ntop / nDPI

Open Source Deep Packet Inspection Software Toolkit
http://www.ntop.org
GNU Lesser General Public License v3.0
3.86k stars 899 forks source link

Roadmap #2537

Open IvanNardi opened 2 months ago

IvanNardi commented 2 months ago

Just some non-commital ideas of features/protocols/algorithms to add (or delete) before the next release. Feel free to add anything in the comments

0xA50C1A1 commented 2 months ago

~I thought it might be nice to add support for the protocol used by the Lustre parallel file system. I've noticed that sessions start with a few identical short packets. However, I only have two pcap files with traffic that I captured on my test setup, so I can’t be completely sure about the pattern.~

~Here's the pcap samples: lustrefs.zip~

0xA50C1A1 commented 2 months ago

Also I’d recommend either removing the Armagetron protocol dissector (because barely anyone plays it anymore) or revamping it since it’s been broken for a while and the game now uses a different protocol.

Here’s a pcap example with the current traffic: armagetron_udp.zip

mmanoj commented 2 months ago

Can we create the agenda/wish list we can address with next roadmap.From my side I'm adding following. 1.VPN and Anonymize/proxy detection in encrypted traffic with ML/DL, 2.Adding more popular services and protocols (we can create list later) 3.Adding more detection techniques / algorithms with AI/ML

utoni commented 2 months ago

I would also like to have a way to automatically check for possible protocol dissector changes (i.e. via documentation URL in doc/) periodically.

aouinizied commented 2 months ago

do not hesitate for direct ping when it comes to AI/ML, what I would like the most:

IvanNardi commented 1 month ago

I would also like to have a way to automatically check for possible protocol dissector changes (i.e. via documentation URL in doc/) periodically.

@utoni, could you elaborate, please? A better extended changelog or something else?