The ntop project, which develops tools for traffic capture and analysis, has released the nDPI 5.0 toolkit for deep packet inspection, continuing the development of the OpenDPI library. The nDPI project was initiated after an unsuccessful attempt to transfer changes to the OpenDPI repository, which remained unsupported. The nDPI code is written in C and is distributed under the LGPLv3 license.
The system allows for the identification of application layer protocols in traffic by analyzing the nature of network activity without binding to network ports (it can identify known protocols whose handlers receive connections on non-standard network ports, for example, when HTTP is served not from port 80, or conversely, when some other network activity is camouflaged as HTTP running on port 80).
The differences from OpenDPI include support for additional protocols, porting to the Windows platform, performance optimization, adaptation for use in real-time traffic monitoring applications (some specific capabilities that slowed down the engine have been removed), the ability to build as a module for the Linux kernel, and support for subprotocol identification.
The detection of 56 types of network threats (flow risk) and more than 450 protocols and applications is supported (from OpenVPN, Tor, QUIC, SOCKS, BitTorrent and IPsec to Telegram, Viber, WhatsApp, PostgreSQL, as well as calls to Gmail, Office 365, Google Docs, and YouTube). There is a decoder for both server and client. SSL certificates, which allows for protocol identification (for example, Citrix Online and Apple iCloud) using the encryption certificate. To analyze content from pcap dumps or current traffic through the network interface, the nDPIreader utility is provided.
In the new release:
- A universal mechanism for traffic identification has been implemented, combining TCP fingerprint metadata, TLS certificate hashes, and JA4 (identifiers for identifying network protocols and applications) into a single traffic fingerprint. The new mechanism allows for more accurate identification and matching of encrypted or obfuscated traffic.
- The ability to identify TLS, QUIC, and HTTP streams where hostnames are present (e.g., in SNI for TLS/QUIC and in the Host header for HTTP), for which DNS resolution was previously not performed, has been added. Such activity can be used to detect anomalies, hidden data transmission channels, and filtering bypass methods.
- The limit on the number of identifiable protocols and traffic categories has been raised to 2^16, allowing for the identification of virtually unlimited protocols during traffic inspection. All available protocols are now included by default.
- New options have been added to the rules for classifying traffic based on fingerprints, JA4 application and protocol identifiers, HTTP URLs, and categories.
- Improved support for First Packet Classification (FPC) technology, aimed at identifying protocols, applications, and services based on the first packet sent during the connection establishment. FPC significantly reduces CPU load during traffic inspection.
- Support for pseudoprotocols such as ADULT_CONTENT, LLM, and ADS_ANALYTICS_TRACK has been removed, and classification based on categories is now used instead.
- Support has been added for new protocols, including Microsoft Delivery Optimization, Rockstar Games, Kick.com, MELSEC, Hamachi, GLBP, Matter, TriStation, Samsung SDP, ESPN, and Akamai.
- New subcategories have been added and the classification of Amazon/AWS services has been expanded.
- Approximately 30 new categories have been added and traffic analysis has been enhanced.
- A data block size analyzer for TLS connections has been added.
- The ability to create protocol stacks covering two or more protocols for traffic classification has been added.
- New APIs for traffic ranking and encoding/decoding hexadecimal sequences have been added.
- Lists of bots, network scanners, and mining pools have been updated.
- The code for parsing HTTP, TLS, and STUN protocols has been updated.
- Initialization has been accelerated and memory management efficiency has improved.
Source: opennet.ru
