├── TODO
├── .gitignore
├── Makefile
├── protos.txt
├── README.md
├── AppCat.csv
├── linux_compat.h
├── pcapReader.c
└── nDPI.html


/TODO:
--------------------------------------------------------------------------------
1 | TODO-list:
2 | Enhance the live detection function to output flow results as detection 
3 | finishes.
4 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
 1 | # Object files
 2 | *.o
 3 | 
 4 | # Libraries
 5 | *.lib
 6 | *.a
 7 | 
 8 | # Shared objects (inc. Windows DLLs)
 9 | *.dll
10 | *.so
11 | *.so.*
12 | *.dylib
13 | 
14 | # Executables
15 | *.exe
16 | *.out
17 | *.app
18 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
 1 | ## A simple makefile
 2 | # Extra headers and libraries from env vars
 3 | INC=-I/usr/local/include/libndpi/ -I. -I$(INCLUDE_PATH) -I$(C_INCLUDE_PATH)
 4 | LIB=-L$(LIBRARY_PATH)
 5 | 
 6 | all: pcapDPI
 7 | 
 8 | pcapDPI: pcapReader.c
 9 | 	gcc -g pcapReader.c -o pcapDPI $(INC) $(LIB) -lpcap -lndpi
10 | 
11 | clean:
12 | 	\/bin/rm -f pcapDPI
13 | 


--------------------------------------------------------------------------------
/protos.txt:
--------------------------------------------------------------------------------
 1 | #  Format:
 2 | #  <tcp|udp>:<port>,<tcp|udp>:<port>,.....@<proto>
 3 | 
 4 | tcp:81,tcp:8181@HTTP
 5 | udp:5061-5062@SIP
 6 | tcp:860,udp:860,tcp:3260,udp:3260@iSCSI
 7 | tcp:3000@ntop
 8 | 
 9 | #  Subprotocols
10 | #  Format:
11 | #  host:"<value>",host:"<value>",.....@<subproto>
12 | 
13 | host:"googlesyndacation.com"@Google
14 | host:"venere.com"@Venere
15 | host:"kataweb.it",host:"repubblica.it"@Repubblica
16 | 
17 | 
18 | 
19 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | pcapDPI
 2 | =======
 3 | 
 4 | A program modified based on the nDPI example in the source package 
 5 | to use nDPI (openDPI) interfaces to detect flow protocols.
 6 | 
 7 | Modifications
 8 | -----------
 9 | 
10 | Add a `-w` option to the example program in nDPI.
11 | 
12 | Add a simple tree walker of the internal search tree implemented
13 | by nDPI to index flows efficiently.
14 | 
15 | Output file has a .csv format which is accepted directly by plenty
16 | of data processing softwares. A piece of text for ex.
17 | 
18 | 	source_ip source_port dest_ip dest_port l4_proto detect_proto packets bytes
19 | 	202.233.233.233 27753 114.112.67.195 80 TCP 7/HTTP 7 751
20 | 	192.88.99.1 0 202.233.233.233 0 41 0/Unknown 485 64975
21 | 	210.46.79.1 51752 202.233.233.233 27955 TCP 0/Unknown 3 194
22 | 	192.88.99.1 0 202.233.233.233 0 41 0/Unknown 485 64975
23 | 
24 | How To Install
25 | ------------
26 | 
27 | Users can make pcapDPI work following two steps:
28 | 
29 | 
30 | First, you must have nDPI installed. nDPI can be obtained from its website: http://www.ntop.org/products/ndpi/ and
31 | a standard linux package installation operation can be made to install it on your system.
32 | 
33 | 
34 | * COPY HEADER FILES MANUALLY: some header files like `linux_compact.h` are not installed by default when installing
35 | nDPI with command `make install`. You should copy them into your local include path manually. E.g., on my computer
36 | running Ubuntu 12.04 32bit, run following commands to get there:
37 | 
38 | 
39 |         $cd nDPI 
40 |         $cp src/include/*.h /usr/local/include/libndpi-1.4/libndpi/
41 | 
42 | 
43 | Second, download pcapDPI from https://github.com/caesar0301/pcapDPI and simply run `make` to compile it.
44 | 
45 | 
46 | * NOTE: if the `make` command raises errors about finding header files and/or libraries in your system 
47 | envirement variables, you can edit the Makefile with `INC` and/or `LIB` variables to search
48 | your local folders.
49 | 
50 | 
51 | AppCat.csv
52 | --------------
53 | 
54 | A manual classification of application protocols identified by nDPI.
55 | The application ID comes from nDPIsrc/include/ndpi_protocols_osdpi.h
56 | 
57 | 
58 | Enjoy.
59 | 
60 | 
61 | by chenxm
62 | 2013-03-16
63 | 


--------------------------------------------------------------------------------
/AppCat.csv:
--------------------------------------------------------------------------------
  1 | ID	ShortDesp	Category
  2 | 0	Unknown	Other
  3 | 1	FTP	FileService
  4 | 2	POP	Mail
  5 | 3	SMTP	Mail
  6 | 4	IMAP	Mail
  7 | 5	DNS	NetMan
  8 | 6	IPP	Netman
  9 | 7	HTTP	HTTP
 10 | 8	MDNS	NetMan
 11 | 9	NTP	NetMan
 12 | 10	NETBIOS	NetMan
 13 | 11	NFS	FileService
 14 | 12	SSDP	NetMan
 15 | 13	BGP	NetMan
 16 | 14	SNMP	NetMan
 17 | 15	XDMCP	RemoteLogin
 18 | 16	SMB	FileService
 19 | 17	SYSLOG	NetMan
 20 | 18	DHCP	NetMan
 21 | 19	PostgreSQL	Database
 22 | 20	MySQL	Database
 23 | 21	TDS	FileService
 24 | 22	DirectDownloadLink	FileService
 25 | 23	I23V5	Other
 26 | 24	AppleJuice	P2P
 27 | 25	DirectConnect	P2P
 28 | 26	Socrates	P2P
 29 | 27	WinMX	P2P
 30 | 28	VMware	Other
 31 | 29	PANDO	P2P
 32 | 30	Filetopia	FileService
 33 | 31	iMESH	P2P
 34 | 32	Kontiki	P2P
 35 | 33	OpenFT	P2P
 36 | 34	KazaaFasttrack	P2P
 37 | 35	Gnutella	P2P
 38 | 36	eDonkey	P2P
 39 | 37	Bittorrent	P2P
 40 | 38	OFF	Other
 41 | 39	AVI	Streaming
 42 | 40	Flash	Streaming
 43 | 41	OGG	Streaming
 44 | 42	MPEG	Streaming
 45 | 43	QuickTime	Streaming
 46 | 44	RealMedia	Streaming
 47 | 45	Windowsmedia	Streaming
 48 | 46	MMS	Streaming
 49 | 47	XBOX	Gaming
 50 | 48	QQ	IM
 51 | 49	MOVE	Streaming
 52 | 50	RTSP	Streaming
 53 | 51	Feidian	Streaming
 54 | 52	Icecast	Streaming
 55 | 53	PPLive	Streaming
 56 | 54	PPStream	Streaming
 57 | 55	Zattoo	Streaming
 58 | 56	SHOUTCast	Streaming
 59 | 57	SopCast	Streaming
 60 | 58	TVAnts	Streaming
 61 | 59	TVUplayer	Streaming
 62 | 60	VeohTV	Streaming
 63 | 61	QQLive	Streaming
 64 | 62	Thunder	P2P
 65 | 63	Soulseek	P2P
 66 | 64	GaduGadu	IM
 67 | 65	IRC	IM
 68 | 66	Popo	IM
 69 | 67	Jabber	IM
 70 | 68	MSN	IM
 71 | 69	Oscar	IM
 72 | 70	Yahoo	IM
 73 | 71	Battlefield	Gaming
 74 | 72	Quake	Gaming
 75 | 73	VRRP	NetMan
 76 | 74	Steam	Gaming
 77 | 75	Halflife2	Gaming
 78 | 76	WorldofWarcraft	Gaming
 79 | 77	Telnet	RemoteLogin
 80 | 78	STUN	NetMan
 81 | 79	IPSEC	NetMan
 82 | 80	GRE	NetMan
 83 | 81	ICMP	NetMan
 84 | 82	IGMP	NetMan
 85 | 83	EGP	NetMan
 86 | 84	SCTP	NetMan
 87 | 85	OSPF	NetMan
 88 | 86	IPinIP	NetMan
 89 | 87	RTP	NetMan
 90 | 88	RDP	RemoteLogin
 91 | 89	VNC	RemoteLogin
 92 | 90	PCAnywhere	RemoteLogin
 93 | 91	SSL	NetMan
 94 | 92	SSH	RemoteLogin
 95 | 93	USENET	News
 96 | 94	MGCP	NetMan
 97 | 95	IAX	VoIP
 98 | 96	TFTP	FileService
 99 | 97	AFP	FileService
100 | 98	StealthNet	P2P
101 | 99	Aimini	Streaming
102 | 100	SIP	IM
103 | 101	Truphone	IM
104 | 102	ICMPv6	NetMan
105 | 103	DHCPv6	NetMan
106 | 104	Armagetron	Gaming
107 | 105	CrossFire	Gaming
108 | 106	Dofus	Gaming
109 | 107	Fiesta	Gaming
110 | 108	Florensia	Gaming
111 | 109	Guildwars	Gaming
112 | 110	HTTPApplicationActiveSync	NetMan
113 | 111	Kerberos	Authentication
114 | 112	LDAP	Authentication
115 | 113	MapleStory	Gaming
116 | 114	msSQL	Database
117 | 115	PPTP	Privacy
118 | 116	WARCRAFT3	Gaming
119 | 117	WorldofKungFu	Gaming
120 | 118	MEEBO	Social
121 | 119	FaceBook	Social
122 | 120	Twitter	Social
123 | 121	DropBox	FileService
124 | 122	Gmail	Mail
125 | 123	GoogleMaps	Maps
126 | 124	YouTube	Streaming
127 | 125	Skype	IM
128 | 126	Google	Google
129 | 127	DCERPC	NetMan
130 | 128	NetFlowIPFIX	NetMan
131 | 129	sFlow	NetMan
132 | 130	HTTPConnect	HTTP
133 | 131	HTTPProxy	HTTP
134 | 132	Citrix	IM
135 | 133	Netflix	Streaming
136 | 134	LastFM	Streaming
137 | 135	GrooveShark	Streaming
138 | 136	SkyfilePrepaid	Streaming
139 | 137	SkyfileRudics	Streaming
140 | 138	SkyfilePostpaid	Streaming
141 | 139	CitrixOnline	IM
142 | 140	Apple	IM
143 | 141	Webex	IM
144 | 142	WhatsApp	IM
145 | 143	AppleiCloud	FileService
146 | 144	Viber	IM
147 | 145	AppleiTunes	Streaming
148 | 146	Radius	Authentication
149 | 147	WindowsUpdate	Update
150 | 148	TeamViewer	IM
151 | 149	Tuenti	Social
152 | 150	LotusNotes	IM
153 | 151	SAP	NetMan
154 | 152	GTP	NetMan
155 | 153	UPnP	NetMan
156 | 154	LLMNR	NetMan
157 | 155	RemoteScan	NetMan
158 | 156	Spotify	Streaming
159 | 157	WebM	Streaming
160 | 158	H323	Streaming
161 | 159	OpenVPN	Privacy
162 | 160	NOE	Streaming
163 | 161	CiscoVPN	Privacy
164 | 162	TeamSpeak	IM
165 | 163	Tor	Privacy
166 | 164	CiscoSkinny	IM
167 | 165	RTCP	NetMan
168 | 166	RSYNC	FileService
169 | 167	Oracle	Database
170 | 168	Corba	NetMan
171 | 169	UbuntuONE	FileService
172 | 


--------------------------------------------------------------------------------
/linux_compat.h:
--------------------------------------------------------------------------------
  1 | /*
  2 |  * linux_compat.h
  3 |  *
  4 |  * Copyright (C) 2009-2011 by ipoque GmbH
  5 |  * Copyright (C) 2011-13 - ntop.org
  6 |  *
  7 |  * This file is part of nDPI, an open source deep packet inspection
  8 |  * library based on the OpenDPI and PACE technology by ipoque GmbH
  9 |  *
 10 |  * nDPI is free software: you can redistribute it and/or modify
 11 |  * it under the terms of the GNU Lesser General Public License as published by
 12 |  * the Free Software Foundation, either version 3 of the License, or
 13 |  * (at your option) any later version.
