The ntop project, which develops tools for traffic capture and analysis, has released the nDPI 4.0 toolset, continuing the development of the OpenDPI library. The nDPI project was established after an unsuccessful attempt to submit changes to the OpenDPI repository, which has been left unmaintained. The nDPI code is written in C and is distributed under the LGPLv3 license.
The project allows for the identification of application-level protocols in traffic by analyzing the nature of network activity without being tied to network ports (it can identify known protocols with handlers that accept connections on non-standard network ports, for example, when HTTP is served from a port other than 80, or conversely, when other network activities are camouflaged as HTTP on port 80).
The differences from OpenDPI boil down to support for additional protocols, porting for the Windows platform, performance optimization, adaptation for use in real-time traffic monitoring applications (some specific capabilities that slowed down the engine have been removed), the ability to compile as a Linux kernel module, and support for subprotocol identification.
A total of 247 protocols and applications are supported, ranging from OpenVPN, Tor, QUIC, SOCKS, BitTorrent, and IPsec to Telegram, Viber, WhatsApp, PostgreSQL, and requests to GMail, Office365, GoogleDocs, and YouTube. There is a decoder for server and client protocols, SSL certificates, which allows for protocol identification (for example, Citrix Online and Apple iCloud) using the encryption certificate. To analyze content from pcap dumps or current traffic through the network interface, the nDPIreader utility is provided.
$ ./nDPIreader -i eth0 -s 20 -f "host 192.168.1.10" Detected protocols: DNS packets: 57 bytes: 7904 flows: 28 SSL_No_Cert packets: 483 bytes: 229203 flows: 6 FaceBook packets: 136 bytes: 74702 flows: 4 DropBox packets: 9 bytes: 668 flows: 3 Skype packets: 5 bytes: 339 flows: 3 Google packets: 1700 bytes: 619135 flows: 34
In the new release:
- Improved support for encrypted traffic analysis methods (ETA — Encrypted Traffic Analysis).
- Support has been implemented for the enhanced TLS client identification method JA3+, which allows determining the software used to establish a connection based on the specifics of the connection negotiation and the parameters set (for example, it can identify the use of Tor and other typical applications). Unlike the previously supported JA3 method, JA3+ has a lower rate of false positives.
- The number of identified network threats and issues related to compromise risk has been expanded to 33. New threat identifiers have been added related to desktop and file sharing, suspicious HTTP traffic, malicious JA3 and SHA1, requests to problematic domains and autonomous systems, and the use of TLS certificates with dubious extensions or excessively long validity periods.
- Significant performance optimization has been carried out; compared to version 3.0, traffic processing speed has increased by 2.5 times.
- GeoIP support for location determination has been added. IP address.
- An API for calculating the RSI (Relative Strength Index) has been introduced.
- Fragmentation management tools have been implemented.
- An API for calculating stream homogeneity (jitter) has been added.
- Support has been added for the following protocols and services: AmongUs, AVAST SecureDNS, CPHA (CheckPoint High Availability Protocol), DisneyPlus, DTLS, Genshin Impact, HP Virtual Machine Group Management (hpvirtgrp), Mongodb, Pinterest, Reddit, Snapchat VoIP, Tumblr, Virtual Assistant (Alexa, Siri), Z39.50.
- Parsing and protocol recognition for the following has been improved: AnyDesk, DNS, Hulu, DCE/RPC, dnscrypt, Facebook, Fortigate, FTP Control, HTTP, IEC104, IEC60870, IRC, Netbios, Netflix, Ookla speedtest, openspeedtest.com, Outlook / MicrosoftMail, QUIC, RTSP, RTSP via HTTP, SNMP, Skype, SSH, Steam, STUN, TeamViewer, TOR, TLS, UPnP, wireguard.
Source: opennet.ru
