search

betolj / ndpi-netfilter

GNU General Public License v2.0
126 stars 69 forks source link

all content-type-matches seem's not to work #31

Open mniehren opened 7 years ago

mniehren commented 7 years ago

Hi,

i am using the latest version from Jun 18. Facebook, Google, Youtube work's all fine, but all of the streaming protocols doesn't.

For example i tried to download an .mp4 File and dropped via iptables the quicktime-Filter, which includes the video/mp4 content-type. But the iptables rule does not match. If i tcpdump the traffic, and analyse it with ndpiReader (compile from the includes nDPI.tar.gz), the traffic is recognised as QUICKTIME.

Kernel Version is V3.14.61

hope for you help Michael

mniehren commented 7 years ago

I think, i found the problem.

Is it right, that i first have to execute the 2 dpi_check rules before i do any other ndpi-rules ? iptables -t mangle -A PREROUTING -m ndpi --dpi_check iptables -t mangle -A POSTROUTING -m ndpi --dpi_check

if i do so, it works

best regards, Michael

KalinIvanov commented 7 years ago

I have the same issue and when I added the both --dpi_check rules it worked but not at all. For example I've tested it with some VIBER traffic and it catches only few packets, however the communication still persist. With ndpiReader it detects all packets for the application or at least they are more than what iptables counter shows. I will continue to test it with other apps and more simultaneous clients connections. For now it seems to work fine for FACEBOOK and GOOGLE.

kong156 commented 6 years ago

take a look at this one https://github.com/betolj/ndpi-netfilter/issues/53