 14 |  *
 15 |  * nDPI is distributed in the hope that it will be useful,
 16 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 17 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 18 |  * GNU Lesser General Public License for more details.
 19 |  *
 20 |  * You should have received a copy of the GNU Lesser General Public License
 21 |  * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
 22 |  *
 23 |  */
 24 | 
 25 | 
 26 | #ifndef __NDPI_LINUX_COMPAT_H__
 27 | #define __NDPI_LINUX_COMPAT_H__
 28 | 
 29 | #include "ndpi_define.h"
 30 | 
 31 | #if defined(__FreeBSD__) || defined(__NetBSD__)
 32 | #include <machine/endian.h>
 33 | 
 34 | #if _BYTE_ORDER == _LITTLE_ENDIAN
 35 | #define __LITTLE_ENDIAN__ 1
 36 | #else
 37 | #define __BIG_ENDIAN__ 1
 38 | #endif
 39 | #endif
 40 | 
 41 | #pragma pack(push)  /* push current alignment to stack */
 42 | #pragma pack(1)     /* set alignment to 1 byte boundary */
 43 | 
 44 | #pragma pack(pop)   /* restore original alignment from stack */
 45 | 
 46 | struct ndpi_ethhdr {
 47 |   u_char h_dest[6];       /* destination eth addr */
 48 |   u_char h_source[6];     /* source ether addr    */
 49 |   u_int16_t h_proto;      /* packet type ID field */
 50 | };
 51 | 
 52 | struct ndpi_80211q {
 53 |   u_int16_t vlanId;
 54 |   u_int16_t protoType;
 55 | };
 56 | 
 57 | struct ndpi_iphdr {
 58 | #if defined(__LITTLE_ENDIAN__) 
 59 |   u_int8_t ihl:4, version:4;
 60 | #elif defined(__BIG_ENDIAN__)
 61 |   u_int8_t version:4, ihl:4;
 62 | #else
 63 | # error "Byte order must be defined"
 64 | #endif
 65 |   u_int8_t tos;
 66 |   u_int16_t tot_len;
 67 |   u_int16_t id;
 68 |   u_int16_t frag_off;
 69 |   u_int8_t ttl;
 70 |   u_int8_t protocol;
 71 |   u_int16_t check;
 72 |   u_int32_t saddr;
 73 |   u_int32_t daddr;
 74 | };
 75 | 
 76 | 
 77 | #ifdef WIN32
 78 | 
 79 | typedef unsigned char  u_char;
 80 | typedef unsigned short u_short;
 81 | typedef unsigned int   uint;
 82 | typedef unsigned long  u_long;
 83 | typedef u_char  u_int8_t;
 84 | typedef u_short u_int16_t;
 85 | typedef uint   u_int32_t;
 86 | 
 87 | #define _WS2TCPIP_H_ /* Avoid compilation problems */
 88 | #define HAVE_SIN6_LEN
 89 | 
 90 | 
 91 | /* IPv6 address */
 92 | /* Already defined in WS2tcpip.h */
 93 | struct ndpi_win_in6_addr
 94 | {
 95 |   union
 96 |   {
 97 |     u_int8_t u6_addr8[16];
 98 |     u_int16_t u6_addr16[8];
 99 |     u_int32_t u6_addr32[4];
100 |   } in6_u;
101 | #ifdef s6_addr
102 | #undef s6_addr
103 | #endif
104 | 
105 | #ifdef s6_addr16
106 | #undef s6_addr16
107 | #endif
108 | 
109 | #ifdef s6_addr32
110 | #undef s6_addr32
111 | #endif
112 | 
113 | #define s6_addr                 in6_u.u6_addr8
114 |   // #define s6_addr16               in6_u.u6_addr16
115 |   // #define s6_addr32               in6_u.u6_addr32
116 | 
117 | };
118 | 
119 | #define in6_addr win_in6_addr
120 | 
121 | /* Generic extension header.  */
122 | struct ndpi_ip6_ext
123 | {
124 |   u_int8_t  ip6e_nxt;		/* next header.  */
125 |   u_int8_t  ip6e_len;		/* length in units of 8 octets.  */
126 | };
127 | 
128 | #define s6_addr16		__u6_addr.__u6_addr16
129 | #define s6_addr32		__u6_addr.__u6_addr32
130 | #else
131 | #ifndef __KERNEL__
132 | #include <arpa/inet.h>
133 | #endif
134 | #endif
135 | 
136 | 
137 | 
138 | struct ndpi_in6_addr {
139 |   union {
140 |     u_int8_t   __u6_addr8[16];
141 |     u_int16_t  __u6_addr16[8];
142 |     u_int32_t  __u6_addr32[4];
143 |   } __u6_addr;                    /* 128-bit IP6 address */
144 | };
145 | 
146 | struct ndpi_ip6_hdr {
147 |   union {
148 |     struct ndpi_ip6_hdrctl {
149 |       u_int32_t ip6_un1_flow;
150 |       u_int16_t ip6_un1_plen;
151 |       u_int8_t ip6_un1_nxt;
152 |       u_int8_t ip6_un1_hlim;
153 |     } ip6_un1;
154 |     u_int8_t ip6_un2_vfc;
155 |   } ip6_ctlun;
156 |   struct ndpi_in6_addr ip6_src;
157 |   struct ndpi_in6_addr ip6_dst;
158 | };
159 | 
160 | struct ndpi_tcphdr {
161 |   u_int16_t source;
162 |   u_int16_t dest;
163 |   u_int32_t seq;
164 |   u_int32_t ack_seq;
165 | #if defined(__LITTLE_ENDIAN__)
166 |   u_int16_t res1:4, doff:4, fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1;
167 | #elif defined(__BIG_ENDIAN__)
168 |   u_int16_t doff:4, res1:4, cwr:1, ece:1, urg:1, ack:1, psh:1, rst:1, syn:1, fin:1;
169 | #else
170 | # error "Byte order must be defined"
171 | #endif  
172 |   u_int16_t window;
173 |   u_int16_t check;
174 |   u_int16_t urg_ptr;
175 | };
176 | 
177 | struct ndpi_udphdr {
178 |   u_int16_t source;
179 |   u_int16_t dest;
180 |   u_int16_t len;
181 |   u_int16_t check;
182 | };
183 | 
184 | #endif
185 | 


--------------------------------------------------------------------------------
/pcapReader.c:
--------------------------------------------------------------------------------
  1 | /*
  2 |  * pcapReader.c
  3 |  *
  4 |  * Copyright (C) 2013 by chenxm
  5 |  * Copyright (C) 2011-13 - ntop.org
  6 |  * Copyright (C) 2009-2011 by ipoque GmbH
  7 |  *
  8 |  * nDPI is free software: you can redistribute it and/or modify
  9 |  * it under the terms of the GNU Lesser General Public License as published by
 10 |  * the Free Software Foundation, either version 3 of the License, or
 11 |  * (at your option) any later version.
 12 |  *
 13 |  * nDPI is distributed in the hope that it will be useful,
 14 |  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 15 |  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 16 |  * GNU Lesser General Public License for more details.
 17 |  *
 18 |  * You should have received a copy of the GNU Lesser General Public License
 19 |  * along with nDPI.  If not, see <http://www.gnu.org/licenses/>.
 20 |  *
 21 |  */
 22 | 
 23 | #include <stdio.h>
 24 | #include <stdlib.h>
 25 | #include <unistd.h>
 26 | #include <string.h>
 27 | #include <stdarg.h>
 28 | #include <netinet/in.h>
 29 | #include <search.h>
 30 | #include <pcap.h>
 31 | #include <signal.h>
 32 | 
 33 | #include "linux_compat.h"
 34 | #include "ndpi_main.h"
 35 | 
 36 | static void setupDetection(void);
 37 | 
 38 | // cli options
 39 | static char *_pcap_file = NULL;
 40 | static char *_bpf_filter = NULL;
 41 | static char *_protoFilePath = NULL;
 42 | 
 43 | // pcap
 44 | static char _pcap_error_buffer[PCAP_ERRBUF_SIZE];
 45 | static pcap_t *_pcap_handle = NULL;
 46 | static int _pcap_datalink_type = 0;
 47 | static u_int8_t enable_protocol_guess = 1, verbose = 0;
 48 | static u_int32_t guessed_flow_protocols = 0;
 49 | static u_int16_t decode_tunnels = 0;
 50 | static u_int16_t num_loops = 1;
 51 | static u_int8_t shutdown_app = 0;
 52 | 
 53 | // detection
 54 | static struct ndpi_detection_module_struct *ndpi_struct = NULL;
 55 | static u_int32_t detection_tick_resolution = 1000;
 56 | static time_t capture_until = 0;
 57 | 
 58 | // results
 59 | static u_int64_t raw_packet_count = 0;
 60 | static u_int64_t ip_packet_count = 0;
 61 | static u_int64_t total_bytes = 0;
 62 | static u_int64_t protocol_counter[NDPI_MAX_SUPPORTED_PROTOCOLS + NDPI_MAX_NUM_CUSTOM_PROTOCOLS + 1];
 63 | static u_int64_t protocol_counter_bytes[NDPI_MAX_SUPPORTED_PROTOCOLS + NDPI_MAX_NUM_CUSTOM_PROTOCOLS + 1];
 64 | static u_int32_t protocol_flows[NDPI_MAX_SUPPORTED_PROTOCOLS + NDPI_MAX_NUM_CUSTOM_PROTOCOLS + 1] = { 0 };
 65 | 
 66 | // log file
 67 | static FILE *flow_info_file;
 68 | static char *flow_info_file_name;
 69 | 
 70 | #define GTP_U_V1_PORT      2152
 71 | #define	MAX_NDPI_FLOWS     20000000
 72 | // id tracking
 73 | typedef struct ndpi_id {
 74 |   u_int8_t ip[4];
 75 |   struct ndpi_id_struct *ndpi_id;
 76 | } ndpi_id_t;
 77 | 
 78 | static u_int32_t size_id_struct = 0;
 79 | 
 80 | #ifndef ETH_P_IP
 81 | #define ETH_P_IP 0x0800
 82 | #endif
 83 | 
 84 | // flow tracking
 85 | typedef struct ndpi_flow {
 86 |   u_int32_t lower_ip;
 87 |   u_int32_t upper_ip;
 88 |   u_int16_t lower_port;
 89 |   u_int16_t upper_port;
 90 |   u_int32_t first_packet_time_sec;
 91 |   u_int32_t first_packet_time_usec;
 92 |   u_int8_t detection_completed, protocol;
 93 |   struct ndpi_flow_struct *ndpi_flow;
 94 | 
 95 |   u_int16_t packets, bytes;
 96 |   // result only, not used for flow identification
 97 |   u_int16_t detected_protocol;
 98 | 
 99 |   void *src_id, *dst_id;
100 | } ndpi_flow_t;
101 | 
102 | static u_int32_t size_flow_struct = 0;
103 | static struct ndpi_flow *ndpi_flows_root = NULL;
104 | static u_int32_t ndpi_flow_count = 0;
105 | 
106 | 
107 | static void help(u_int long_help) {
