feat: nDPI application-layer identification (#40)#47
Conversation
Integrates ndpiReader subprocess to identify 300+ application protocols (Zoom, WhatsApp, Telegram, etc.) per conversation in uploaded PCAP files. - Backend: NdpiService runs ndpiReader -i <file> -v 2, parses per-flow text output, and enriches ConversationInfo with appName - DB: V4 migration adds app_name column to conversations table - DTOs/Entity: appName propagated through all response types - Docker: switched runtime base to ubuntu jammy for libndpi-bin support, added DEBIAN_FRONTEND=noninteractive to fix tshark debconf hang, added BuildKit apt cache mounts for faster rebuilds - Frontend: appName surfaces in Conversations table (badge column), Conversation detail panel, Network topology edge labels, and Overview "Applications Detected" pill badges - Sample PCAPs: added Telegram, WhatsApp, Zoom, Signal, Discord, Teams, Viber samples from ntop/nDPI test suite Closes #40 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces application-layer protocol identification using nDPI. It includes a new NdpiService that runs ndpiReader as a subprocess to enrich network conversations with application names (e.g., Zoom, WhatsApp). The backend has been updated to store and serve this data, and the frontend now displays application labels in the conversation list, details, and analysis overview. Additionally, the LLM story generation prompt was enhanced to include protocol breakdowns and top conversations. Feedback suggests improving error handling in NdpiService by logging the full exception and capturing the standard error stream, as well as centralizing the application color logic in the frontend for better maintainability.
- NdpiService: drain stderr to logger at DEBUG level instead of discarding, so ndpiReader diagnostics are visible when troubleshooting - NdpiService: pass full exception to log.warn() to include stack trace - Frontend: extract shared getAppColor() utility (src/utils/appColors.ts) used by ConversationList, ConversationDetail, and AnalysisOverview, eliminating three copies of the hardcoded color fallback Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 participant
Summary
ndpiReaderas a subprocess to identify 300+ application protocols (Zoom, WhatsApp, Telegram, Signal, Discord, Teams, Viber, etc.) per conversationlibndpi-binis available; fixes tshark debconf hang withDEBIAN_FRONTEND=noninteractive; adds BuildKit apt cache mounts for faster rebuildsappNameacross the frontend: Conversations table badge column, Conversation detail panel, Network topology edge labels, and Overview "Applications Detected" pill badgesTest plan
sample-files/telegram.pcap→ Overview should show "Telegram" badge; Conversations table should show Application column with purple badgesample-files/zoom.pcap→ Overview should show "Zoom" badge in blue (#2D8CFF)sample-files/whatsapp.pcap→ "WhatsApp" badge in green (#25D366)docker compose buildcompletes without hanging and is faster on subsequent builds due to apt cacheCloses #40
🤖 Generated with Claude Code