Re: Help required to identify protocols (Spotify)
Luca Deri <[email protected]> Tue, 2 Jun 2020 15:00:59 +0200
| Newsgroups | gmane.linux.ntop.devel |
|---|---|
| Message-ID | <[email protected]> |
--===============7253109637889080577== Content-Type: multipart/alternative; boundary="Apple-Mail=_5C9F007F-F08B-4BD7-9FF8-AB81C36C1401" --Apple-Mail=_5C9F007F-F08B-4BD7-9FF8-AB81C36C1401 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii Hi Abid, just fixed = https://github.com/ntop/nDPI/commit/5afa3ad818a9bbfd83526f03507e60575c6c83= bc Regards Luca > On 2 Jun 2020, at 13:55, Abid Zaidi <[email protected]> wrote: >=20 > Greetings, >=20 > I'm mailing on this list for guidance. I want to learn adding a new = protocol or fixing an existing protocol in NDPI. I've collected spotify = packets and been comparing it with the results, the pcap dump is = available here ( = https://drive.google.com/file/d/13sN3BkkxNdud2Nr8szeZJMSu3KOtvU35/view?usp= =3Dsharing = <https://drive.google.com/file/d/13sN3BkkxNdud2Nr8szeZJMSu3KOtvU35/view?us= p=3Dsharing> ). feeding this dump to ndpiReader I get the following = stats. >=20 >=20 > Detected protocols: > DNS packets: 66 bytes: 9465 = flows: 33 =20 > MDNS packets: 121 bytes: 11111 = flows: 4 =20 > NetBIOS packets: 15 bytes: 1380 = flows: 1 =20 > SSDP packets: 157 bytes: 51525 = flows: 48 =20 > SNMP packets: 4 bytes: 476 = flows: 1 =20 > IGMP packets: 15 bytes: 682 = flows: 6 =20 > TLS packets: 16095 bytes: 14205389 = flows: 9 =20 > ICMPV6 packets: 12 bytes: 992 = flows: 3 =20 > Google packets: 706 bytes: 165715 = flows: 9 =20 > LLMNR packets: 42 bytes: 3370 = flows: 22 =20 > Spotify packets: 87 bytes: 27349 = flows: 4 =20 > Microsoft365 packets: 98 bytes: 47219 = flows: 4 =20 > MS_OneDrive packets: 26 bytes: 7204 = flows: 1 =20 >=20 > Following are few questions, I hope someone could make me understand = this process more clearly > Why does majority of packets go under TLS, I understand it might be = using TLS but shouldn't it be under Spotify? This means the spotify.c in = protocols needs to be fixed? > How do you guys infer packet protocols looking at the payload, I've = seen few checks with hardcoded bytes, but what if the payload changes = our logic would fail? >=20 > Regards, > Abid Zaidi > _______________________________________________ > Ntop-dev mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-dev --Apple-Mail=_5C9F007F-F08B-4BD7-9FF8-AB81C36C1401 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=us-ascii <html><head><meta http-equiv=3D"Content-Type" content=3D"text/html; = charset=3Dus-ascii"></head><body style=3D"word-wrap: break-word; = -webkit-nbsp-mode: space; line-break: after-white-space;" class=3D"">Hi = Abid,<div class=3D"">just fixed<div class=3D""><a = href=3D"https://github.com/ntop/nDPI/commit/5afa3ad818a9bbfd83526f03507e60= 575c6c83bc" = class=3D"">https://github.com/ntop/nDPI/commit/5afa3ad818a9bbfd83526f03507= e60575c6c83bc</a></div><div class=3D""><br class=3D""></div><div = class=3D"">Regards Luca<br class=3D""><div><br class=3D""><blockquote = type=3D"cite" class=3D""><div class=3D"">On 2 Jun 2020, at 13:55, Abid = Zaidi <<a href=3D"mailto:[email protected]" = class=3D"">[email protected]</a>> wrote:</div><br = class=3D"Apple-interchange-newline"><div class=3D""><div dir=3D"ltr" = class=3D"">Greetings,<div class=3D""><br class=3D""><div class=3D"">I'm = mailing on this list for guidance. I want to learn adding a new protocol = or fixing an existing protocol in NDPI. I've collected spotify packets = and been comparing it with the results, the pcap dump is available here = ( <a = href=3D"https://drive.google.com/file/d/13sN3BkkxNdud2Nr8szeZJMSu3KOtvU35/= view?usp=3Dsharing" target=3D"_blank" = class=3D"">https://drive.google.com/file/d/13sN3BkkxNdud2Nr8szeZJMSu3KOtvU= 35/view?usp=3Dsharing</a> ). feeding this dump to ndpiReader I get = the following stats.</div></div><div class=3D""><br class=3D""></div><div = class=3D""><br class=3D""></div><blockquote style=3D"margin:0 0 0 = 40px;border:none;padding:0px" class=3D""><div class=3D"">Detected = protocols:</div><div class=3D""> DNS = packets: 66 = bytes: 9465 flows: = 33 </div><div class=3D""> MDNS = packets: 121 = bytes: 11111 = flows: 4 </div><div = class=3D""> NetBIOS = packets: 15 bytes: 1380 = flows: 1 = </div><div class=3D""> SSDP = packets: 157 = bytes: 51525 flows: 48 = </div><div class=3D""> SNMP = packets: 4 = bytes: 476 = flows: 1 </div><div = class=3D""> IGMP = packets: 15 bytes: 682 = flows: 6 = </div><div class=3D""> TLS = packets: 16095 = bytes: 14205389 flows: 9 = </div><div class=3D""> ICMPV6 = packets: 12 = bytes: 992 flows: = 3 </div><div class=3D""> = Google packets: 706 = bytes: 165715 = flows: 9 </div><div = class=3D""> LLMNR = packets: 42 bytes: 3370 = flows: 22 = </div><div class=3D""> Spotify = packets: 87 = bytes: 27349 flows: 4 = </div><div class=3D""> Microsoft365 = packets: 98 = bytes: 47219 flows: 4 = </div><div class=3D""> = MS_OneDrive packets: 26 = bytes: 7204 = flows: 1 </div><div class=3D""><br = class=3D""></div></blockquote><div class=3D"">Following are = few questions, I hope someone could make me understand this = process more clearly</div><div class=3D"">Why does majority of = packets go under TLS, I understand it might be using TLS but shouldn't = it be under Spotify? This means the spotify.c in protocols needs to be = fixed?</div><div class=3D"">How do you guys infer packet protocols = looking at the payload, I've seen few checks with hardcoded bytes, = but what if the payload changes our logic would fail?</div><div = class=3D""><br class=3D""></div><div class=3D"">Regards,</div><div = class=3D"">Abid Zaidi</div></div> _______________________________________________<br class=3D"">Ntop-dev = mailing list<br class=3D""><a = href=3D"mailto:[email protected]" = class=3D"">[email protected]</a><br = class=3D"">http://listgateway.unipi.it/mailman/listinfo/ntop-dev</div></bl= ockquote></div><br class=3D""></div></div></body></html>= --Apple-Mail=_5C9F007F-F08B-4BD7-9FF8-AB81C36C1401-- --===============7253109637889080577== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev --===============7253109637889080577==--