108 |   printf("pcapReader -i <file|device> [-f <filter>][-s <duration>]\n"
109 | 	 "           [-p <protos>][-w <outfile>][-l <loops>[-d][-h][-t][-v]\n\n"
110 | 	 "Usage:\n"
111 | 	 "  -i <file.pcap|device>     | Specify a pcap file to read packets from or a device for live capture\n"
112 | 	 "  -f <BPF filter>           | Specify a BPF filter for filtering selected traffic\n"
113 | 	 "  -s <duration>             | Maximum capture duration in seconds (live traffic capture only)\n"
114 | 	 "  -p <file>.protos          | Specify a protocol file (eg. protos.txt)\n"
115 |    "  -w <outfile>              | Specify a output file (default: out.dpi.csv) to save detectd result for each flow\n"
116 | 	 "  -l <num loops>            | Number of detection loops (test only)\n"
117 | 	 "  -d                        | Disable protocol guess and use only DPI\n"
118 | 	 "  -t                        | Dissect GTP tunnels\n"
119 | 	 "  -h                        | This help\n"
120 | 	 "  -v                        | Verbose 'unknown protocol' packet print\n");
121 | 
122 |   if(long_help) {
123 |     printf("\n\nSupported protocols:\n");
124 |     setupDetection();
125 |     ndpi_dump_protocols(ndpi_struct);
126 |   }
127 | 
128 |   exit(-1);
129 | }
130 | 
131 | static void parseOptions(int argc, char **argv)
132 | {
133 |   int opt;
134 | 
135 |   while ((opt = getopt(argc, argv, "df:i:hp:w:l:s:tv")) != EOF) {
136 |     switch (opt) {
137 |     case 'd':
138 |       enable_protocol_guess = 0;
139 |       break;
140 | 
141 |     case 'i':
142 |       _pcap_file = optarg;
143 |       break;
144 | 
145 |     case 'f':
146 |       _bpf_filter = optarg;
147 |       break;
148 | 
149 |     case 'l':
150 |       num_loops = atoi(optarg);
151 |       break;
152 | 
153 |     case 'p':
154 |       _protoFilePath = optarg;
155 |       break;
156 | 
157 |     case 'w':
158 |       flow_info_file_name = optarg;
159 |       break;
160 | 
161 |     case 's':
162 |       capture_until = atoi(optarg);
163 |       break;
164 | 
165 |     case 't':
166 |       decode_tunnels = 1;
167 |       break;
168 | 
169 |     case 'v':
170 |       verbose = 1;
171 |       break;
172 | 
173 |     case 'h':
174 |       help(1);
175 |       break;
176 | 
177 |     default:
178 |       help(0);
179 |       break;
180 |     }
181 |   }
182 | 
183 |   // check parameters
184 |   if (_pcap_file == NULL || strcmp(_pcap_file, "") == 0) help(0);
185 |   if (flow_info_file_name == NULL || strcmp(flow_info_file_name, "") == 0)
186 |     flow_info_file_name = "out.dpi.csv";  // default
187 | }
188 | 
189 | static void debug_printf(u_int32_t protocol, void *id_struct,
190 | 			 ndpi_log_level_t log_level,
191 | 			 const char *format, ...) {
192 | }
193 | 
194 | static void *malloc_wrapper(unsigned long size)
195 | {
196 |   return malloc(size);
197 | }
198 | 
199 | static void free_wrapper(void *freeable)
200 | {
201 |   free(freeable);
202 | }
203 | 
204 | 
205 | static char* ipProto2Name(u_short proto_id) {
206 |   static char proto[8];
207 | 
208 |   switch(proto_id) {
209 |   case IPPROTO_TCP:
210 |     return("TCP");
211 |     break;
212 |   case IPPROTO_UDP:
213 |     return("UDP");
214 |     break;
215 |   case IPPROTO_ICMP:
216 |     return("ICMP");
217 |     break;
218 |   case 112:
219 |     return("VRRP");
220 |     break;
221 |   }
222 | 
223 |   snprintf(proto, sizeof(proto), "%u", proto_id);
224 |   return(proto);
225 | }
226 | 
227 | /*
228 |  * A faster replacement for inet_ntoa().
229 |  */
230 | char* intoaV4(unsigned int addr, char* buf, u_short bufLen) {
231 |   char *cp, *retStr;
232 |   uint byte;
233 |   int n;
234 | 
235 |   cp = &buf[bufLen];
236 |   *--cp = '\0';
237 | 
238 |   n = 4;
239 |   do {
240 |     byte = addr & 0xff;
241 |     *--cp = byte % 10 + '0';
242 |     byte /= 10;
243 |     if (byte > 0) {
244 |       *--cp = byte % 10 + '0';
245 |       byte /= 10;
246 |       if (byte > 0)
247 | 	*--cp = byte + '0';
248 |     }
249 |     *--cp = '.';
250 |     addr >>= 8;
251 |   } while (--n > 0);
252 | 
253 |   /* Convert the string to lowercase */
254 |   retStr = (char*)(cp+1);
255 | 
256 |   return(retStr);
257 | }
258 | 
259 | static void printFlow(struct ndpi_flow *flow) {
260 |   char buf1[32], buf2[32];
261 | 
262 |   printf("\t%s %s:%u > %s:%u [proto: %u/%s][%u pkts/%u bytes]\n",
263 | 	 ipProto2Name(flow->protocol),
264 | 	 intoaV4(ntohl(flow->lower_ip), buf1, sizeof(buf1)),
265 | 	 ntohs(flow->lower_port),
266 | 	 intoaV4(ntohl(flow->upper_ip), buf2, sizeof(buf2)),
267 | 	 ntohs(flow->upper_port),
268 | 	 flow->detected_protocol,
269 | 	 ndpi_get_proto_name(ndpi_struct, flow->detected_protocol),
270 | 	 flow->packets, flow->bytes);
271 | }
272 | 
273 | static void fPrintFlow(FILE *stream, struct ndpi_flow *flow) {
274 |   char buf1[32], buf2[32];
275 | 
276 |   fprintf(stream, "%s %u %s %u %.6f %s %u/%s %u %u\n",
277 |    intoaV4(ntohl(flow->lower_ip), buf1, sizeof(buf1)),
278 |    ntohs(flow->lower_port),
279 |    intoaV4(ntohl(flow->upper_ip), buf2, sizeof(buf2)),
280 |    ntohs(flow->upper_port),
281 |    flow->first_packet_time_sec + flow->first_packet_time_usec/1000000.0,
282 |    ipProto2Name(flow->protocol),
283 |    flow->detected_protocol,
284 |    ndpi_get_proto_name(ndpi_struct, flow->detected_protocol),
285 |    flow->packets, flow->bytes);
286 | }
287 | 
288 | static void node_print_unknown_proto_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) {
289 |   struct ndpi_flow *flow = *(struct ndpi_flow**)node;
290 | 
291 |   if (flow->detected_protocol != 0 /* UNKNOWN */) return;
292 | 
293 |   if((which == preorder) || (which == leaf)) /* Avoid walking the same node multiple times */
294 |     printFlow(flow);
295 | }
296 | 
297 | static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) {
298 |   struct ndpi_flow *flow = *(struct ndpi_flow**)node;
299 |   char buf1[32], buf2[32];
300 | 
301 | #if 0
302 |   printf("<%d>Walk on node %s (%p)\n",
303 | 	 depth,
304 | 	 which == preorder?"preorder":
305 | 	 which == postorder?"postorder":
306 | 	 which == endorder?"endorder":
307 | 	 which == leaf?"leaf": "unknown",
308 | 	 flow);
309 | #endif
310 | 
311 |   if((which == preorder) || (which == leaf)) { /* Avoid walking the same node multiple times */
312 |     if(enable_protocol_guess) {
313 |       if (flow->detected_protocol == 0 /* UNKNOWN */) {
314 | 	 ndpi_protocol guessed = ndpi_guess_undetected_protocol(ndpi_struct,
315 | 								 flow->protocol,
316 | 								 ntohl(flow->lower_ip),
317 | 								 ntohs(flow->lower_port),
318 | 								 ntohl(flow->upper_ip),
319 | 								 ntohs(flow->upper_port));
320 |    flow->detected_protocol = guessed.master_protocol;
321 | 
322 | 	if (flow->detected_protocol != 0)
323 | 	  guessed_flow_protocols++;
324 | 
325 | 	// printFlow(flow);
326 |       }
327 |     }
328 | 
329 |     protocol_counter[flow->detected_protocol]       += flow->packets;
330 |     protocol_counter_bytes[flow->detected_protocol] += flow->bytes;
331 |     protocol_flows[flow->detected_protocol]++;
332 |   }
333 | }
334 | 
335 | // 2013-03-16: added by chenxm to log detected results
336 | static void node_output_flow_info_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) {
337 |   struct ndpi_flow *flow = *(struct ndpi_flow**)node;
338 |   if ( flow_info_file != NULL){
339 |     if ((which == preorder) || (which == leaf)) fPrintFlow(flow_info_file, flow);
340 |   }
341 |   else {printf("Invalid file stream!\n"); exit(-1);}
342 | }
343 | 
344 | static int node_cmp(const void *a, const void *b) {
345 |   struct ndpi_flow *fa = (struct ndpi_flow*)a;
346 |   struct ndpi_flow *fb = (struct ndpi_flow*)b;
347 | 
348 |   if(fa->lower_ip < fb->lower_ip) return(-1); else { if(fa->lower_ip > fb->lower_ip) return(1); }
349 |   if(fa->lower_port < fb->lower_port) return(-1); else { if(fa->lower_port > fb->lower_port) return(1); }
350 |   if(fa->upper_ip < fb->upper_ip) return(-1); else { if(fa->upper_ip > fb->upper_ip) return(1); }
351 |   if(fa->upper_port < fb->upper_port) return(-1); else { if(fa->upper_port > fb->upper_port) return(1); }
352 |   if(fa->protocol < fb->protocol) return(-1); else { if(fa->protocol > fb->protocol) return(1); }
353 | 
354 |   return(0);
355 | }
356 | 
357 | 
358 | static struct ndpi_flow *get_ndpi_flow(const struct pcap_pkthdr *header, 
359 |                           const struct ndpi_iphdr *iph, u_int16_t ipsize)
360 | {
361 |   u_int32_t i;
