The ntop project, which develops traffic capture and analysis tools, has released nDPI 4.8, a toolkit for deep packet inspection, continuing the development of the OpenDPI library. The nDPI project was established after an unsuccessful attempt to transfer changes to the OpenDPI repository, which has been left without support. The nDPI code is written in C and is distributed under the LGPLv3 license.
The system allows for the identification of application layer protocols in traffic by analyzing the nature of network activity without being tied to network ports (it can recognize known protocols whose handlers accept connections on non-standard ports, for example, if HTTP is served not from port 80, or conversely, when some other network activity is attempted to be camouflaged as HTTP by running on port 80).
The differences from OpenDPI include support for additional protocols, porting to the Windows platform, performance optimization, adaptation for use in real-time traffic monitoring applications (some specific capabilities that slowed down the engine have been removed), the ability to build as a module for the Linux kernel, and support for subprotocol identification.
The detection of 53 types of network threats (flow risk) and over 350 protocols and applications is supported (from OpenVPN, Tor, QUIC, SOCKS, BitTorrent, and IPsec to Telegram, Viber, WhatsApp, PostgreSQL, and accesses to Gmail, Office 365, Google Docs, and YouTube). A decoder for server and client packets is available. SSL certificates, which allows for protocol identification (for example, Citrix Online and Apple iCloud) using the encryption certificate. To analyze content from pcap dumps or current traffic through the network interface, the nDPIreader utility is provided.
In the new release:
- Memory consumption has been significantly reduced due to a revamped implementation of lists.
- Expanded support for IPv6.
- New protocol identifiers related to adult content, advertising, web analytics, and tracking movements have been added.
- Support for the following protocols and services has been added:
- HAProxy
- Apache Thrift
- RMCP (Remote Management Control Protocol)
- SLP (Service Location Protocol)
- Bitcoin
- HTTP/2 without encryption
- SRTP (Secure Real-time Transport)
- BACnet
- OICQ (Chinese messenger)
- Detection of OperaVPN and ProtonVPN has been added. Wireguard detection has been improved.
- Heuristics for identifying fully encrypted traffic streams have been implemented.
- Detection of Yandex and VK services has been added.
- Detection of Facebook reels and stories has been added.
- Detection of the Roblox gaming platform, NVIDIA GeForce Now cloud service, Epic Games' games, and the game 'Heroes of the Storm' has been added.
- Traffic detection from search engine bots has been improved.
- Improved parsing and identification of protocols and services:
- Gnutella
- H323
- HTTP
- Hangout
- MS Teams
- Alibaba
- MGCP
- Steam
- MySQL
- Zabbix
- The range of detectable network threats and issues related to compromise risks (flow risk) has been expanded. Support for new types of threats has been added: NDPI_MALWARE_HOST_CONTACTED and NDPI_TLS_ALPN_SNI_MISMATCH.
- Fuzz testing has been organized to identify reliability issues.
- Build issues on FreeBSD have been resolved.
Source: opennet.ru
