search

ntop / nDPI

Open Source Deep Packet Inspection Software Toolkit
http://www.ntop.org
GNU Lesser General Public License v3.0
3.85k stars 896 forks source link

Support for VPN and TOR browser detection #2484

Closed DanujaSW closed 4 months ago

DanujaSW commented 4 months ago

Hi,

I have been testing the dpi with several VPNs to see if these apps are detected. The following are the undetected VPNs from my testing:

  1. Ultrasurf
  2. Cloudfare WARP (1.1.1.1)
  3. Tunnel Bear
  4. Turbo VPN

In addition to these VPNs, I have tested using TOR browser. This was undetected as well.

I have included the PCAPs for each of these tests for your reference in the following link: PCAPs google drive link

May I know if there is a strategy to support such application detection?

IvanNardi commented 4 months ago

@DanujaSW , thanks for your report. At first glance, it seems that at least some of these files have been captured when the vpn was already on. If that is the case, could you try again on this order, please?

The initial packets of the flows might be quite useful...

DanujaSW commented 4 months ago

@IvanNardi I have taken the PCAPs according to your specifications and included them in the link below: PCAP files with VPN turned on after capturing starts

Please let me know if you need any additional information from me to help with your analysis.

IvanNardi commented 4 months ago

@DanujaSW ,could you share 3/4 other examples of Warp traffic (captured as the last one), please? I am going to take a closer look at it...

IvanNardi commented 4 months ago

TOR classification might be not perfect, but I think that is more than fine...

ivan@ivan-Latitude-E6540:~/svnrepos/nDPI(warp)$ ./example/ndpiReader -t -i ~/Downloads/VPN-testing-28.06.2024/tor-browser.pcap 
[...]
Detected protocols:
    Unknown              packets: 344           bytes: 22634         flows: 32           
    HTTP                 packets: 112           bytes: 6636          flows: 12           
    MDNS                 packets: 83            bytes: 6911          flows: 2            
    NetBIOS              packets: 12            bytes: 1104          flows: 1            
    DHCP                 packets: 24            bytes: 8616          flows: 2            
    ICMP                 packets: 202           bytes: 39867         flows: 9            
    IGMP                 packets: 60            bytes: 3530          flows: 3            
    TLS                  packets: 11226         bytes: 8726895       flows: 149          
    ICMPV6               packets: 6             bytes: 516           flows: 1            
    YouTube              packets: 144           bytes: 59132         flows: 8            
    Skype_Teams          packets: 225           bytes: 30638         flows: 8            
    Google               packets: 1611          bytes: 1323566       flows: 35           
    LLMNR                packets: 11            bytes: 825           flows: 11           
    Tor                  packets: 112660        bytes: 111446056     flows: 16         <------------------------------
    QUIC                 packets: 500           bytes: 206042        flows: 12           
    Github               packets: 254           bytes: 68027         flows: 22           
    Microsoft            packets: 1193          bytes: 194457        flows: 147          
    Microsoft365         packets: 3453          bytes: 1045531       flows: 449          
    GoogleServices       packets: 638           bytes: 233855        flows: 54           
    Teams                packets: 4809          bytes: 1490571       flows: 537          
    Cybersec             packets: 1169          bytes: 143444        flows: 229          
    TunnelBear           packets: 329           bytes: 47852         flows: 28
DanujaSW commented 4 months ago

@DanujaSW ,could you share 3/4 other examples of Warp traffic (captured as the last one), please? I am going to take a closer look at it...

@IvanNardi I will get back to you with this info on as soon as possible on Monday since my test setup is in my office.

Thank you for the update to tunnelbear detection.

As for the TOR classification, there might be an error on my side. I will check on it further. Thx for the clarification.

DanujaSW commented 4 months ago

@IvanNardi I have uploaded the PCAPs for Warp traffic as you requested in the link below: Cloudfare Warp packet captures

Please let me know if you need any further information

DanujaSW commented 4 months ago

@IvanNardi Thanks for the updates. We will do further testing with the updated code and let you know how it goes.

DanujaSW commented 4 months ago

@IvanNardi , the detection works for Cloudfare Warp. I have included the testing results below:

Currently working on testing TunnelBear detection.

IvanNardi commented 4 months ago

@DanujaSW, I don't know if it is feasible for you, but I would like if you could capture some warp traffic using MASQUE as transport (the previous captures use Wireguard). It seems that you can change that, according to https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/configure-warp/warp-settings/ in "Device tunnel protocol" section.

The new code should handle also MASQUE, but I would like to test it with a real trace...

DanujaSW commented 4 months ago

@IvanNardi, I will set up the captures as you requested. It will require a small change in my test setup. I will get the results to you as soon as possible tomorrow morning.

DanujaSW commented 4 months ago

@IvanNardi , From what I could find, MASQUE has not been released in open beta mode yet. The most recent information I could find was in the comments under the following post: https://www.reddit.com/r/CloudFlare/comments/1cb8tn2/zero_trust_warp_tunneling_with_a_masque/ Where a Cloudflare member mentioned yesterday that they had just started rolling out the update in stages.

Tried downloading the beta Warp client and logging into a Zero-trust account on my device. This still does not give an option to switch over to Masque from WireGuard.

The following are the only modes available to set in warp-cli mode

Arguments:
  <MODE>  [possible values: warp, doh, warp+doh, dot, warp+dot, proxy, tunnel_only]

Please let me know if you are aware of another method to set up Warp with Masque. I will keep checking if there is an option to do so as well.

IvanNardi commented 4 months ago

Please let me know if you are aware of another method to set up Warp with Masque

No, I don't. I hoped that MASQUE beta was more available

IvanNardi commented 4 months ago

Bottom line:

Note that most of the "VPN apps" are some kind of simple wrapper above Wireguard/OpenVPN/IPSec: in most cases nDPI identify their traffic as such

@DanujaSW, thanks for all the traces that you provided: they were very useful

DanujaSW commented 4 months ago

@IvanNardi , Thank you for your help with this issue and the changes you made. They helped us out a lot.

I will keep up with the CloudFlare MASQUE situation and run the tests on it when the beta becomes available. I will let you know if there are any updates.