362 |   u_int16_t l4_packet_len;
363 |   struct ndpi_tcphdr *tcph = NULL;
364 |   struct ndpi_udphdr *udph = NULL;
365 |   u_int32_t lower_ip;
366 |   u_int32_t upper_ip;
367 |   u_int16_t lower_port;
368 |   u_int16_t upper_port;
369 |   struct ndpi_flow flow;
370 |   void *ret;
371 | 
372 |   if (ipsize < 20)
373 |     return NULL;
374 | 
375 |   if ((iph->ihl * 4) > ipsize || ipsize < ntohs(iph->tot_len)
376 |       || (iph->frag_off & htons(0x1FFF)) != 0)
377 |     return NULL;
378 | 
379 |   l4_packet_len = ntohs(iph->tot_len) - (iph->ihl * 4);
380 | 
381 |   if (iph->saddr < iph->daddr) {
382 |     lower_ip = iph->saddr;
383 |     upper_ip = iph->daddr;
384 |   } else {
385 |     lower_ip = iph->daddr;
386 |     upper_ip = iph->saddr;
387 |   }
388 | 
389 |   if (iph->protocol == 6 && l4_packet_len >= 20) {
390 |     // tcp
391 |     tcph = (struct ndpi_tcphdr *) ((u_int8_t *) iph + iph->ihl * 4);
392 |     if (iph->saddr < iph->daddr) {
393 |       lower_port = tcph->source;
394 |       upper_port = tcph->dest;
395 |     } else {
396 |       lower_port = tcph->dest;
397 |       upper_port = tcph->source;
398 |     }
399 |   } else if (iph->protocol == 17 && l4_packet_len >= 8) {
400 |     // udp
401 |     udph = (struct ndpi_udphdr *) ((u_int8_t *) iph + iph->ihl * 4);
402 |     if (iph->saddr < iph->daddr) {
403 |       lower_port = udph->source;
404 |       upper_port = udph->dest;
405 |     } else {
406 |       lower_port = udph->dest;
407 |       upper_port = udph->source;
408 |     }
409 |   } else {
410 |     // non tcp/udp protocols
411 |     lower_port = 0;
412 |     upper_port = 0;
413 |   }
414 | 
415 |   flow.protocol = iph->protocol;
416 |   flow.lower_ip = lower_ip;
417 |   flow.upper_ip = upper_ip;
418 |   flow.lower_port = lower_port;
419 |   flow.upper_port = upper_port;
420 |   flow.first_packet_time_sec = header->ts.tv_sec;
421 |   flow.first_packet_time_usec = header->ts.tv_usec;
422 | 
423 |   ret = ndpi_tfind(&flow, (void*)&ndpi_flows_root, node_cmp);
424 | 
425 |   if(ret == NULL) {
426 |     if (ndpi_flow_count == MAX_NDPI_FLOWS) {
427 |       printf("ERROR: maximum flow count (%u) has been exceeded\n", MAX_NDPI_FLOWS);
428 |       exit(-1);
429 |     } else {
430 |       struct ndpi_flow *newflow = (struct ndpi_flow*)malloc(sizeof(struct ndpi_flow));
431 | 
432 |       if(newflow == NULL) {
433 | 	    printf("[NDPI] %s(1): not enough memory\n", __FUNCTION__);
434 | 	    return(NULL);
435 |       }
436 | 
437 |       memset(newflow, 0, sizeof(struct ndpi_flow));
438 |       newflow->protocol = iph->protocol;
439 |       newflow->lower_ip = lower_ip, newflow->upper_ip = upper_ip;
440 |       newflow->lower_port = lower_port, newflow->upper_port = upper_port;
441 |       newflow->first_packet_time_sec = header->ts.tv_sec;
442 |       newflow->first_packet_time_usec = header->ts.tv_usec;
443 | 
444 |       if((newflow->ndpi_flow = calloc(1, size_flow_struct)) == NULL) {
445 | 	    printf("[NDPI] %s(2): not enough memory\n", __FUNCTION__);
446 | 	    return(NULL);
447 |       }
448 | 
449 |       if((newflow->src_id = calloc(1, size_id_struct)) == NULL) {
450 | 	    printf("[NDPI] %s(3): not enough memory\n", __FUNCTION__);
451 | 	    return(NULL);
452 |       }
453 | 
454 |       if((newflow->dst_id = calloc(1, size_id_struct)) == NULL) {
455 | 	    printf("[NDPI] %s(4): not enough memory\n", __FUNCTION__);
456 | 	    return(NULL);
457 |       }
458 | 
459 |       ndpi_tsearch(newflow, (void*)&ndpi_flows_root, node_cmp); /* Add */
460 | 
461 |       ndpi_flow_count += 1;
462 | 
463 |       //printFlow(newflow);
464 |       return(newflow);
465 |     }
466 |   } else
467 |     return *(struct ndpi_flow**)ret;
468 | }
469 | 
470 | static void setupDetection(void)
471 | {
472 |   u_int32_t i;
473 |   NDPI_PROTOCOL_BITMASK all;
474 | 
475 |   // init global detection structure
476 |   ndpi_struct = ndpi_init_detection_module(detection_tick_resolution, malloc_wrapper, free_wrapper, debug_printf);
477 |   if (ndpi_struct == NULL) {
478 |     printf("ERROR: global structure initialization failed\n");
479 |     exit(-1);
480 |   }
481 |   // enable all protocols
482 |   NDPI_BITMASK_SET_ALL(all);
483 |   ndpi_set_protocol_detection_bitmask2(ndpi_struct, &all);
484 | 
485 |   // allocate memory for id and flow tracking
486 |   size_id_struct = ndpi_detection_get_sizeof_ndpi_id_struct();
487 |   size_flow_struct = ndpi_detection_get_sizeof_ndpi_flow_struct();
488 | 
489 |   // clear memory for results
490 |   memset(protocol_counter, 0, sizeof(protocol_counter));
491 |   memset(protocol_counter_bytes, 0, sizeof(protocol_counter_bytes));
492 |   memset(protocol_flows, 0, sizeof(protocol_flows));
493 | 
494 |   if(_protoFilePath != NULL)
495 |     ndpi_load_protocols_file(ndpi_struct, _protoFilePath);
496 | 
497 |   raw_packet_count = ip_packet_count = total_bytes = 0;
498 |   ndpi_flow_count = 0;
499 | }
500 | 
501 | static void free_ndpi_flow(struct ndpi_flow *flow) {
502 |   if(flow->ndpi_flow) { ndpi_free(flow->ndpi_flow); flow->ndpi_flow = NULL; }
503 |   if(flow->src_id)    { ndpi_free(flow->src_id); flow->src_id = NULL;       }
504 |   if(flow->dst_id)    { ndpi_free(flow->dst_id); flow->dst_id = NULL;       }
505 | }
506 | 
507 | static void ndpi_flow_freer(void *node) {
508 |   struct ndpi_flow *flow = (struct ndpi_flow*)node;
509 |   free_ndpi_flow(flow);
510 |   ndpi_free(flow);
511 | }
512 | 
513 | 
514 | static void terminateDetection(void)
515 | {
516 |   ndpi_tdestroy(ndpi_flows_root, ndpi_flow_freer);
517 |   ndpi_flows_root = NULL;
518 |   ndpi_exit_detection_module(ndpi_struct, free_wrapper);
519 | }
520 | 
521 | static unsigned int packet_processing(const u_int64_t time, const struct pcap_pkthdr *header,
522 |               const struct ndpi_iphdr *iph, u_int16_t ipsize, u_int16_t rawsize)
523 | {
524 |   struct ndpi_id_struct *src, *dst;
525 |   struct ndpi_flow *flow;
526 |   struct ndpi_flow_struct *ndpi_flow = NULL;
527 |   u_int16_t protocol = 0;
528 |   u_int16_t frag_off = ntohs(iph->frag_off);
529 | 
530 |   flow = get_ndpi_flow(header, iph, ipsize);
531 |   if (flow != NULL) {
532 |     ndpi_flow = flow->ndpi_flow;
533 |     flow->packets++, flow->bytes += rawsize;
534 |     src = flow->src_id, dst = flow->dst_id;
535 |   } else
536 |     return;
537 | 
538 |   ip_packet_count++;
539 |   total_bytes += rawsize;
540 | 
541 |   if(flow->detection_completed) return;
542 | 
543 |   // only handle unfragmented packets
544 |   if ((frag_off & 0x3FFF) == 0) {
545 |     // here the actual detection is performed
546 |     ndpi_protocol detected = ndpi_detection_process_packet(ndpi_struct, ndpi_flow, (uint8_t *) iph, ipsize, time, src, dst);
547 |     protocol = detected.master_protocol;
548 |   } else {
549 |     static u_int8_t frag_warning_used = 0;
550 | 
551 |     if (frag_warning_used == 0) {
552 |       printf("\n\nWARNING: fragmented ip packets are not supported and will be skipped \n\n");
553 |       frag_warning_used = 1;
554 |     }
555 | 
556 |     return 0;
557 |   }
558 | 
559 | #if 0
560 |   if(verbose && (protocol == 0)) {
561 |     char buf1[32], buf2[32];
562 | 
563 |     printf("%s %s:%u > %s:%u [proto: %u/%s]\n",
564 | 	   ipProto2Name(flow->protocol),
565 | 	   intoaV4(ntohl(flow->lower_ip), buf1, sizeof(buf1)), ntohs(flow->lower_port),
566 | 	   intoaV4(ntohl(flow->upper_ip), buf2, sizeof(buf2)), ntohs(flow->upper_port),
567 | 	   protocol, ndpi_get_proto_name(ndpi_struct, protocol));
568 |   }
569 | #endif
570 | 
571 |   flow->detected_protocol = protocol;
572 | 
573 |   if((flow->detected_protocol != NDPI_PROTOCOL_UNKNOWN)
574 |      || (iph->protocol == IPPROTO_UDP)
575 |      || ((iph->protocol == IPPROTO_TCP) && (flow->packets > 10))) {
576 |     flow->detection_completed = 1;
577 | 
578 | #if 0
579 |     if(flow->ndpi_flow->l4.tcp.host_server_name[0] != '\0')
580 |       printf("%s\n", flow->ndpi_flow->l4.tcp.host_server_name);
581 | #endif
582 | 
583 |     free_ndpi_flow(flow);
584 |   }
585 | 
586 | #if 0
587 |   if(ndpi_flow->l4.tcp.host_server_name[0] != '\0')
588 |     printf("%s\n", ndpi_flow->l4.tcp.host_server_name);
589 | #endif  
590 | 
591 |   return 0;
592 | }
593 | 
594 | static void printResults(void)
595 | {
596 |   u_int32_t i, j;
597 | 
598 |   printf("\x1b[2K\n");
599 |   printf("pcap file contains\n");
600 |   printf("\tip packets:   \x1b[33m%-13llu\x1b[0m of %llu packets total\n",
