Skip to content

4.6 Stable
Compare
Choose a tag to compare
@lucaderi lucaderi released this 01 Feb 17:33
· 6 commits to 4.6-stable since this release
4.6
56aade0
This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
GPG key ID: 4AEE18F83AFDEB23
Expired
Learn about vigilant mode.

nDPI 4.6 (Feb 2023)

New Features

  • New support for custom BPF protocol definition using nBPF (see example/protos.txt)
  • Improved dissection performace
  • Added fuzzing all over

New Supported Protocols and Services

  • Add protocol detection for:
    • Activision
    • AliCloud server access
    • AVAST
    • CryNetwork
    • Discord
    • EDNS
    • Elasticsearch
    • FastCGI
    • Kismet
    • Line App and Line Voip valls
    • Meraki Cloud
    • Munin
    • NATPMP
    • Syncthing
    • TP-LINK Smart Home
    • TUYA LAN
    • SoftEther VPN
    • Tailscale
    • TiVoConnect

Improvements

  • Improve protocol detection for:
    • Anydesk
    • Bittorrent (fix confidence, detection over TCP)
    • DNS, add ability to decode DNS PTR records used for reverse address resolution
    • DTLS (handle certificate fragments)
    • Facebook Voip calls
    • FastCGI (dissect PARAMS)
    • FortiClient (update default ports)
    • Zoom
      • Add Zoom screen share detection
      • Add detection of Zoom peer-to-peer flows in STUN
    • Hangout/Duo Voip calls detection, optimize lookups in the protocol tree
    • HTTP
      • Handling of HTTP-Proxy and HTTP-Connect
      • HTTP subclassification
      • Check for empty/missing user-agent in HTTP
    • IRC (credentials check)
    • Jabber/XMPP
    • Kerberos (support for Krb-Error messages)
    • LDAP
    • MGCP
    • MONGODB (avoid false positives)
    • Postgres
    • POP3
    • QUIC (support for 0-RTT packets received before the initial)
    • Snapchat Voip calls
    • SIP
    • SNMP
    • SMB (support for messages split into multiple TCP segments)
    • SMTP (support for X-ANONYMOUSTLS command)
    • STUN
    • SKYPE (improve detection over UDP, remove detection over TCP)
    • Teamspeak3 (License/Weblist detection)
    • Threema Messenger
    • TINC (avoid processing SYN packets)
    • TLS
      • improve reassembler
      • handling of ALPN(s) and subclassification
      • ignore invalid Content Type values
    • WindowsUpdate
  • Add flow risk:
    • NDPI_HTTP_OBSOLETE_SERVER
    • NDPI_MINOR_ISSUES (generic/relevant information about issues found on traffic)
    • NDPI_HTTP_OBSOLETE_SERVER (Apache and nginx are supported)
    • NDPI_PERIODIC_FLOW (reserved bit to be used by apps based on nDPI)
    • NDPI_TCP_ISSUES
  • Improve detection of WebShell and PHP code in HTTP URLs that is reported via flow risk
  • Improve DGA detection
  • Improve AES-NI check
  • Improve nDPI JSON serialization
  • Improve export/print of L4 protocol information
  • Improve connection refused detection
  • Add statistics for Patricia tree, Ahocarasick automa, LRU cache
  • Add a generic (optional and configurable) expiration logic in LRU caches
  • Add RTP stream type in flow metadata
  • LRU cache is now IPv6 aware

Tools

  • ndpiReader
    • Add support for Linux Cooked Capture v2
    • Fix packet dissection (CAPWAP and TSO)
    • Fix Discarded bytes statistics

Fixes

  • Fix classification by-port
  • Fix exclusion of DTLS protocol
  • Fix undefined-behaviour in ahocorasick callback
  • Fix infinite loop when a custom rule has port 65535
  • Fix undefined-behavior when setting empty user-agent
  • Fix infinite loop in DNS dissector (due to an integer overflow)
  • Fix JSON export of IPv6 addresses
  • Fix memory corruptions in Bittorrent, HTTP, SoftEther, Florensia, QUIC, IRC, TFTP dissectors
  • Fix stop of extra dissection in HTTP, Bittorrent, Kerberos
  • Fix signed integer overflow in ASN1/BER dissector
  • Fix char/uchar bug in ahocorasick
  • Fix endianess in IP-Port lookup
  • Fix FastCGI memory allocation issue
  • Fix metadata extraction in NAT-PMP
  • Fix invalid unidirectional traffic alert for unidirectional protocols (e.g. sFlow)

Misc

  • Support for Rocky Linux 9
  • Enhance fuzzers to test nDPI configurations, memory allocation failures, serialization/deserialization, algorithms and data structures
  • GitHub Actions: update to Node.js 16
  • Size of LRU caches is now configurable
Assets 2