./net/ndpi, Library for deep-packet inspection

[ CVSweb ] [ Homepage ] [ RSS ] [ Required by ] [ Add to tracker ]


Branch: CURRENT, Version: 2.8, Package name: ndpi-2.8, Maintainer: adam

nDPI is an open source LGPLv3 library for deep-packet inspection. Based on
OpenDPI it includes ntop extensions. We have tried to push them into the OpenDPI
source tree but nobody answered emails so we have decided to create our own
source tree.


Required to run:
[textproc/json-c]

Required to build:
[pkgtools/cwrappers]

Master sites:

SHA1: 5b5f613cf55deeb040483f7c04ede7a2ed415c26
RMD160: c26bfadeee1db4abbf86a06fdfa338cbfaf42d9b
Filesize: 19291.236 KB

Version history: (Expand)


CVS history: (Expand)


   2019-07-12 11:30:34 by Adam Ciarcinski | Files touched by this commit (10) | Package updated
Log message:
ndpi: updated to 2.8

2.8 Stable

New Supported Protocols and Services
* Added Modbus over TCP dissector

Improvements
* Wireshark Lua plugin compatibility with Wireshark 3
* Improved MDNS dissection
* Improved HTTP response code handling
* Full dissection of HTTP responses

Fixes
* Fixed false positive mining detection
* Fixed invalid TCP DNS dissection
* Releasing buffers upon realloc failures
* ndpiReader: Prevents references after free
* Endianness fixes
* Fixed IPv6 HTTP traffic dissection
* Fixed H.323 detection

Other
* Disabled ookla statistics which need to be improved
* Support for custom protocol files of arbitrary length
* Update radius.c to RFC2865
   2018-10-18 18:24:29 by Adam Ciarcinski | Files touched by this commit (9) | Package updated
Log message:
ndpi: updated to 2.4

2.4 Stable:
New Supported Protocols and Services
------------------------------------
Showmax.com
Musical.ly
RapidVideo
VidTO streaming service
Apache JServ Protocol
Facebook Messenger
FacebookZero protocol

Improvements
------------
Improved YouTube support
Improved Netflix support
Updated Google Hangout detection
Updated Twitter address range
Updated Viber ports, subnet and domain
Updated AmazonVideo detection
Updated list of FaceBook sites
Initial Skype in/out support
Improved Tor detection
Improved hyperscan support and category definition
Custom categories loading, extended ndpiReader (-c <file>) for loading \ 
name-based categories

Fixes
-----
Fixes for Instagram flows classified as Facebook
Fixed Spotify detection
Fixed minimum packet payload length for SSDP
Fixed length check in MSN, x-steam-sid, Tor certificate name
Increase client's maximum payload length for SSH
Fixed end-of-line bounds handling
Fixed substring matching
Fix for handling IP address based custom categories
Repaired wrong timestamp calculation
Fixed memory leak
Optimized memory usage

Other/Changes
-------------
New API calls:
ndpi_set_detection_preferences()
ndpi_load_hostname_category()
ndpi_enable_loaded_categories()
ndpi_fill_protocol_category()
ndpi_process_extra_packet()
Skype CallIn/CallOut are now set as Skype.SkypeCallOut Skype.SkypeCallIn
Added support for SMTPS on port 587
Changed RTP from VoIP to Media category
Added site unavailable category
Added custom categories CUSTOM_CATEGORY_MINING, CUSTOM_CATEGORY_MALWARE, \ 
CUSTOM_CATEGORY_ADVERTISEMENT, CUSTOM_CATEGORY_BANNED_SITE
Implemented hash-based categories
Converted some not popular protocols to NDPI_PROTOCOL_GENERIC with category detection
   2017-11-06 14:29:38 by Thomas Klausner | Files touched by this commit (1)
Log message:
ndpi: follow redirect
   2017-06-15 12:06:39 by Filip Hajny | Files touched by this commit (3)
Log message:
Fix ndpi build on SunOS.
   2016-07-01 06:51:57 by Adam Ciarcinski | Files touched by this commit (1)
Log message:
Added patches/patch-configure.ac
   2016-07-01 06:51:15 by Adam Ciarcinski | Files touched by this commit (10)
Log message:
Changes 2.4:
* Memory-management, stability and speed have been fundamentally improved
* We have kept an eye on security and hardened the code to prevent privileges \ 
escalation and XSS
* Alerts have been extended to include support for
  . Re-arming to avoid raising trains of identical alerts in short periods of time
  . Alert propagation to the infrastructure monitoring software Nagios
  . CIDR-based triggers to monitor the behavior of whole networks
  . The detection of suspicious probing attempts
* Netfilter support has been added together with optional packet dropping features
* Routing visibility is now possible through RIPE RIS
* Availability of fine-grained historical data drill-down features, including \ 
top talkers, top applications, and interactions between hosts (more details \ 
here)
* Integrations with other software
  . LDAP authentication support
  . alerts forwarding/withdrawal to Nagios
  . nBox integration to request full packet pcaps of monitored flows
  . Data export to Apache Kafka
* We have extended and improved traffic monitoring
  . Visibility of TCP sessions throughput estimations and state breakdown (e.g., \ 
connections established, connections reset, etc.)
  . Goodput monitoring
  . Trends detection
  . Highlight of low-goodput flows and hosts
  . Visibility of hosts top-visited sites
* Built-in support is now included for
  . GRE detunnelling
  . per-VLAN historical statistics
  . ICMP and ICMPv6 dissection
* We have extended the set of supported OSes to include: Ubuntu 16, Debian 7, EdgeOS
* There is also an optional support for hosts categorization via service \ 
flashstart.it
   2016-04-08 18:51:23 by Adam Ciarcinski | Files touched by this commit (6)
Log message:
nDPI is an open source LGPLv3 library for deep-packet inspection. Based on
OpenDPI it includes ntop extensions. We have tried to push them into the OpenDPI
source tree but nobody answered emails so we have decided to create our own
source tree.