601 | 	 (long long unsigned int)ip_packet_count,
602 | 	 (long long unsigned int)raw_packet_count);
603 |   printf("\tip bytes:     \x1b[34m%-13llu\x1b[0m\n",
604 | 	 (long long unsigned int)total_bytes);
605 |   printf("\tunique flows: \x1b[36m%-13u\x1b[0m\n", ndpi_flow_count);
606 | 
607 |   ndpi_twalk(ndpi_flows_root, node_proto_guess_walker, NULL);
608 |   if(enable_protocol_guess)
609 |     printf("\tguessed flow protocols: \x1b[35m%-13u\x1b[0m\n", guessed_flow_protocols);
610 | 
611 |   printf("\n\ndetected protocols:\n");
612 |   for (i = 0; i <= ndpi_get_num_supported_protocols(ndpi_struct); i++) {
613 |     if (protocol_counter[i] > 0) {
614 |       printf("\t\x1b[31m%-20s\x1b[0m packets: \x1b[33m%-13llu\x1b[0m bytes: \x1b[34m%-13llu\x1b[0m "
615 | 	     "flows: \x1b[36m%-13u\x1b[0m\n",
616 | 	     ndpi_get_proto_name(ndpi_struct, i), (long long unsigned int)protocol_counter[i],
617 | 	     (long long unsigned int)protocol_counter_bytes[i], protocol_flows[i]);
618 |     }
619 |   }
620 | 
621 |   if(verbose && (protocol_counter[0] > 0)) {
622 |     printf("\n\nundetected flows:\n");
623 |     ndpi_twalk(ndpi_flows_root, node_print_unknown_proto_walker, NULL);
624 |   }
625 | 
626 |   if (1) {
627 |     flow_info_file = fopen(flow_info_file_name, "wb");
628 |     fputs("source_ip source_port dest_ip dest_port first_packet_time l4_proto detect_proto packets bytes\n", flow_info_file);
629 |     ndpi_twalk(ndpi_flows_root, node_output_flow_info_walker, NULL);
630 |     fclose(flow_info_file);
631 |   }
632 | 
633 |   printf("\n\n");
634 | }
635 | 
636 | static void openPcapFileOrDevice(void)
637 | {
638 |   u_int snaplen = 1514;
639 |   int promisc = 1;
640 |   char errbuf[PCAP_ERRBUF_SIZE];
641 |   
642 |   if((_pcap_handle = pcap_open_live(_pcap_file, snaplen, promisc, 500, errbuf)) == NULL) {
643 |     _pcap_handle = pcap_open_offline(_pcap_file, _pcap_error_buffer);
644 |     capture_until = 0;
645 | 
646 |     if (_pcap_handle == NULL) {
647 |       printf("ERROR: could not open pcap file: %s\n", _pcap_error_buffer);
648 |       exit(-1);
649 |     } else
650 |       printf("Reading packets from pcap file %s...\n", _pcap_file);
651 |   } else
652 |     printf("Capturing live traffic from device %s...\n", _pcap_file);
653 | 
654 |   _pcap_datalink_type = pcap_datalink(_pcap_handle);
655 | 
656 |   if(_bpf_filter != NULL) {
657 |     struct bpf_program fcode;
658 | 
659 |     if(pcap_compile(_pcap_handle, &fcode, _bpf_filter, 1, 0xFFFFFF00) < 0) {
660 |       printf("pcap_compile error: '%s'\n", pcap_geterr(_pcap_handle));
661 |     } else {
662 |       if(pcap_setfilter(_pcap_handle, &fcode) < 0) {
663 | 	printf("pcap_setfilter error: '%s'\n", pcap_geterr(_pcap_handle));
664 |       } else
665 | 	printf("Succesfully set BPF filter to '%s'\n", _bpf_filter);
666 |     }
667 |   }
668 | 
669 |   if(capture_until > 0) {
670 |     printf("Capturing traffic up to %u seconds\n", (unsigned int)capture_until);
671 |     capture_until += time(NULL);
672 |   }
673 | }
674 | 
675 | static void closePcapFile(void)
676 | {
677 |   if (_pcap_handle != NULL) {
678 |     pcap_close(_pcap_handle);
679 |   }
680 | }
681 | 
682 | void sigproc(int sig) {
683 |   static int called = 0;
684 | 
685 |   if(called) return; else called = 1;
686 |   shutdown_app = 1;
687 | 
688 |   closePcapFile();
689 |   printResults();
690 |   terminateDetection();
691 |   exit(0);
692 | }
693 | 
694 | 
695 | // executed for each packet in the pcap file
696 | static void pcap_packet_callback(u_char * args, const struct pcap_pkthdr *header, const u_char * packet)
697 | {
698 |   const struct ndpi_ethhdr *ethernet = (struct ndpi_ethhdr *) packet;
699 |   struct ndpi_iphdr *iph = (struct ndpi_iphdr *) &packet[sizeof(struct ndpi_ethhdr)];
700 |   u_int64_t time;
701 |   static u_int64_t lasttime = 0;
702 |   u_int16_t type, ip_offset;
703 | 
704 |   raw_packet_count++;
705 | 
706 |   if((capture_until != 0) && (header->ts.tv_sec >= capture_until)) {
707 |     sigproc(0);
708 |     return;
709 |   }
710 | 
711 |   time = ((uint64_t) header->ts.tv_sec) * detection_tick_resolution +
712 |     header->ts.tv_usec / (1000000 / detection_tick_resolution);
713 |   if (lasttime > time) {
714 |     // printf("\nWARNING: timestamp bug in the pcap file (ts delta: %llu, repairing)\n", lasttime - time);
715 |     time = lasttime;
716 |   }
717 |   lasttime = time;
718 | 
719 | 
720 |   type = ethernet->h_proto;
721 | 
722 |   // just work on Ethernet packets that contain IP
723 |   if (_pcap_datalink_type == DLT_EN10MB && type == htons(ETH_P_IP)
724 |       && header->caplen >= sizeof(struct ndpi_ethhdr)) {
725 |     u_int16_t frag_off = ntohs(iph->frag_off);
726 | 
727 |     if(header->caplen < header->len) {
728 |       static u_int8_t cap_warning_used = 0;
729 |       if (cap_warning_used == 0) {
730 | 	printf("\n\nWARNING: packet capture size is smaller than packet size, DETECTION MIGHT NOT WORK CORRECTLY\n\n");
731 | 	cap_warning_used = 1;
732 |       }
733 |     }
734 | 
735 |     if (iph->version != 4) {
736 |       static u_int8_t ipv4_warning_used = 0;
737 | 
738 |     v4_warning:
739 |       if (ipv4_warning_used == 0) {
740 | 	printf("\n\nWARNING: only IPv4 packets are supported in this demo (nDPI supports both IPv4 and IPv6), all other packets will be discarded\n\n");
741 | 	ipv4_warning_used = 1;
742 |       }
743 |       return;
744 |     }
745 | 
746 |     ip_offset = sizeof(struct ndpi_ethhdr);
747 |     if(decode_tunnels && (iph->protocol == IPPROTO_UDP) && ((frag_off & 0x3FFF) == 0)) {
748 |       u_short ip_len = ((u_short)iph->ihl * 4);
749 |       struct ndpi_udphdr *udp = (struct ndpi_udphdr *)&packet[sizeof(struct ndpi_ethhdr)+ip_len];
750 |       u_int16_t sport = ntohs(udp->source), dport = ntohs(udp->dest);
751 | 
752 |       if((sport == GTP_U_V1_PORT) || (dport == GTP_U_V1_PORT)) {
753 | 	/* Check if it's GTPv1 */
754 | 	u_int offset = sizeof(struct ndpi_ethhdr)+ip_len+sizeof(struct ndpi_udphdr);
755 | 	u_int8_t flags = packet[offset];
756 | 	u_int8_t message_type = packet[offset+1];
757 | 
758 | 	if((((flags & 0xE0) >> 5) == 1 /* GTPv1 */) && (message_type == 0xFF /* T-PDU */)) {
759 | 	  ip_offset = sizeof(struct ndpi_ethhdr)+ip_len+sizeof(struct ndpi_udphdr)+8 /* GTPv1 header len */;
760 | 
761 | 	  if(flags & 0x04) ip_offset += 1; /* next_ext_header is present */
762 | 	  if(flags & 0x02) ip_offset += 4; /* sequence_number is present (it also includes next_ext_header and pdu_number) */
763 | 	  if(flags & 0x01) ip_offset += 1; /* pdu_number is present */
764 | 
765 | 	  iph = (struct ndpi_iphdr *) &packet[ip_offset];
766 | 
767 | 	  if (iph->version != 4) {
768 | 	    // printf("WARNING: not good (packet_id=%u)!\n", (unsigned int)raw_packet_count);
769 | 	    goto v4_warning;
770 | 	  }
771 | 	}
772 |       }
773 | 
774 |     }
775 | 
776 |     // process the packet
777 |     packet_processing(time, header, iph, header->len - ip_offset, header->len);
778 |   }
779 | }
780 | 
781 | static void runPcapLoop(void)
782 | {
783 |   if((!shutdown_app) && (_pcap_handle != NULL))
784 |     pcap_loop(_pcap_handle, -1, &pcap_packet_callback, NULL);
785 | }
786 | 
787 | void test_lib() {
788 |   setupDetection();
789 |   openPcapFileOrDevice();
790 |   signal(SIGINT, sigproc);
791 |   runPcapLoop();
792 |   closePcapFile();
793 |   printResults();
794 |   terminateDetection();
795 | }
796 | 
797 | int main(int argc, char **argv)
798 | {
799 |   int i;
800 | 
801 |   parseOptions(argc, argv);
802 | 
803 |   for(i=0; i<num_loops; i++)
804 |     test_lib();
805 | 
806 |   return 0;
807 | }
808 | 


--------------------------------------------------------------------------------
/nDPI.html:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html><!-- HTML 5 -->
  2 | <html lang="en-US">
  3 | <head>
  4 | <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  5 | 
  6 | <title>  nDPI</title>
  7 | <!-- Platform WordPress Framework By PageLines - www.PageLines.com -->
  8 | 
  9 | <link rel="shortcut icon" href="http://www.ntop.org/wp-content/uploads/2011/09/favicon-ntop1.png" type="image/x-icon" />
 10 | <link rel="profile" href="http://gmpg.org/xfn/11" />
 11 | <script type="text/javascript">
 12 | function SetElementContent(name, val){
 13 |   var field = document.getElementById(name);
 14 |   if (window.navigator.userAgent.indexOf("MSIE") > 0) { // IE
 15 |     field.innerText = val;
 16 |   } else { // Firefox, Safari, etc.
