The nDPI 3.0 deep packet inspection system is available.

Project ntop, developing tools for traffic capture and analysis, announced releasing tools for deep packet inspection nDPI 3.0, continuing the development of the library OpenDPI. The nDPI project was initiated after an unsuccessful attempt to transfer changes to repository OpenDPI, which was left without support. The nDPI code is written in C and is distributed is licensed under LGPLv3.

Project , rather than taking focus. identify application-level protocols in traffic by analyzing the nature of network activity without tying to network ports (can identify known protocols whose handlers accept connections on non-standard network ports, for example, when http is served not from port 80, or conversely, when some other network activity is camouflaged as http by running on port 80).

The differences from OpenDPI are in support for additional protocols, porting for the Windows platform, performance optimization, adaptation for use in real-time traffic monitoring applications (some specific features that slowed down the engine have been removed),
the ability to build as a Linux kernel module and support for subprotocol identification.

In total, it supports the identification of 238 protocols and applications, from
OpenVPN, Tor, QUIC, SOCKS, BitTorrent, and IPsec to Telegram,
Viber, WhatsApp, PostgreSQL, and access to GMail, Office365,
GoogleDocs, and YouTube. It includes a decoder for server and client SSL certificates, allowing the identification of the protocol (e.g., Citrix Online and Apple iCloud) using the encryption certificate. To analyze the content of pcap dumps or current traffic through the network interface, the nDPIreader utility is provided.

$ ./nDPIreader -i eth0 -s 20 -f 'host 192.168.1.10'

Detected protocols:
DNS packets: 57 bytes: 7904 flows: 28
SSL_No_Cert packets: 483 bytes: 229203 flows: 6
FaceBook packets: 136 bytes: 74702 flows: 4
DropBox packets: 9 bytes: 668 flows: 3
Skype packets: 5 bytes: 339 flows: 3
Google packets: 1700 bytes: 619135 flows: 34

In the new release:

• Protocol information is now displayed immediately upon detection, without waiting for full metadata (even when specific fields are not yet parsed due to missing relevant packets), which is crucial for traffic analyzers that need to respond quickly to specific types of traffic. For applications that require full protocol dissection, the API ndpi_extra_dissection_possible() has been proposed, allowing verification that all protocol metadata is defined.
• A deeper TLS dissection has been implemented, extracting details about certificate validity and the SHA-1 hash of the certificate.
• The nDPIreader application now includes the '-C' flag for CSV export, which allows the use of additional ntop tools. to perform fairly complex statistical sampling. For example, to determine the IP of the user who watched movies on Netflix the longest:

  $ ndpiReader -i netflix.pcap -C /tmp/netflix.csv
  $ q -H -d ',' "select src_ip,SUM(src2dst_bytes+dst2src_bytes) from /tmp/netflix.csv where ndpi_proto like '%NetFlix%' group by src_ip"

  192.168.1.7,6151821

• Support for the technique proposed in Cisco Joy to detect malicious activity hidden in encrypted traffic has been implemented, using analysis of packet size and timing/delays. In ndpiReader, the method is activated with the option '-J'. Protocol classification by category has been ensured.
• Support for calculating IAT (Inter-Arrival Time) has been added to identify anomalies in protocol usage, for instance, to detect protocol use during DoS attacks.
• Capabilities for data analysis based on computed metrics such as entropy, mean, standard deviation, and variance have been introduced.
• An initial version of bindings for the Python language has been proposed.
• A mode for detecting readable strings in traffic to identify data leaks has been added. In
• ndpiReader, this mode is enabled with the '-e' option.
  Support for the method of identifying TLS clients
• JA3 , which allows determining what software is used to establish a connection based on the characteristics of connection negotiation and specified parameters (for instance, it can determine the use of Tor and other typical applications), has been added.Support for identifying implementations of SSH (
• HASSH) and DHCP has been added.Functions for serializing and deserializing data in
• Type-Length-Value (TLV) and JSON formats have been added.
  Type-Length-Value (TLV) and JSON formats.
• Support has been added for protocols and services: DTLS (TLS over UDP),
  Hulu,
  TikTok/Musical.ly,
  WhatsApp Video,
  DNSoverHTTPS,
  Datasaver,
  Line,
  Google Duo, Hangout,
  WireGuard VPN,
  IMO,
  Zoom.us.
• Improved support for analyzing TLS, SIP, STUN,
  Viber,
  WhatsApp,
  Amazon Video,
  SnapChat,
  FTP,
  QUIC
  OpenVPN UDP,
  Facebook Messenger and Hangout.

Source: opennet.ru