add signature to identify Mpeg-DASH(Dynamic Adaptive Streaming over HTTP) application

[Douina]

mpeg-DASH is one of video streaming application. I am planning to add signature to identify DASH,
I had tried to create new dissector of dash i was following steps in https://github.com/ntop/nDPI#how-to-add-a-new-protocol-dissector but NDPI still don't know Dash,
please can any one help me to add new signature DASH

[utoni]

You can also use already existing commits that implement new protocol detections e.g. 1c2a0c3, abd6bce or b4a8c8c as "template".

To give you a more detailed answer, your question needs to be more specific.

P.S.: Did you re-run ./autogen.sh after adding your protocol detection?

[Douina]

thanks for reply, yes i did run ./autogensh, but i didn't define my protocol in dash.c :

#include "ndpi_protocol_ids.h"
#define NDPI_CURRENT_PROTO NDPI_PROTOCOL_DASH
#include "ndpi_api.h"
void ndpi_search_dash(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) {
    struct ndpi_packet_struct *packet = &flow->packet;
     NDPI_LOG_DBG(ndpi_struct, "search dash\n");
      NDPI_LOG_INFO(ndpi_struct, "found dash\n");
       ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DASH, NDPI_PROTOCOL_UNKNOWN);
NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
}
void init_dash_dissector(struct ndpi_detection_module_struct *ndpi_struct,
                             u_int32_t *id,
                             NDPI_PROTOCOL_BITMASK *detection_bitmask) {
    ndpi_set_bitmask_protocol_detection("dash", ndpi_struct, detection_bitmask, *id,
                                        NDPI_PROTOCOL_DASH,
                                        ndpi_search_dash,
                                        NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD,
                                        SAVE_DETECTION_BITMASK_AS_UNKNOWN,
                                        ADD_TO_DETECTION_BITMASK);
    *id += 1;
}**

also i have to define if the http-url ends with ".mpd" so that is an application dash ,but i dont know how to do that
please can you help me

[utoni]

I recommend that if you want to check for HTTP patterns in a protocol classification, you should also set NDPI_PROTOCOL_DASH as subprotocol of NDPI_PROTOCOL_HTTP with ndpi_set_proto_subprotocols(...) in src/lib/ndpi_main.c:ndpi_init_protocol_defaults(...).
The line you need to add should look alike:
ndpi_set_proto_subprotocols(ndpi_str, NDPI_PROTOCOL_HTTP, NDPI_PROTOCOL_DASH, NDPI_PROTOCOL_MATCHED_BY_CONTENT, NDPI_PROTOCOL_NO_MORE_SUBPROTOCOLS);

Your classification routine (ndpi_search_dash) should now be called after HTTP was previously detected and you can use constructs such as:
if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP && flow->http.method == NDPI_HTTP_METHOD_GET && packet->http_url_name != NULL && LINE_ENDS(packet->http_url_name, ".mpd") == 1) { ndpi_int_mpg_dash_add_connection(...) }

[IvanNardi]

@Douina, could you share any pcap with this kind of traffic, please?