 17 |     field.textContent = val;
 18 |   }
 19 | }
 20 | function SetLinkHREF(name, val){
 21 |   var field = document.getElementById(name);
 22 |   field.href = val;
 23 | }
 24 | </script><!--[if IE 6]>
 25 | <script src="http://www.ntop.org/wp-content/themes/platformpro/core/js/ie.belatedpng.js"></script> 
 26 | <script>DD_belatedPNG.fix('.pngbg, .shadow-bottom, .post-comments a, #fcolumns_container, #footer img, .branding_wrap img, .fboxgraphic img ');</script>
 27 | <![endif]-->
 28 | <link rel="alternate" type="application/rss+xml" title="ntop &raquo; Feed" href="http://www.ntop.org/feed/" />
 29 | <link rel="alternate" type="application/rss+xml" title="ntop &raquo; Comments Feed" href="http://www.ntop.org/comments/feed/" />
 30 | <link rel='stylesheet' id='q-a-plus-css'  href='http://www.ntop.org/wp-content/plugins/q-and-a/css/q-a-plus.css?ver=1.0.6.2' type='text/css' media='screen' />
 31 | <link rel='stylesheet' id='pagelines-pro-css'  href='http://www.ntop.org/wp-content/themes/platformpro/pro/pro.css?ver=1.3.0.2' type='text/css' media='all' />
 32 | <link rel='stylesheet' id='pagelines-stylesheet-css'  href='http://www.ntop.org/wp-content/themes/platformpro/style.css?ver=1.3.0.2' type='text/css' media='all' />
 33 | <!--[if lte IE 6]>
 34 | <link rel='stylesheet' id='ie6-style-css'  href='http://www.ntop.org/wp-content/themes/platformpro/css/ie6.css?ver=1.3.0.2' type='text/css' media='all' />
 35 | <![endif]-->
 36 | <!--[if IE 7]>
 37 | <link rel='stylesheet' id='ie7-style-css'  href='http://www.ntop.org/wp-content/themes/platformpro/css/ie7.css?ver=1.3.0.2' type='text/css' media='all' />
 38 | <![endif]-->
 39 | <link rel='stylesheet' id='contact-form-7-css'  href='http://www.ntop.org/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=3.5.4' type='text/css' media='all' />
 40 | <link rel='stylesheet' id='jetpack-widgets-css'  href='http://www.ntop.org/wp-content/plugins/jetpack/modules/widgets/widgets.css?ver=20121003' type='text/css' media='all' />
 41 | <link rel='stylesheet' id='wpss_style-css'  href='http://www.ntop.org/wp-content/plugins/wordpress-simple-survey/style.css?ver=3.7.1' type='text/css' media='all' />
 42 | <link rel='stylesheet' id='wpss_uicore-css'  href='http://www.ntop.org/wp-content/plugins/wordpress-simple-survey/css/ui.core.css?ver=3.7.1' type='text/css' media='all' />
 43 | <link rel='stylesheet' id='wpss_uitheme-css'  href='http://www.ntop.org/wp-content/plugins/wordpress-simple-survey/css/ui.theme.css?ver=3.7.1' type='text/css' media='all' />
 44 | <link rel='stylesheet' id='wpss_probar-css'  href='http://www.ntop.org/wp-content/plugins/wordpress-simple-survey/css/ui.progressbar.css?ver=3.7.1' type='text/css' media='all' />
 45 | <link rel='stylesheet' id='superfish-css'  href='http://www.ntop.org/wp-content/themes/platformpro/sections/nav/superfish.css?ver=1.3.0.2' type='text/css' media='screen' />
 46 | <script type='text/javascript' src='http://www.ntop.org/wp-includes/js/jquery/jquery.js?ver=1.10.2'></script>
 47 | <script type='text/javascript' src='http://www.ntop.org/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.2.1'></script>
 48 | <script type='text/javascript' src='http://www.ntop.org/wp-includes/js/comment-reply.min.js?ver=3.7.1'></script>
 49 | <script type='text/javascript' src='http://www.ntop.org/wp-content/plugins/gt-tabs/GTTabs.js?ver=3.7.1'></script>
 50 | <script type='text/javascript' src='http://www.ntop.org/wp-includes/js/jquery/ui/jquery.ui.core.min.js?ver=1.10.3'></script>
 51 | <script type='text/javascript' src='http://www.ntop.org/wp-includes/js/jquery/ui/jquery.ui.widget.min.js?ver=1.10.3'></script>
 52 | <script type='text/javascript' src='http://www.ntop.org/wp-includes/js/jquery/ui/jquery.ui.progressbar.min.js?ver=1.10.3'></script>
 53 | <script type='text/javascript' src='http://www.ntop.org/wp-content/plugins/wordpress-simple-survey/js/custom.js?ver=2.1.2'></script>
 54 | <link rel="EditURI" type="application/rsd+xml" title="RSD" href="http://www.ntop.org/xmlrpc.php?rsd" />
 55 | <link rel="wlwmanifest" type="application/wlwmanifest+xml" href="http://www.ntop.org/wp-includes/wlwmanifest.xml" /> 
 56 | <link rel='prev' title='Products' href='http://www.ntop.org/products/' />
 57 | <link rel='next' title='nBox Feedback' href='http://www.ntop.org/support/support-and-feedback/nboxquote-feedback/' />
 58 | <meta name="generator" content="WordPress 3.7.1" />
 59 | <link rel='canonical' href='http://www.ntop.org/products/ndpi/' />
 60 | <link rel='shortlink' href='http://wp.me/P1LxdS-sW' />
 61 | 	<style type="text/css">
 62 | 	    .GTTabs_divs{
 63 | 	padding: 4px;	
 64 | }
 65 | 
 66 | 
 67 | .GTTabs_titles{
 68 | 	display:none;	
 69 | }
 70 | 
 71 | ul.GTTabs
 72 | 	{
 73 | 		width: auto;
 74 | 	height: auto;
 75 | 	margin: 0px 0px 1em !important;
 76 | 	padding: 0.2em 1em 0.2em 20px !important;
 77 | 	border-bottom: 1px solid #ccc !important;
 78 | 	font-size: 11px;
 79 | 	list-style-type: none !important;
 80 | 	line-height:normal;
 81 | 	text-align: left;
 82 | 	display: block !important;
 83 | 	background: none;
 84 | 	}
 85 | 
 86 | ul.GTTabs li
 87 | 	{	
 88 | 	display: inline !important;	font-size: 11px;
 89 | 	line-height:normal;
 90 | 	background: none;
 91 | 	padding: 0px;
 92 | 	margin:1em 0px 0px 0px;
 93 | 	}
 94 |   
 95 | ul.GTTabs li:before{
 96 | content: none;	
 97 | }  
 98 |   	
 99 | ul.GTTabs li a
100 | 	{
101 | 	text-decoration: none;
102 | 	background: #f3f3f3;
103 | 	border: 1px solid #ccc  !important;
104 | 	padding: 0.2em 0.4em !important;
105 | 	color: #666 !important;
106 | 	outline:none;	
107 | 	cursor: pointer;
108 | 	
109 | 	}
110 | 	
111 | ul.GTTabs li.GTTabs_curr a{
112 | 	border-bottom:: 1px solid #fff !important;
113 | 	background: #fff;
114 | 	color: #000000 !important;
115 | 	text-decoration: none;
116 | 	
117 | 	}
118 | 
119 | ul.GTTabs li a:hover
120 | 	{
121 | 	color: #666 !important;
122 | 	background: #fff;
123 | 	text-decoration: none;
124 | 	
125 | 	}
126 | 
127 | .GTTabsNavigation{
128 | 	display: block !important;
129 | 	overflow:hidden;
130 | }
131 | 
132 | .GTTabs_nav_next{
133 | 	float:right;
134 | }
135 | 
136 | .GTTabs_nav_prev{
137 | 	float:left;
138 | }
139 | 	</style>
140 | 	<!-- Q & A -->
141 | 		<noscript><link rel="stylesheet" type="text/css" href="http://www.ntop.org/wp-content/plugins/q-and-a/css/q-a-plus-noscript.css?ver=1.0.6.2" /></noscript><!-- Q & A -->
142 | <!-- Jetpack Open Graph Tags -->
143 | <meta property="og:type" content="article" />
144 | <meta property="og:title" content="nDPI" />
145 | <meta property="og:url" content="http://www.ntop.org/products/ndpi/" />
146 | <meta property="og:description" content=" &lt;!--&nbsp;  nDPI Open and Extensible GPLv3 Deep Packet Inspection Library. nDPI is a ntop-maintained superset of the popular OpenDPI library. Released under the GPL license, its goal is to exte..." />
147 | <meta property="og:site_name" content="ntop" />
148 | <meta property="og:image" content="../../wp-content/uploads/2011/08/windows_icon.png" />
149 | <meta property="og:image" content="../../wp-content/uploads/2011/08/osx_icon.gif" />
150 | <meta property="og:image" content="../../wp-content/uploads/2011/08/free_bsd_icon.jpg" />
151 | <meta property="og:image" content="../../wp-content/uploads/2011/08/linux_icon.gif" />
152 | <meta property="og:image" content="/wp-content/uploads/2011/08/new.png" />
153 | <meta property="og:image" content="../../wp-content/uploads/2011/09/get_it_o.png" />
154 | <meta name="twitter:site" content="@jetpack" />
155 | <meta name="twitter:image0" content="../../wp-content/uploads/2011/08/windows_icon.png" />
156 | <meta name="twitter:image1" content="../../wp-content/uploads/2011/08/osx_icon.gif" />
157 | <meta name="twitter:image2" content="../../wp-content/uploads/2011/08/free_bsd_icon.jpg" />
158 | <meta name="twitter:image3" content="../../wp-content/uploads/2011/08/linux_icon.gif" />
159 | <meta name="twitter:card" content="gallery" />
160 | 		
161 | <script type="text/javascript"> /* <![CDATA[ */ jQuery(document).ready(function() {  jQuery('ul.sf-menu').superfish({ delay: 100, speed: 'fast', autoArrows:  1, dropShadows: 1 });  }); /* ]]> */ </script>			
162 | 
163 | <link rel="stylesheet" id="pagelines-dynamic-css" href="http://www.ntop.org/wp-content/uploads/pagelines/dynamic.css?ver=1.3.0.2" type="text/css" media="all" />
164 | <style type="text/css" id="syntaxhighlighteranchor"></style>
165 | </head>
166 | <body class="page page-id-1794 page-child parent-pageid-24 page-template-default canvas ttype-default tmain-default">
167 | 
168 | 		
169 | 		<div id="site" class="one-sidebar-left"> <!-- #site // Wraps #header, #page-main, #footer - closed in footer -->
170 | 		
171 | 				<div id="page"> <!-- #page // Wraps #header, #page-main - closed in footer -->
172 | 			<div id="page-canvas">
173 | 								<div id="header" class="container-group fix">
174 | 					<div class="outline">
175 | 									<div id="branding" class="container fix">
176 | 				<div class="texture">
177 | 					<div class="content">
178 | 						<div class="content-pad">
179 | <div class="branding_wrap">
180 | 	<a class="mainlogo-link" href="http://www.ntop.org" title="ntop"><img class="mainlogo-img" src="http://www.ntop.org/wp-content/uploads/2011/08/logo_new_m.png" alt="ntop" /></a>		
181 | 	
182 | 	<div class="icons" style="bottom: 21px; right: 1px;">
183 | 
184 | 				<a target="_blank" href="http://www.ntop.org/feed/" class="rsslink"></a>
185 | 				
186 | 																								
187 | 	</div>
188 | </div>
189 | 						<div class="clear"></div>
190 | 					</div>
191 | 				</div>
192 | 			</div>
193 | 		</div>
194 | 			<div id="primary-nav" class="container fix">
195 | 				<div class="texture">
196 | 					<div class="content">
197 | 						<div class="content-pad">
198 | 	<div id="nav_row" class="main_nav fix">
199 | 	
200 | 	<ul id="menu-nav" class="main-nav nosearch sf-menu">
201 | 		<li class="page_item page-item-34 page_item_has_children"><a href="http://www.ntop.org/">Home</a>
202 | <ul class='children'>
203 | 	<li class="page_item page-item-15"><a href="http://www.ntop.org/home/about-us/">About Us</a></li>
204 | 	<li class="page_item page-item-474"><a href="http://www.ntop.org/home/whos-behind-ntop/">The ntop Team</a></li>
205 | 	<li class="page_item page-item-1380"><a href="http://www.ntop.org/home/credits/">Credits</a></li>
206 | 	<li class="page_item page-item-1450"><a href="http://www.ntop.org/home/business-partners/">Partners</a></li>
207 | </ul>
208 | </li>
209 | <li class="page_item page-item-485"><a href="http://www.ntop.org/blog/">Blog</a></li>
210 | <li class="page_item page-item-24 page_item_has_children current_page_ancestor current_page_parent"><a href="http://www.ntop.org/products/">Products</a>
211 | <ul class='children'>
212 | 	<li class="page_item page-item-494"><a href="/products/">Overview</a></li>
213 | 	<li class="page_item page-item-2190"><a href="http://www.ntop.org/products/n2disk/">n2disk</a></li>
214 | 	<li class="page_item page-item-2320 page_item_has_children"><a href="http://www.ntop.org/products/nbox-2/">nBox</a>
215 | 	<ul class='children'>
216 | 		<li class="page_item page-item-161"><a href="http://www.ntop.org/products/nbox-2/nbox/">nBox NetFlow/IPFIX</a></li>
217 | 		<li class="page_item page-item-1019"><a href="http://www.ntop.org/products/nbox-2/nbox-recorder/">nBox Recorder</a></li>
218 | 	</ul>
