and alerts
Disabled MySQL DB for view interfaces
2016-12-19 16:57:14 +01:00
Luca Deri
da2b1ab1aa Chnages for #860 (work in progress) 2016-12-19 13:19:04 +01:00
Luca
6094c023fb Added support for ZMQ version 1 2016-12-17 13:37:55 +01:00
Luca Deri
3443b76b06 Refined alert generation
Added refresh button in alert page
2016-12-17 12:33:34 +01:00
Luca Deri
7f8065d90b Fixed missing csrf field in alerts pages that caused flow deletion to fail
Improved flock checks heuristics to limit cgeneration of false positives
Added TCP flow alert generation in case of OOO/retransmission... > 10% of packets
2016-12-17 10:42:06 +01:00
Luca
a16fc2800b Code cleanup 2016-12-16 01:46:07 +01:00
valentina
e3a1962997 Fix: the isPassVerdict is now called just when you have a bridge interface
Added check in order to drop the packets of blacklisted hosts in a bridge interface.
2016-12-16 00:31:36 +01:00
Simone Mainardi
5ded07f5a8 Adds code for batched mysql insertions 2016-12-15 22:53:23 +01:00
Simone Mainardi
2b5da87dff Implements caching of probing alerts preferences 2016-12-14 19:39:28 +01:00
Luca Deri
bb3bb02e08 Added policer check 2016-12-14 17:08:51 +01:00
Luca Deri
1467e59b21 Compilation fix 2016-12-14 17:05:51 +01:00
Luca
b4c75c3202 Flow shaper improvement 2016-12-14 16:21:41 +01:00
Luca
c8abb52456 Restored flow dump during interface alert
Updated flow drop state
2016-12-14 15:53:58 +01:00
Simone Mainardi
82c305de53 Temporarily removes flow dump when interface is alerted 2016-12-14 11:54:50 +01:00
Luca
44e0d1ef0c Modified slack alerts report (more work to do)
Num of engaged alerts is now read upon network interface startup
2016-12-13 16:13:54 +01:00
Luca
25185ce028 While the network interface has at least one engaged interface alert, expired flows are now triggering a flow alert 2016-12-13 01:19:50 +01:00
Luca Deri
ce5fbf2a8e Traffic shaping code cleanup and optimizations 2016-12-10 13:27:42 +01:00
valentina
c0fbce98a5 Network and protocol shaping step 2: Implemented shaping engine 2016-12-09 03:02:34 +01:00
valentina
961b9cbd63 Network and protocol shaping step 1: revert shaping and filtering engine
Code cleanup.
2016-12-08 00:51:21 +01:00
Simone Mainardi
3c410d605c Merges Flow::lua with Flow::print_peers 2016-12-06 18:32:42 +01:00
Luca Deri
be136251d1 Restored periodic flow activities
Minor code cleanup
2016-12-05 15:41:35 +01:00
Luca Deri
5cee98a65c Shaper code cleanup 2016-12-05 13:00:02 +01:00
emanuele-f
d52dc77e36 Implement per-network protocol shaping 2016-11-27 01:50:31 +01:00
Simone Mainardi
0e4e4e5906 Implements flow alerts 2016-11-23 13:10:59 +01:00
emanuele-f
322390648a Create/delete traffic shapers at runtime 2016-11-23 12:40:21 +01:00
Simone Mainardi
262d3ec9ed Fixes segfault due to new dynamic interfaces 2016-11-19 17:31:20 +01:00
Simone Mainardi
129dc18210 Implements alerts origin/target 2016-11-18 18:22:30 +01:00
Simone Mainardi
e6df88e878 Fixes host alert counters 2016-11-14 20:00:27 +01:00
Luca Deri
e838612110 Fixed but that prevented nDPI to be enabled 2016-11-08 19:20:19 +01:00
Luca
480c142dc8 Minor changes 2016-11-04 16:43:20 +01:00
Luca
0c917a45a2 Propedeutic work for #731 2016-10-27 16:56:23 +02:00
emanuele-f
ea2e289e6f Disable host and interface stats update for ZMQ interfaces, needs further review 2016-10-26 19:38:02 +02:00
emanuele-f
bc14efd102 Interpret ZMQ retransmissions/OOO and update counters 2016-10-26 14:32:02 +02:00
Luca Deri
217902fc01 Minor code cleanup 2016-10-14 18:04:03 +02:00
Simone Mainardi
9022b7b1e8 Adds VoIP SIP to RTP flow search 2016-10-14 13:15:07 +02:00
Luca
827a312a5f Resized footer 2016-10-10 09:16:21 +02:00
Luca Deri
97b19c1461 Introduced the concept of Mac hosts (it used to be mixed with L3 hosts). More work is needed to add L2 stats
Host activities are now enabled (and memory allocated) only for local hosts. Fixed bug in activities preferences
Cleaned up various methods
Removed some old unused code
2016-10-02 19:43:13 +02:00
Luca
96e44265e7 Minor changes for #760 2016-09-27 19:13:38 +02:00
Simone Mainardi
cd0db380e3 Reworked flow activities calculation 2016-09-27 18:06:41 +02:00
Emanuele Faranda
4272e6bb37 Fix HTTP detection for multiple requests 2016-09-25 22:08:19 +02:00
Simone Mainardi
b8acfb9400 Removes (Too Early) for ZC flow interfaces 2016-09-23 12:25:56 +02:00
emanuele-f
5a27c35e74 Make activity detection work with recent changes 2016-09-12 11:50:51 +02:00
Luca Deri
17f7bde70b Reworked protocol VMs 2016-09-11 23:42:03 +02:00
Luca Deri
54f15aa322 Reworked code to avoid crash while executing flow callbacks 2016-09-10 09:51:04 +02:00
Luca Deri
9d6d69eb91 TEmporarely disabled flow_update in http 2016-09-09 19:45:11 +02:00
Simone Mainardi
a280e53862 Completes the migration to the stateful alerts 2016-09-06 16:36:05 +02:00
Simone Mainardi
441857d34d Implements stateful network alerts 2016-09-02 14:59:54 +02:00
Simone Mainardi
98b9726585 Prevents a possible null-pointer dereference 2016-09-01 15:56:55 +02:00
emanuele-f
94d964eb71 Fix reassembled data not being reported as SSL data 2016-08-29 01:07:02 +02:00
emanuele-f
179b7f72c8 Remove unsafe code and extend activity framework API 2016-08-27 10:58:58 +02:00