ndpi filter does not detect potocol inside http_proxy

[didgaudin]

Hi,
i am trying the module and make some test with ndpiReader and xt_ndpi.
ndpiReader can detect Youtube, facebook, .. inside http_proxy but xt_ndpi detect only http_proxy.
Is there a particular parameter to activate this feature?

[vel21ripn]

Please send a sample of traffic in pcap format to vel21ripn at gmail dot com or a link to it. This will significantly speed up the process of detecting errors.

[vel21ripn]

Thanks for the traffic sample.
I already forgot that in the old versions of the kernel there was support for /proc/net/conntrack.
Please do not use it. I plan to completely remove this feature for two reasons: proc/net/ conntack is not supported in new kernels (4.8.0+) and it requires a patch for the kernel. In the new ndpi-netfilter branch, a patch for the kernel is an optional requirement.
There is a more correct way. Read nDPI / ndpi-netfilter / FLOW_INFO.txt
I'll see how your sample traffic is determined in the ndpi-netfilter in the next couple of days.

[didgaudin]

Thnks for your help.
I know the /proc/net/conntrack is deprecated.. My kernel is still now an 4.1 for my routeurs (pcengines).
I will use the proc flow info file.
If you wan more sample, let me know.

[vel21ripn]

The code to support profs/conntrack has not changed since version 1.7.
There have been a lot of changes in the new versions.
I'll see if this code can be fixed.

[vel21ripn]

I got a difference in the work of ndpiReader and ndpi-netfilter.
I will try to correct the errors in the near future.

[didgaudin]

Ok
Thanks.

[vel21ripn]

Fixed a stupid bug. See commit 5acad50
I can't verify the correctness of the data in /proc/net/conntrack.

[didgaudin]

Ok, I test this patch.

[didgaudin]

Great !!!
I have do some test and it works. I continue testing the module.
I will send you a patch to compile with the 4.1.52 kernel to your gmail address
Thanks

[clebig]

Thanks for the traffic sample.
I already forgot that in the old versions of the kernel there was support for /proc/net/conntrack.
Please do not use it. I plan to completely remove this feature for two reasons: proc/net/ conntack is not supported in new kernels (4.8.0+) and it requires a patch for the kernel. In the new ndpi-netfilter branch, a patch for the kernel is an optional requirement.
There is a more correct way. Read nDPI / ndpi-netfilter / FLOW_INFO.txt
I'll see how your sample traffic is determined in the ndpi-netfilter in the next couple of days.

What do you mean by /proc/net/conntrack not supported anymore in 4.8+ kernels ? do you mean ip_conntrack ? nf_conntrack ? everything related to conntracks in procfs ?

[vel21ripn]

The proc/net/ip_conntrack has been removed as obsolete.
The proc/net/nf_conntrack has been rewritten. It is possible to do a backporting of the output of the protocol information, but I do not have time for this.
IMHO proc/net/xt_ndpi/flows is a more correct way to get information about the protocol.