219 | </li>
220 | 	<li class="page_item page-item-133 page_item_has_children"><a href="http://www.ntop.org/products/pf_ring/">PF_RING</a>
221 | 	<ul class='children'>
222 | 		<li class="page_item page-item-498"><a href="/products/pf_ring/">Overview</a></li>
223 | 		<li class="page_item page-item-77"><a href="http://www.ntop.org/products/pf_ring/dna/">DNA (Direct NIC Access)</a></li>
224 | 		<li class="page_item page-item-142"><a href="http://www.ntop.org/products/pf_ring/tnapi/">TNAPI</a></li>
225 | 		<li class="page_item page-item-540"><a href="http://www.ntop.org/products/pf_ring/hardware-packet-filtering/">Hardware Packet Filtering</a></li>
226 | 		<li class="page_item page-item-1906"><a href="http://www.ntop.org/products/pf_ring/libzero-for-dna/">Libzero for DNA</a></li>
227 | 		<li class="page_item page-item-74"><a href="http://www.ntop.org/products/pf_ring/vpf_ring/">Virtual PF_RING</a></li>
228 | 	</ul>
229 | </li>
230 | 	<li class="page_item page-item-146 page_item_has_children"><a href="http://www.ntop.org/products/nprobe/">nProbe</a>
231 | 	<ul class='children'>
232 | 		<li class="page_item page-item-502"><a href="/products/nprobe/">Overview</a></li>
233 | 		<li class="page_item page-item-157"><a href="http://www.ntop.org/products/nprobe/http-plugin/">MySQL/Oracle, DNS and HTTP Plugins</a></li>
234 | 		<li class="page_item page-item-830"><a href="http://www.ntop.org/products/nprobe/netflow-lite-plugin/">NetFlow-Lite Plugin</a></li>
235 | 	</ul>
236 | </li>
237 | 	<li class="page_item page-item-148"><a href="http://www.ntop.org/products/ntop/">ntopng</a></li>
238 | 	<li class="page_item page-item-1794 current_page_item"><a href="http://www.ntop.org/products/ndpi/">nDPI</a></li>
239 | 	<li class="page_item page-item-150"><a href="http://www.ntop.org/products/n2n/">n2n</a></li>
240 | </ul>
241 | </li>
242 | <li class="page_item page-item-1498 page_item_has_children"><a href="http://www.ntop.org/solutions/">Solutions</a>
243 | <ul class='children'>
244 | 	<li class="page_item page-item-1561"><a href="http://www.ntop.org/solutions/wire-speed-packet-capture/">Wire Speed Packet Capture</a></li>
245 | 	<li class="page_item page-item-1503"><a href="http://www.ntop.org/solutions/wire-speed-traffic-generation/">Wire Speed Traffic Generation</a></li>
246 | 	<li class="page_item page-item-1527"><a href="http://www.ntop.org/solutions/flow-based-monitoring/">Flow-based Monitoring</a></li>
247 | 	<li class="page_item page-item-1542"><a href="http://www.ntop.org/solutions/idsips-acceleration-snort-suricata-bro/">IDS/IPS Acceleration</a></li>
248 | 	<li class="page_item page-item-1550"><a href="http://www.ntop.org/solutions/softwarehardware-packet-filtering/">Hardware Packet Filtering</a></li>
249 | 	<li class="page_item page-item-1568"><a href="http://www.ntop.org/solutions/vm-wire-rate-networking/">VM Wire-Rate Networking</a></li>
250 | </ul>
251 | </li>
252 | <li class="page_item page-item-509 page_item_has_children"><a href="/get-started/download/">Get Started</a>
253 | <ul class='children'>
254 | 	<li class="page_item page-item-26"><a href="http://www.ntop.org/get-started/download/">Download</a></li>
255 | </ul>
256 | </li>
257 | <li class="page_item page-item-28 page_item_has_children"><a href="#">Support</a>
258 | <ul class='children'>
259 | 	<li class="page_item page-item-2125"><a href="http://www.ntop.org/support/kb/">Knowledge Base</a></li>
260 | 	<li class="page_item page-item-388"><a href="http://www.ntop.org/support/documentation/">Documentation</a></li>
261 | 	<li class="page_item page-item-1140"><a href="http://www.ntop.org/support/technical-papers/">Technical Papers</a></li>
262 | 	<li class="page_item page-item-386"><a href="http://www.ntop.org/support/need-help/">Need Help?</a></li>
263 | 	<li class="page_item page-item-390"><a href="http://www.ntop.org/support/contact-us/">Contact Us</a></li>
264 | </ul>
265 | </li>
266 | <li class="page_item page-item-90"><a href="http://shop.ntop.org" target="_blank">Shop</a></li>
267 | 	</ul>	</div>
268 | 
269 | 						<div class="clear"></div>
270 | 					</div>
271 | 				</div>
272 | 			</div>
273 | 		</div>
274 | 			<div id="secondnav" class="container fix">
275 | 				<div class="texture">
276 | 					<div class="content">
277 | 						<div class="content-pad">
278 | 						<div class="clear"></div>
279 | 					</div>
280 | 				</div>
281 | 			</div>
282 | 		</div>
283 | 					</div>
284 | 				</div>
285 | 								<div id="page-main" class="container-group fix"> <!-- #page-main // closed in footer -->
286 | 					<div id="dynamic-content" class="outline fix">
287 | 									<div id="maincontent" class="container fix">
288 | 				<div class="texture">
289 | 					<div class="content">
290 | 						<div class="content-pad">
291 | <div id="pagelines_content" class="one-sidebar-left fix">
292 | 	
293 | 		<div id="column-wrap" class="fix">
294 | 		
295 | 				<div id="column-main" class="mcolumn fix">
296 | 			<div class="mcolumn-pad" >
297 | 							<div id="theloop" class="copy fix">
298 | 				<div class="copy-pad">
299 | <div class="post-1794 page type-page status-publish hentry fpost" id="post-1794">
300 | 				
301 | 				
302 | 				
303 | 					  	
304 | 						<div class="entry_wrap fix">
305 | 						
306 | 							<div class="entry_content">
307 | 								<div style="float: right;"><img alt="" src="../../wp-content/uploads/2011/08/windows_icon.png" /> <img alt="" src="../../wp-content/uploads/2011/08/osx_icon.gif" /><!--&nbsp;<img src="../../wp-content/uploads/2011/08/free_bsd_icon.jpg"--> <img alt="" src="../../wp-content/uploads/2011/08/linux_icon.gif" /></div>
308 | <h2>nDPI</h2>
309 | <h3>Open and Extensible GPLv3 Deep Packet Inspection Library.</h3>
310 | <hr />
311 | <p>nDPI is a ntop-maintained superset of the popular <a href="http://code.google.com/p/opendpi/">OpenDPI</a> library. Released under the GPL license, its goal is to extend the original library by adding new protocols that are otherwise available only on the paid version of OpenDPI. In addition to Unix platforms, we also support Windows, in order to provide you a cross-platform DPI experience. Furthermore, we have modified nDPI do be more suitable for traffic monitoring applications, by disabling specific features that slow down the DPI engine while being them un-necessary for network traffic monitoring.</p>
312 | <p>nDPI is used by both ntop and nProbe for adding application-layer detection of protocols, regardless of the port being used. This means that it is possible to both detect known protocols on non-standard ports (e.g. detect http non ports other than 80), and also the opposite (e.g. detect Skype traffic on port 80). This is because nowadays the concept of port=application no longer holds.</p>
313 | <p>We are continuously extending nDPI and so far the following protocols are supported:</p>
314 | <ul>
315 | <li>FTP</li>
316 | <li>POP</li>
317 | <li>SMTP</li>
318 | <li>IMAP</li>
319 | <li>DNS</li>
320 | <li>IPP</li>
321 | <li>HTTP</li>
322 | <li>MDNS</li>
323 | <li>NTP</li>
324 | <li>NETBIOS</li>
325 | <li>NFS</li>
326 | <li>SSDP</li>
327 | <li>BGP</li>
328 | <li>SNMP</li>
329 | <li>XDMCP</li>
330 | <li>SMB</li>
331 | <li>SYSLOG</li>
332 | <li>DHCP</li>
333 | <li>PostgreSQL</li>
334 | <li>MySQL</li>
335 | <li>TDS</li>
336 | <li>DirectDownloadLink</li>
337 | <li>I23V5</li>
338 | <li>AppleJuice</li>
339 | <li>DirectConnect</li>
340 | <li>Socrates</li>
341 | <li>WinMX</li>
342 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" />VMware</li>
343 | <li>PANDO</li>
344 | <li>Filetopia</li>
345 | <li>iMESH</li>
346 | <li>Kontiki</li>
347 | <li>OpenFT</li>
348 | <li>Kazaa/Fasttrack</li>
349 | <li>Gnutella</li>
350 | <li>eDonkey</li>
351 | <li>Bittorrent</li>
352 | <li>OFF</li>
353 | <li>AVI</li>
354 | <li>Flash</li>
355 | <li>OGG</li>
356 | <li>MPEG</li>
357 | <li>QuickTime</li>
358 | <li>RealMedia</li>
359 | <li>Windowsmedia</li>
360 | <li>MMS</li>
361 | <li>XBOX</li>
362 | <li>QQ</li>
363 | <li>MOVE</li>
364 | <li>RTSP</li>
365 | <li>Feidian</li>
366 | <li>Icecast</li>
367 | <li>PPLive</li>
368 | <li>PPStream</li>
369 | <li>Zattoo</li>
370 | <li>SHOUTCast</li>
371 | <li>SopCast</li>
372 | <li>TVAnts</li>
373 | <li>TVUplayer</li>
374 | <li>VeohTV</li>
375 | <li>QQLive</li>
376 | <li>Thunder/Webthunder</li>
377 | <li>Soulseek</li>
378 | <li>GaduGadu</li>
379 | <li>IRC</li>
380 | <li>Popo</li>
381 | <li>Jabber</li>
382 | <li>MSN</li>
383 | <li>Oscar</li>
384 | <li>Yahoo</li>
385 | <li>Battlefield</li>
386 | <li>Quake</li>
387 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> VRRP</li>
388 | <li>Steam</li>
389 | <li>Halflife2</li>
390 | <li>World of Warcraft</li>
391 | <li>Telnet</li>
392 | <li>STUN</li>
393 | <li>IPSEC</li>
394 | <li>GRE</li>
395 | <li>ICMP</li>
396 | <li>IGMP</li>
397 | <li>EGP</li>
398 | <li>SCTP</li>
399 | <li>OSPF</li>
400 | <li>IP in IP</li>
401 | <li>RTP</li>
402 | <li>RDP</li>
403 | <li>VNC</li>
404 | <li>PCAnywhere</li>
405 | <li>SSL</li>
406 | <li>SSH</li>
407 | <li>USENET</li>
408 | <li>MGCP</li>
409 | <li>IAX</li>
410 | <li>TFTP</li>
411 | <li>AFP</li>
412 | <li>StealthNet</li>
413 | <li>Aimini</li>
414 | <li>SIP</li>
415 | <li>Truphone</li>
416 | <li>ICMPv6</li>
417 | <li>DHCPv6</li>
418 | <li>Armagetron</li>
419 | <li>CrossFire</li>
420 | <li>Dofus</li>
421 | <li>Fiesta</li>
422 | <li>Florensia</li>
423 | <li>Guildwars</li>
424 | <li>HTTP Application Activesync</li>
425 | <li>Kerberos</li>
426 | <li>LDAP</li>
427 | <li>MapleStory</li>
428 | <li>msSQL</li>
429 | <li>PPTP</li>
430 | <li>WARCRAFT3</li>
431 | <li>World of Kung Fu</li>
432 | <li>MEEBO</li>
433 | <li>FaceBook</li>
434 | <li>Twitter</li>
435 | <li>DropBox</li>
436 | <li>Gmail</li>
437 | <li>Google Maps</li>
438 | <li>YouTube</li>
439 | <li>Skype</li>
440 | <li>Google</li>
441 | <li>DCE RPC</li>
442 | <li>NetFlow_IPFIX</li>
443 | <li>sFlow</li>
444 | <li>HTTP Connect (SSL over HTTP)</li>
445 | <li>HTTP Proxy</li>
446 | <li>Netflix</li>
447 | <li>Citrix</li>
448 | <li>CitrixOnline/GotoMeeting</li>
449 | <li>Apple (iMessage, FaceTime&#8230;)</li>
450 | <li>Webex</li>
451 | <li>WhatsApp</li>
452 | <li>Apple iCloud</li>
453 | <li>Viber</li>
454 | <li>Apple iTunes</li>
455 | <li>Radius</li>
456 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> WindowsUpdate</li>
457 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> TeamViewer</li>
458 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> Tuenti</li>
459 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> LotusNotes</li>
460 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> SAP</li>
461 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> GTP</li>
462 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> UPnP</li>
463 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> LLMNR</li>
464 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> RemoteScan</li>
465 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> Spotify</li>
466 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> H323</li>
467 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> OpenVPN</li>
468 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> NOE</li>
469 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> CiscoVPN</li>
470 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> TeamSpeak</li>
471 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> Tor</li>
472 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> CiscoSkinny</li>
