Commit graph

447 commits

Author SHA1 Message Date
Luca Deri
599835c72f Reworked IEC104 implementation 2020-11-27 22:34:50 +01:00
Luca Deri
17266b71a6 Extended flow alert JSON 2020-11-17 17:04:11 +01:00
Luca Deri
83816cefae Zero window alert improvement 2020-11-07 00:41:02 +01:00
Luca
bac9ee8701 Optimized TCP window memory usage 2020-11-05 19:32:39 +01:00
Matteo Biscosi
e5a48cb5d2
TCP Zero Window alert from issue #3417 (#4684)
* Added no_if_activity alert to user script keys

* Added no_if_activity description alert

* Fixes #4648 trigger an alert when no flows are collected

* Changed the time past one call of the alert and an other

* Fixes #4648 reorganized files and cache management

* Added status flow check regarding issue #3417

* Removed debug code

Co-authored-by: matteo <biscosi@ntop.org>
Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
2020-11-05 18:20:09 +01:00
Luca Deri
82fab91a2e
Merge pull request #4604 from Wallace4/retry_project
Retransmissions Plugin updated
2020-10-25 18:18:57 +01:00
Simone Mainardi
a2705a8bda Implements header and drilldown of flow status severities 2020-10-19 19:26:30 +02:00
Simone Mainardi
d7f1ce0d8c Reworks and optimizes flow alerted status 2020-10-19 16:50:22 +02:00
Wallace4
ca88369ef3 New version of retransmission plugin, fixed and tested 2020-10-19 16:40:22 +02:00
Simone Mainardi
d3dda0bb82 Unifies misbehaving with alerted flows
Implements #4596
2020-10-16 18:58:20 +02:00
Simone Mainardi
adfec81477 Simplifies idling of flows for views 2020-10-15 09:03:01 +02:00
Alfredo Cardigliano
3aae425731 Print device ID in flow details (when available) 2020-10-13 17:17:17 +02:00
Simone Mainardi
7320c8266c Adds throughput estimation via ZMQ
Implements #3508
2020-10-06 19:28:11 +02:00
Simone Mainardi
891e52c1ef Adds comments for flow status / alerted status 2020-10-02 17:03:47 +02:00
Simone Mainardi
fdf0f15140 Fixes races in view interfaces and cli/srv scores
Fixes #4513
Fixes #4512
2020-10-02 16:34:28 +02:00
Simone Mainardi
0db456c0cf Reworks flow user scripts execution in C++ 2020-09-30 18:41:36 +02:00
Simone Mainardi
90a5a57b36 Implements user script queues (avoids 5-sec HT walk) 2020-09-28 11:45:00 +02:00
Simone Mainardi
6e0c369fa9 Handles flow dump queues in view interfaces - and fixes races 2020-09-25 14:10:06 +02:00
Simone Mainardi
7f2a9b1420 Decouples flow dump from user scripts execution
Addresses #3545
2020-09-24 19:29:00 +02:00
Simone Mainardi
814ee67cf9 Reworks nDPI Risks flow plugins to handle all risks and scores
Fixes #4432
2020-09-23 17:58:51 +02:00
Luca Deri
55d8e299fa Cleanued up code for flow score 2020-09-23 10:51:36 +02:00
Luca Deri
c7b7f2ee1b Minor cleanup 2020-09-23 09:35:32 +02:00
Simone Mainardi
a9a323acf1 Reworks (simplifies) hosts score calculation
Fixes #4459
Fixes #4460
2020-09-22 15:46:38 +02:00
Simone Mainardi
841dacd4cd Simplifies per-category host score 2020-09-21 11:44:00 +02:00
Simone Mainardi
db0d7730a8 Implements per-category host score
Implements #4413
2020-09-18 18:34:28 +02:00
Luca Deri
6cd3ebcc3b Flow dump code rework 2020-09-11 15:58:33 +02:00
Luca Deri
4648dfffe1 Implemented full IEC 104 handling 2020-09-08 20:03:20 +02:00
Luca Deri
9fe21dac15 Added IEC 104 handling 2020-09-04 16:58:44 +02:00
Simone Mainardi
941da6819f Implements HTTP method using enum ndpi_http_method 2020-08-27 10:04:58 +02:00
Luca Deri
0bd6f1353a Added support for flow risk over ZMQ 2020-08-26 23:03:00 +02:00
Simone Mainardi
00c428eb1a Fixes heap-use-after-free on HTTP dissected last_url
Fixes #4328
2020-08-26 11:17:07 +02:00
Luca Deri
522fafc6df Added new flow call (to be used in scripts for instance) that allows from Lua to set a custom
info message.
Example: flow.setCustomInfo("hello world")
2020-08-04 19:00:40 +02:00
Simone Mainardi
21d151a404 Implements HTTP stats over ZMQ
Fixes #4152
2020-07-29 11:07:35 +02:00
Simone Mainardi
ec9d092423 Fixes DNS stats when collecting from ZMQ
Fixes #4148
2020-07-29 10:40:53 +02:00
Simone Mainardi
d33c1b23d7 Optimizes stats refresh calc for large flows 2020-07-27 18:51:20 +02:00
Simone Mainardi
1baa7d6cc4 Avoids double 5-sec HT-walks to update stats 2020-07-27 14:22:59 +02:00
Luca Deri
ce1309853f Refactored idle code: now it should be easier to read and understand.
Idle lifecycle has been modified to make it more efficient
2020-07-23 12:56:30 +02:00
Alfredo Cardigliano
b0c6ec0a84 Add tos to flow json (including elk) 2020-07-21 12:37:02 +02:00
Alfredo Cardigliano
0a84d0706e Add DSCP stats to the host, new DSCPStats class 2020-07-17 18:05:11 +02:00
Alfredo Cardigliano
2364e73345 DSCP utiliti functions 2020-07-17 10:40:38 +02:00
Luca Deri
1f2f1fd25d BA improvemements 2020-07-14 18:14:59 +02:00
Luca Deri
0fb01440b0 Implemented flow entropy 2020-07-14 12:49:47 +02:00
Alfredo Cardigliano
354866d16a Remove aggregated flows 2020-07-03 17:17:33 +02:00
Luca Deri
70c0601dfa Implemented DSCP/TOS collection, dissection and report 2020-06-25 23:23:04 +02:00
Simone Mainardi
d481465e72 Fixes flow exporter filtering
Fixes #4033
2020-06-12 10:59:23 +02:00
Simone Mainardi
4ffa3e2ca7 Adds SNMP information in flow_details.lua 2020-06-10 17:10:30 +02:00
Luca Deri
e87d13f260 Refreshed nDPI flow risk implementation 2020-05-16 00:26:09 +02:00
Simone Mainardi
058f2a32be Uses nDPI-calculated risks for TLS alerts 2020-05-15 11:54:18 +02:00
Luca Deri
d29492a89e Added support for flow risk reported by nDPI 2020-05-12 00:34:46 +02:00
Luca Deri
698265c4fb Added TLS issuerDN, subjectDN 2020-05-07 19:06:13 +02:00