The ntop project, which develops tools for traffic capture and analysis, has released the nDPI 6.0 toolkit for deep packet inspection, continuing the development of the OpenDPI library. The nDPI project was established after an unsuccessful attempt to transfer changes to the OpenDPI repository, which was left without maintenance. The nDPI code is written in the C language and is distributed under the LGPLv3 license.
The system allows for the identification of application layer protocols in traffic by analyzing the nature of network activity without binding to network ports (it can identify known protocols whose handlers receive connections on non-standard network ports, for example, when HTTP is served not from port 80, or conversely, when some other network activity is camouflaged as HTTP running on port 80).
The differences from OpenDPI include support for additional protocols, porting to the Windows platform, performance optimization, adaptation for use in real-time traffic monitoring applications (some specific capabilities that slowed down the engine have been removed), the ability to build as a module for the Linux kernel, and support for subprotocol identification.
It supports the identification of 56 types of network threats (flow risk) and over 450 protocols and applications (from OpenVPN, Tor, QUIC, SOCKS, BitTorrent, and IPsec to Telegram, Viber, WhatsApp, PostgreSQL, and requests to Gmail, Office 365, Google Docs, and YouTube). There is a decoder for server and client certificates, allowing the protocol to be identified (for example, Citrix Online and Apple iCloud) using the encryption certificate. To analyze the contents of pcap dumps or current traffic through the network interface, the nDPIreader utility is provided. SSL-certificates, allowing protocol identification (for example, Citrix Online and Apple iCloud) using the encryption certificate. To analyze the contents of pcap dumps or current traffic through the network interface, the nDPIreader utility is provided.
In the new release:
- The licensing conditions have changed. The core nDPI library continues to be provided under the LGPLv3 license, but some traffic parsing modules, such as DNS, QUIC, and TLS, have been transitioned to a dual license: LGPLv3 for non-commercial projects and a commercial license for projects used for profit.
- The ability to detect and block DoS attacks of the Slowloris, Slow POST, and Slow GET classes has been added, in which the client receives a response or sends a request very slowly, neither closing the connection nor allowing a timeout interruption, which allows exhausting the limit on the number of active connections.
- Increased reliability of JA4 traffic fingerprinting, which allows the identification of malicious activity. To reduce the likelihood of false positives, selective computation of JA4 hashes has been implemented, which does not cover some session-dependent TLS extensions, such as the extension for session resumption using pre-shared keys (PSK), thereby reducing the uniqueness of JA4 hashes.
- Support for the Userland Statically Defined Tracing (USDT) tracing mechanism has been added, which integrates into the application without creating additional load when switched off. USDT allows inspection of nDPI operation using bpftrace and perf utilities on devices servers without using separate debug builds.
- Support for inspecting Meshtastic, libp2p, YGGDRASIL, and Nebula protocols used in overlay and mesh networks has been added.
- The ability to classify data in JSON and MsgPack formats has been implemented, along with the separation of activities related to different GitHub services (Copilot, Packages, Actions) and Proton (Mail, Pass, Drive, Calendar, Docs, Wallet, Lumo, Meet).
- Support for identifying voice and video call traffic has been added.
- New content control categories have been proposed: children, search engines, violence, drugs, and weapons.
Source: opennet.ru
