Mailing List Archive: nDPI entries

nDPI entries

Jan 8, 2018, 4:38 PM

Post #1 of 5 (821 views)

Hi,
I’m evaluating ntopng, and so far it’s looking good. One of the problems I need to solve before we commit, is that the application information for DPI doesn’t seem to be editable. For example, OpenVPN is known, but not on a non-default port. I would like to be able to create a new entry for various internal protocols – is there any guidance on this?

D

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: nDPI entries [ In reply to ]

deri at ntop

Jan 8, 2018, 10:33 PM

Post #2 of 5 (821 views)

Permalink

Hi,
if this is the case then it’s a bug as we should be able to detect it regardless of the port. Please file an issue on https://github.com/ntop/nDPI/issues and attach a pcap we can use to reproduce the defect

Thanks Luca

> On 9 Jan 2018, at 01:38, spam_0258@eyetsystems.com.au wrote:
>
> Hi,
> I’m evaluating ntopng, and so far it’s looking good. One of the problems I need to solve before we commit, is that the application information for DPI doesn’t seem to be editable. For example, OpenVPN is known, but not on a non-default port. I would like to be able to create a new entry for various internal protocols – is there any guidance on this?
>
> D
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop

_______________________________________________
Ntop mailing list
Ntop@listgateway.unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop

Re: nDPI entries [ In reply to ]

deri at ntop

Jan 8, 2018, 10:33 PM

Post #3 of 5 (821 views)

Permalink

Re: nDPI entries [ In reply to ]

mainardi at ntop

Jan 9, 2018, 12:59 AM

Post #4 of 5 (821 views)

Permalink

To create new entries for internal protocols see https://www.ntop.org/ndpi/configuring-ndpi-for-custom-protocol-detection/ <https://www.ntop.org/ndpi/configuring-ndpi-for-custom-protocol-detection/>
You can either use ports, as well as host names/ip addresses.

Simone

> On 9 Jan 2018, at 01:38, <spam_0258@eyetsystems.com.au> <spam_0258@eyetsystems.com.au> wrote:
>
> Hi,
> I’m evaluating ntopng, and so far it’s looking good. One of the problems I need to solve before we commit, is that the application information for DPI doesn’t seem to be editable. For example, OpenVPN is known, but not on a non-default port. I would like to be able to create a new entry for various internal protocols – is there any guidance on this?
>
> D
>
> _______________________________________________
> Ntop mailing list
> Ntop@listgateway.unipi.it
> http://listgateway.unipi.it/mailman/listinfo/ntop