You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
nDPI now reports the protocol ASAP even when specific fields have not yet been dissected because such packets have not yet been observed. This is important for inline applications that can immediately act on traffic. Applications that need full dissection need to call the new API function ndpi_extra_dissection_possible() to check if metadata dissection has been completely performed or if there is more to read before declaring it completed.
TLS (formerly identified as SSL in nDPI v2.x) is now dissected more deeply, certificate validity is extracted as well certificate SHA-1.
nDPIreader can now export data in CSV format with option -C
Available as library and in ndpiReader with option -J
Promoted usage of protocol categories rather than protocol identifiers in order to classify protocols. This allows application protocols to be clustered in families and thus better managed by users/developers rather than using hundred of protocols unknown to most of the people.
Added Inter-Arrival Time (IAT) calculation used to detect protocol misbehaviour (e.g. slow-DoS detection)
Added data analysis features for computign metrics such as entropy, average, stddev, variance on a single and consistent place that will prevent when possible. This should ease traffic analysis on monitoring/security applications. New API calls have been implemented such as ndpi_data_XXX() to handle these calculations.
Initial release of Python bindings available under nDPI/python.
Implemented search of human readable strings for promoting data exfiltration detection
Available as library and in ndpiReader with option -e
Implemented a library to serialize/deserialize data in both Type-Length-Value (TLV) and JSON format
Used by nProbe/ntopng to exchange data via ZMQ
New Supported Protocols and Services
DTLS (i.e. TLS over UDP)
Hulu
TikTok/Musical.ly
WhatsApp Video
DNSoverHTTPS
Datasaver
Line protocol
Google Duo and Hangout merged
WireGuard VPN
IMO
Zoom.us
Improvements
TLS
Organizations
Ciphers
Certificate analysis
Added PUBLISH/SUBSCRIBE methods to SIP
Implemented STUN cache to enhance matching of STUN-based protocols
Dissection improvements
Viber
WhatsApp
AmazonVideo
SnapChat
FTP
QUIC
OpenVPN support for UDP-based VPNs
Facebook Messenger mobile
Various improvements for STUN, Hangout and Duo
Added new categories: CUSTOM_CATEGORY_ANTIMALWARE, NDPI_PROTOCOL_CATEGORY_MUSIC, NDPI_PROTOCOL_CATEGORY_VIDEO, NDPI_PROTOCOL_CATEGORY_SHOPPING, NDPI_PROTOCOL_CATEGORY_PRODUCTIVITY and NDPI_PROTOCOL_CATEGORY_FILE_SHARING
Added NDPI_PROTOCOL_DANGEROUS classification
Fixes
Fixed the dissection of certain invalid DNS responses
Fixed Spotify dissection
Fixed false positives with FTP and FTP_DATA
Fix to discard STUN over TCP flows
Fixed MySQL dissector
Fix category detection due to missing initialization