473 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> RTCP</li>
474 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> RSYNC</li>
475 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> Oracle</li>
476 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> Corba</li>
477 | <li><img alt="" src="/wp-content/uploads/2011/08/new.png" /> UbuntuONE</li>
478 | </ul>
479 | <p>&nbsp;</p>
480 | <h3>Handling Encrypted Content</h3>
481 | <hr />
482 | <p>The trend of Internet traffic is going towards encrypted content often using SSL. In order to let nDPI support encrypted connections, we have added a decoder for SSL (both client and server) certificates, thus we can figure out the protocol using the encryption certificate. This allows us to identify protocols such as Citrix Online and Apple iCloud that otherwise would be undetected.</p>
483 | <h3>Documentation</h3>
484 | <hr />
485 | You can refer to the <A HREF="/support/documentation/">documentation page</A> for nDPI manuals.</p>
486 | <p><img style="float: left; width: 32px; padding-right: 5px;" alt="" src="../../wp-content/uploads/2011/09/get_it_o.png" /></p>
487 | <h3>Download Source</h3>
488 | <hr />
489 | <p>nDPI is automatically downloaded when you build ntop and nProbe. However nothing prevents you from using it as a standalone DPI library. The source code can be downloaded from the <a href="/get-started/download/">ntop SVN</a>.</p>
490 | <h3>Please Contribute!</h3>
491 | <hr />
492 | <p>DPI is a time-consuming activity as protocols (in particular P2P) change quite often. This means that it&#8217;s necessary to update the code from time to time and add extensions. We would encourage anyone out there to help us adding or enhancing new protocols: we will put your contributions on our SVN and make them available to everyone free of charge. In fact the main reason why we decided to go for nDPI instead of using the original library, is that the company behind OpenDPI has never replied to our offers to merge the extensions we coded onto the original source code.</p>
493 | 									<div class="clear"></div> 
494 | 																</div>	
495 | 							<div class="tags">
496 | 								&nbsp;
497 | 							</div>
498 | 						</div>
499 | 								</div>
500 | 
501 | 				<div class="clear"></div>
502 | 				</div>
503 | 			</div>
504 | 			</div>
505 | 		</div>
506 | 		
507 | 				
508 | 	</div>	
509 | 	
510 | 	
511 | 	<div id="sidebar-wrap" class="fix">
512 | 			<div id="sidebar1" class="scolumn fix" >
513 | 				<div class="scolumn-pad">
514 | 								<div id="sidebar_primary" class="copy fix">
515 | 				<div class="copy-pad">
516 | 	<ul id="list_sidebar_primary" class="sidebar_widgets fix">
517 | 		<li id="nav_menu-4" class="widget_nav_menu widget fix"><div class="widget-pad"><h3 class="widget-title">Products</h3><div class="menu-products-menu-container"><ul id="menu-products-menu" class="menu"><li id="menu-item-544" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-544"><a href="/products/">Overview</a></li>
518 | <li id="menu-item-2343" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-2343"><a href="http://www.ntop.org/products/n2disk/">n2disk</a></li>
519 | <li id="menu-item-2341" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-2341"><a href="http://www.ntop.org/products/nbox-2/">nBox</a>
520 | <ul class="sub-menu">
521 | 	<li id="menu-item-265" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-265"><a href="http://www.ntop.org/products/nbox-2/nbox/">nBox NetFlow/IPFIX</a></li>
522 | 	<li id="menu-item-1026" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1026"><a href="http://www.ntop.org/products/nbox-2/nbox-recorder/">nBox Recorder</a></li>
523 | </ul>
524 | </li>
525 | <li id="menu-item-256" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-256"><a href="http://www.ntop.org/products/pf_ring/">PF_RING</a>
526 | <ul class="sub-menu">
527 | 	<li id="menu-item-545" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-545"><a href="/products/pf_ring/">Overview</a></li>
528 | 	<li id="menu-item-258" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-258"><a href="http://www.ntop.org/products/pf_ring/dna/">DNA (Direct NIC Access)</a></li>
529 | 	<li id="menu-item-1668" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1668"><a href="http://www.ntop.org/products/pf_ring/tnapi/">TNAPI</a></li>
530 | 	<li id="menu-item-543" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-543"><a href="http://www.ntop.org/products/pf_ring/hardware-packet-filtering/">Hardware Packet Filtering</a></li>
531 | 	<li id="menu-item-1963" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-1963"><a href="http://www.ntop.org/products/pf_ring/libzero-for-dna/">Libzero for DNA</a></li>
532 | 	<li id="menu-item-259" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-259"><a href="http://www.ntop.org/products/pf_ring/vpf_ring/">Virtual PF_RING</a></li>
533 | </ul>
534 | </li>
535 | <li id="menu-item-260" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-260"><a href="http://www.ntop.org/products/nprobe/">nProbe</a>
536 | <ul class="sub-menu">
537 | 	<li id="menu-item-546" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-546"><a href="/products/nprobe/">Overview</a></li>
538 | 	<li id="menu-item-261" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-261"><a href="http://www.ntop.org/products/nprobe/http-plugin/">MySQL/Oracle, DNS and HTTP Plugins</a></li>
539 | 	<li id="menu-item-833" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-833"><a href="http://www.ntop.org/products/nprobe/netflow-lite-plugin/">NetFlow-Lite Plugin</a></li>
540 | </ul>
541 | </li>
542 | <li id="menu-item-262" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-262"><a href="http://www.ntop.org/products/ntop/">ntopng</a></li>
543 | <li id="menu-item-1803" class="menu-item menu-item-type-post_type menu-item-object-page current-menu-item page_item page-item-1794 current_page_item menu-item-1803"><a href="http://www.ntop.org/products/ndpi/">nDPI</a></li>
544 | <li id="menu-item-263" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-263"><a href="http://www.ntop.org/products/n2n/">n2n</a></li>
545 | </ul></div></div></li>	</ul>
546 | 				<div class="clear"></div>
547 | 				</div>
548 | 			</div>
549 | 	
550 | 				</div>
551 | 			</div>
552 | 			</div>		
553 | 
554 | </div>						<div class="clear"></div>
555 | 					</div>
556 | 				</div>
557 | 			</div>
558 | 		</div>
559 | 				</div> <!-- END #dynamic-content -->
560 | 					
561 | 				<div id="morefoot_area">
562 | 								</div>
563 | 				<div class="clear"></div>
564 | 				
565 | 			</div> <!-- END #page-main from header -->
566 | 		</div> <!-- END #page-canvas from header -->
567 | 	</div> <!-- END #page from header -->
568 | 
569 | 	<div  id="footer">
570 | 		<div class="outline fix">
571 | 						<div id="footcols" class="container fix">
572 | 				<div class="texture">
573 | 					<div class="content">
574 | 						<div class="content-pad">
575 | 			<div id="fcolumns_container" class="dcol_container_5 fix">
576 | 				
577 | 				<div id="text-5" class="widget_text dcol_5 dcol"><div class="dcol-pad">			<div class="textwidget"><a class="home" href="http://www.ntop.org" title="Home">
578 | <img src="http://www.ntop.org/wp-content/uploads/2011/07/logo-ntop-small.png" alt="ntop" />
579 | </a></div>
580 | 		</div></div><div id="text-8" class="widget_text dcol_5 dcol"><div class="dcol-pad">			<div class="textwidget"><div class="footer-links list-links"><ul><li class="page_item page-item-34"><a href="http://www.ntop.org/" title="Home">Home</a></li><li class="page_item page-item-485"><a href="http://www.ntop.org/blog/" title="Blog">Blog</a></li><li class="page_item page-item-24 current_page_ancestor"><a href="http://www.ntop.org/products/" title="Products">Products</a></li><li class="page_item page-item-509"><a href="/get-started/" title="Get Started">Get Started</a></li><li class="page_item page-item-28"><a href="http://www.ntop.org/support/documentation/" title="Support">Support</a></li><li class="page_item page-item-90"><a href="http://shop.ntop.org" target="_blank" title="Shop">Shop</a></li></ul></div></div>
581 | 		</div></div><div id="text-6" class="widget_text dcol_5 dcol"><div class="dcol-pad"><h3 class="widget-title">Upcoming Events</h3>			<div class="textwidget"><ul class="lcp_catlist"></ul>
582 | 
583 | </div>
584 | 		</div></div><div id="text-9" class="widget_text dcol_5 dcol"><div class="dcol-pad">			<div class="textwidget"><div class="findent footer-more">
585 | Stay updated by subscribing to the <a href='http://www.ntop.org/?feed=rss2'>RSS feed</a>.
586 | </div></div>
587 | 		</div></div><div id="text-7" class="widget_text dcol_5 dcol"><div class="dcol-pad">			<div class="textwidget"><div class="findent terms">
588 | <small>© Copyright 1998-2013 - ntop
589 | <p>
590 | VAT ID 01567840507
591 | <br>
592 | ntop, PF_RING, nProbe, and n2disk are registered trademarks.
593 | </small>
594 | </div></div>
595 | 		</div></div>			</div>	
596 | 			<div class="clear"></div>
597 | 								<div class="clear"></div>
598 | 					</div>
599 | 				</div>
600 | 			</div>
601 | 		</div>
602 | 			<div class="clear"></div>
603 | 						<div class="clear"></div>
604 | 		</div>
605 | 	</div>
606 | </div>
607 | 	<div style="display:none">
608 | 	</div>
609 | <script type='text/javascript' src='http://www.ntop.org/wp-content/themes/platformpro/sections/nav/superfish.js?ver=1.0'></script>
610 | <script type='text/javascript' src='http://www.ntop.org/wp-content/themes/platformpro/sections/nav/jquery.bgiframe.min.js?ver=1.0'></script>
611 | <script type='text/javascript' src='http://www.ntop.org/wp-content/plugins/q-and-a/js/q-a-plus.js?ver=1.0.6.2'></script>
612 | <script type='text/javascript' src='http://www.ntop.org/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=3.45.0-2013.10.17'></script>
613 | <script type='text/javascript'>
614 | /* <![CDATA[ */
615 | var _wpcf7 = {"loaderUrl":"http:\/\/www.ntop.org\/wp-content\/plugins\/contact-form-7\/images\/ajax-loader.gif","sending":"Sending ..."};
616 | /* ]]> */
617 | </script>
618 | <script type='text/javascript' src='http://www.ntop.org/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=3.5.4'></script>
619 | <script type='text/javascript' src='http://s0.wp.com/wp-content/js/devicepx-jetpack.js?ver=201349'></script>
620 | <script type='text/javascript' src='http://s.gravatar.com/js/gprofiles.js?ver=2013Decaa'></script>
621 | <script type='text/javascript'>
622 | /* <![CDATA[ */
623 | var WPGroHo = {"my_hash":""};
624 | /* ]]> */
625 | </script>
626 | <script type='text/javascript' src='http://www.ntop.org/wp-content/plugins/jetpack/modules/wpgroho.js?ver=3.7.1'></script>
627 | 
628 | 	<script src="http://stats.wordpress.com/e-201349.js" type="text/javascript"></script>
629 | 	<script type="text/javascript">
630 | 	st_go({v:'ext',j:'1:2.5',blog:'26105464',post:'1794',tz:'0'});
631 | 	var load_cmc = function(){linktracker_init(26105464,1794,2);};
632 | 	if ( typeof addLoadEvent != 'undefined' ) addLoadEvent(load_cmc);
633 | 	else load_cmc();
634 | 	</script><script>var pltNewTabURLs = ["http:\/\/shop.ntop.org"];(function(){jQuery(function(e){return e("body").on("click","a",function(t){var n;n=e(this);if(e.inArray(n.attr("href"),pltNewTabURLs)>-1)return n.attr("target","_blank")})})}).call(this);</script>
635 | </body>
636 | </html>


--------------------------------------------------------------------------------