{"id":54460,"date":"2019-12-26T00:00:00","date_gmt":"2019-12-25T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/dostupna-sistema-glubokogo-inspektirovaniya-paketov-ndpi-3-0"},"modified":"2020-02-18T14:02:28","modified_gmt":"2020-02-18T11:02:28","slug":"dostupna-sistema-glubokogo-inspektirovaniya-paketov-ndpi-3-0","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dostupna-sistema-glubokogo-inspektirovaniya-paketov-ndpi-3-0","title":{"rendered":"The nDPI 3.0 deep packet inspection system is available.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Project ntop<\/a><\/noindex>, developing tools for traffic capture and analysis, announced<\/a><\/noindex> releasing tools for deep packet inspection nDPI 3.0<\/a><\/noindex>, continuing the development of the library OpenDPI<\/a><\/noindex>. The nDPI project was initiated after an unsuccessful attempt to transfer changes to repository<\/a><\/noindex> OpenDPI, which was left without support. The nDPI code is written in C and is distributed<\/a><\/noindex> is licensed under LGPLv3.<\/p>\n

Project , rather than taking focus.<\/a><\/noindex> identify application-level protocols in traffic by analyzing the nature of network activity without tying to network ports (can identify known protocols whose handlers accept connections on non-standard network ports, for example, when http is served not from port 80, or conversely, when some other network activity is camouflaged as http by running on port 80). <\/p>\n

The differences from OpenDPI are in support for additional protocols, porting for the Windows platform, performance optimization, adaptation for use in real-time traffic monitoring applications (some specific features that slowed down the engine have been removed),
\nthe ability to build as a Linux kernel module and support for subprotocol identification. <\/p>\n

In total, it supports the identification of 238 protocols and applications, from
\nOpenVPN, Tor, QUIC, SOCKS, BitTorrent, and IPsec to Telegram,
\nViber, WhatsApp, PostgreSQL, and access to GMail, Office365,
\nGoogleDocs, and YouTube. It includes a decoder for server and client SSL certificates, allowing the identification of the protocol (e.g., Citrix Online and Apple iCloud) using the encryption certificate. To analyze the content of pcap dumps or current traffic through the network interface, the nDPIreader utility is provided.<\/p>\n

$ .\/nDPIreader -i eth0 -s 20 -f \"host 192.168.1.10\"<\/p>\n

Detected protocols:
\n DNS packets: 57 bytes: 7904 flows: 28
\n SSL_No_Cert packets: 483 bytes: 229203 flows: 6
\n FaceBook packets: 136 bytes: 74702 flows: 4
\n DropBox packets: 9 bytes: 668 flows: 3
\n Skype packets: 5 bytes: 339 flows: 3
\n Google packets: 1700 bytes: 619135 flows: 34<\/p>\n

In the new release:<\/p>\n