-
Notifications
You must be signed in to change notification settings - Fork 71
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Matching not correct. #1
Comments
I got it working on ubuntu 14.04 and 12.04. It work's. compiles and let me use iptables targets but. I don't think it's doing what it is supposed to do. |
I did some tests yesterday and it has worked for me. iptables -I INPUT -m ndpi --http -j DROP iptables -I INPUT -m ndpi --ssh -j DROP iptables -I OUTPUT -m ndpi --rdp -j DROP Unfortunately, I noticed that the choice of the proper chain depends on the flow through which data was received. And, unless you recompile the kernel with the patch, the module nf_conntrack_netlink can not be loaded into memory (but you will have problems with conntrack tool). |
root@humberto-XPS-8300: root@humberto-XPS-8300:~# cat /etc/os-release |
For ssh you must have at INPUT (or http). The signature is in the response. For routed traffic you probably will not have any problem because the rule may cover both directions, but be careful to define the flow in the rule. |
I have been testing it and you are correct. |
Yes... and this is an old problem! Apparently, it is more safe and guaranteed to work with protocols where there was a specific module build (ftp_data, http, rdp and others). Most filters in nDPI/src/lib/ndpi_content_match.c.inc or do not work well or take unwanted action. When I filter for twitter, several sites that reference it did not open. This is certainly a problem. |
It works well for protocols in /usr/src/nDPI/src/lib/protocols/ |
I have no idea. I will get some pcaps and see why is matchin twitter and not the others. |
In ntop everything works like a charm, I guess they do analisis of the entire network flow matching the criteria. |
It's different. I think that the filters in ndpi_content_match.c.inc are internal for nDPI and netfilter can not use them because it depends on which modules are compiled and integrated. The url filters is also indicated in Squid or other proxy. |
I'm building against 8323 and it's not matching anything... This is the most recent nDPI I can get the build module to load. |
Hi, Unfortunately this module is incompatible with nf_conntrack_netlink. And, unless you recompile the kernel with the patch, the module rmmod nf_conntrack_netlink 2014-11-13 15:22 GMT-03:00 syadnom notifications@github.com:
|
I will make several fixes as soon and protocol id bugfix too. |
Hello, |
I tested this too. I found it's working for some few protocols such as SSL, http, ftp. But one of the most important protocol, youtube ( specifically youtube over SSL ) is not working at all. I just add an iptables rule,
Matches nothing. But when I run ndpiReader -i interface, it picks up youtube traffic |
same for me. Did you founded solution? |
Hi, I'm working in a patch for the latest nDPI version and i will include support I'll probably update the repository tomorrow. 2015-06-11 4:49 GMT-04:00 Mile-Lile notifications@github.com:
|
Working to me when I enable first a SSL Rule. But Skype don't. André Luiz R. Ferreira - NETDEEP -----Mensagem Original----- Hi, I'm working in a patch for the latest nDPI version and i will include support I'll probably update the repository tomorrow. 2015-06-11 4:49 GMT-04:00 Mile-Lile notifications@github.com:
— |
@betolj |
The "ndpi-netfilter" projects with logical structure based on "ewildgoose" model don't work well nowadays.
I finished xt_ndpi fixes today:
My tests, showed satisfactory results. |
Thx again! |
how to block particular http/https urls by using ndpi |
I think I found that protocols don't match the protocol name with the actual protocol being described.
I guess you fixed ewildgoose version by adding to xt_ndpi.h
NDPI_PROTOCOL_LONG_STRING
NDPI_PROTOCOL_SHORT_STRING
which does the matching of the protocol names in iptables -m ndpi --[protocol name]
This was usualy done in older versions of the nDPI library. But those constants are no longer part of the nDPI library.
I will try with an older nDPI to get it to work. Otherwise it should be fixed to work with newer versions of the nDPI library since they don't match protocols with NDPI_PROTOCOL_LONG_STRING
NDPI_PROTOCOL_SHORT_STRING any more.
The text was updated successfully, but these errors were encountered: