fix: nDPI v5.0.0 upgrade, protocol detection fixes (VLAN/PIM/IGMP/H.245), responsive hex viewer & packet table#84
Merged
NotYuSheng merged 3 commits intomainfrom Mar 28, 2026
Conversation
…GMP/H.245 - Upgrade ndpiReader from Ubuntu 22.04's libndpi-bin 4.2-2 to nDPI 5.0.0 from ntop's apt repository (packages.ntop.org/apt-stable/22.04/). nDPI 5.0.0 includes H.225 session tracking, so dynamically negotiated H.245 ports are now correctly classified as H323/VoIP instead of Cassandra. - Remove correctMisclassification() workaround in NdpiService — nDPI 5.0.0 handles H.225/H.245 natively so the port-based override is no longer needed. - Extend FLOW_LINE regex from (TCP|UDP) to (\w+) so non-TCP/UDP protocols (IGMP, GRE, OSPF, PIM, SCTP) are parsed from ndpiReader output. Port 0 emitted by ndpiReader for portless protocols is normalised to null. Portless flows are also indexed by IP pair for fallback resolution. - Add raw-byte VLAN unwrapping (802.1Q and QinQ) in PcapParserService to handle pcap4j not registering Dot1qVlanTagPacket in the EtherType factory. Supports VLAN→IP and VLAN→PPPoE→IP (resolves SIP/RTP/H.225 on VLAN nets). - Add BSD null/loopback (DLT=0), raw IP (DLT=12), and Linux SLL (DLT=113) link-layer handlers so PIM and other protocols on those capture types are correctly decoded. - Add resolveVlanInnerProtocolName() for human-readable protocol labels on non-IP VLAN frames (ARP, LLDP, PPPoE-Discovery, LLC, etc.). Closes #83 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
HexViewer:
- Replace hardcoded BYTES_PER_ROW with ResizeObserver-driven calculation.
A hidden ruler span ("XX " — 3 monospace chars) measures the exact character
width at the rendered font size; bytes-per-row is recalculated whenever the
container resizes, snapped to multiples of 8 (min 8).
- Formula: line = 8 + N×4 chars (4 offset + 2 gap + N×3 hex + 2 gap + N ascii),
correctly preserving the standard 3:1 hex-to-ascii width ratio.
ConversationDetail packet stream table:
- Switch to table-layout: fixed with <colgroup> percentage widths so columns
scale with the modal rather than being fixed pixel sizes.
- Add text-overflow: ellipsis + title attributes on source, destination,
timestamp, and info cells to truncate long content gracefully.
- Remove table-responsive horizontal-scroll wrapper (no longer needed with
fixed layout); keep overflow-y scroll + sticky header on the same container.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request enhances protocol detection and packet parsing by updating the backend to a newer nDPI version and adding manual support for VLAN, PPPoE, and various link-layer types like BSD loopback and Linux SLL. It also introduces a responsive hex viewer in the frontend that dynamically adjusts its layout based on the container width. Feedback suggests optimizing the Docker image size by removing temporary build dependencies, improving error handling by logging exceptions during packet parsing, and refactoring protocol resolution logic into a switch statement for better maintainability.
- Purge curl and gnupg after ntop repo setup to reduce image size; ca-certificates is retained as a runtime dependency. Note: rm -rf /var/lib/apt/lists/* is intentionally omitted — BuildKit cache mounts on /var/cache/apt and /var/lib/apt already handle cleanup. - Replace silent catch(Exception ignored) blocks with log.debug() calls in BSD loopback, raw IP, Linux SLL, and VLAN unwrap handlers so malformed packets surface during troubleshooting. - Refactor resolveVlanInnerProtocolName() if-chain to a switch statement. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
NotYuSheng
deleted the
fix/protocol-detection-ndpi-v5-hex-viewer-responsive
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
libndpi-bin4.2-2 to nDPI 5.0.0 via ntop's apt repository, which includes H.225 session tracking — dynamically negotiated H.245 ports are now correctly classified asH323/VoIPinstead ofCassandracorrectMisclassification()port-override workaround inNdpiService(nDPI 5.0.0 handles this natively)VLAN→IPandVLAN→PPPoE→IPsince pcap4j doesn't registerDot1qVlanTagPacketin its EtherType factoryFLOW_LINEregex from(TCP|UDP)to(\w+)so IGMP, GRE, OSPF, PIM, and other portless protocols are enriched by nDPI; port0is normalised tonullfor non-TCP/UDP flowsNdpiServicefor portless flow resolutionHexVieweris now fully responsive: aResizeObserver+ hidden ruler span dynamically recalculates bytes-per-row as the container resizes, honouring the standard 3:1 hex-to-ascii character ratioConversationDetailswitches totable-layout: fixedwith<colgroup>percentage widths andtext-overflow: ellipsison long cellsTest plan
h245-rtp.pcap(VLAN + H.225/H.245/RTP/PIM/IGMP) — H.225 flows on port 1720 showH323/VoIP; dynamically negotiated H.245 port showsH323/VoIP(notCassandra)voip-final.pcapng(VLAN→PPPoE→IP) — SIP and RTP conversations appear with correct app labelspim-reg.cap(BSD null/loopback) — PIM conversations appear withIP_PIM/Networkapp=IGMP, cat=Network(not empty)Closes #83
🤖 Generated with Claude Code