Option SID to identify the server...

utoni / nDPId

Tiny nDPI based deep packet inspection daemons / toolkit.

GNU General Public License v3.0

67 stars 15 forks source link

Option SID to identify the server... #46

Closed UnveilTech closed 3 weeks ago

UnveilTech commented 1 month ago

Hello Toni, proposal from our side, an unique SID (UUID) to identify the server/machine.

we know we could use the flag 'Alias' but we would like to use that flag for another work.

suggestion:

use "cat /sys/class/dmi/id/product_uuid" by default for the unique SID identification
or use a special argument (ex: -U or -D or other) or from the ndpid.conf (sid/uuid=blablabla...)

what do you think ?

bye Fred

utoni commented 1 month ago

Hi Fred,

that's a great idea. I'll take a look how this could be integrated in nDPId.

Thanks!

UnveilTech commented 1 month ago

Hi Toni, appreciated, thanks :o)

we'll post a new suggestion very soon, you should like it too...

bye Fred

utoni commented 1 month ago

Just to clarify: You want an extra JSON element i.e. "uuid": "XXXX.." in addition to the already existing "alias": "host.tld" as part of all events, right?

UnveilTech commented 1 month ago

Hi Toni, 100% correct

bye Fred

UnveilTech commented 4 weeks ago

hello Toni, we've added the UUID, commented "// UT" nDPId.zip please check it fits your policies...

bye Fred

utoni commented 4 weeks ago

Thanks Fred. I am already integrating and extending your patch. :)

UnveilTech commented 4 weeks ago

you're welcome Toni ;o)

we're also having a look to the encrypt/decrypt (OpenSSL AES), it does not seem to be easy to find the right C code...

bye Fred

utoni commented 3 weeks ago

With commit https://github.com/utoni/nDPId/commit/817559ffa7ddd1c3e71c9b2b0d862c381bafd5f6 it is now possible to use UUID for every nDPId instance. Please give me some feedback. :)

UnveilTech commented 3 weeks ago

Toni, looks great, thanks a lot.

bye Fred