search

betolj / ndpi-netfilter

GNU General Public License v2.0
126 stars 72 forks source link

modules not loading on nDPI >r8323 #2

Closed syadnom closed 9 years ago

syadnom commented 9 years ago

I've pulled in nDPI release 8323 which does build and load, but it does nothing, no inspection. I can get 5761 built with the mainline nDPI sources and they work.

(debian 7)

betolj commented 9 years ago

Hi,

Unfortunately this module is incompatible with nf_conntrack_netlink. And, unless you recompile the kernel with the patch, the module nf_conntrack_netlink can not be loaded into memory (but you will have problems with conntrack tool).

rmmod nf_conntrack_netlink modprobe xt_ndpi

syadnom commented 9 years ago

betolj, so if I recompile the kernel with the patch, then I netfilter will be able to mark packets? All I really need is to mark routed packets with DSCP tags based on nDPI.

syadnom commented 9 years ago

betolj, I've install deb6 to match watch this was built against. I can't get the kernel patch to take 'patch -p1 <patchfile', the hunks are all failing. kernel 2.6.32. did you apply this patch differently somehow?

betolj commented 9 years ago

The kernel patch works only for kernel 3.x series.

I will make several fixes as soon and protocol id bugfix too. Wait a little bit.

betolj commented 9 years ago

The "ndpi-netfilter" projects with logical structure based on "ewildgoose" model don't work well nowadays.

  1. Only one exclusive "conntrack notify" call: For this reason, it cann't be used in conjunction with nfnetlink. But, when you remove the nfnetlink kernel module, the conntrack application wont works anymore.
  2. The web host detection depends on http or ssl protocols enabled: Youtube or Facebook protocols are not external modules (like /usr/src/nDPI/src/lib/protocols/*).

I finished xt_ndpi fixes today:

My tests, showed satisfactory results. https://github.com/betolj/ndpi-netfilter