montimage / mmt-dpi

A software C library designed to extract data attributes from network packets, server logs, and from structured events in general, in order to make them available for analysis

MMT-DPI

A software C library desinged to extract data attributes from network packets, server logs, and from structured events in general, in odrder to make them available for analysis

• Compile and Install
• Full documentation

---

Website: http://www.montimage.com

Contact: [email protected]

mmt-dpi's Issues

DPI does not recognise RDP protocol

In the following pcap, MMT-DPI recognises RDP as MSSQL protocol
rdp.pcapng.zip

Incorrect classification in GTP

The 3 fields, sequence number (2 octets), n-pdu number (1 octet) and extension header (1 octet), are present if at least one of 3 bit fields, S, NP, E is present.

So the classification is incorrect:

int gtp_classify_next_proto(ipacket_t * ipacket, unsigned index) {

	int offset = get_packet_offset_at_index(ipacket, index);
	struct gtp_header_generic *gtp = (struct gtp_header_generic*)& ipacket->data[offset];
	int gtp_offset = sizeof (struct gtp_header_generic);
	if(gtp->sequence_number == 1){
		gtp_offset += 4;
	}
	if(gtp->ndpu_number == 1){
		gtp_offset += 2;
	}
	if(gtp->extension_header == 1){
		gtp_offset += 2;	
	}
	if (gtp->message_type == 0xff) {
		classified_proto_t retval;
		retval.proto_id = PROTO_IP;
		retval.offset = gtp_offset;
		retval.status = Classified;
		return set_classified_proto(ipacket, index + 1, retval);
	}
	return 0;
}

DPI does not recognise TPKT protocol

In the following pcap, DPI classifies TPKT packets as MSSQL ones
tpkt.pcapng.zip

Compilation error, redefinition of ‘union byteswap_64_u’ and of ‘ntohll’, when using gcc -v 9.4 and 7.5.0

[COMPILE] plugins_engine.o
[ARCHIVE] libmmt_core.a
[LIBRARY] libmmt_core.so.1.7.2.0
[COMPILE] proto_int.o
In file included from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.c:8:
/home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.h:17:7: error: redefinition of ‘union byteswap_64_u’
17 | union byteswap_64_u {
| ^~~~~~~~~~~~~
In file included from /home/zujany/mmt-dpi/src/mmt_core/public_include/plugin_defs.h:14,
from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.h:11,
from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.c:8:
/home/zujany/mmt-dpi/src/mmt_core/public_include/data_defs.h:64:7: note: originally defined here
64 | union byteswap_64_u {
| ^~~~~~~~~~~~~
In file included from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.c:8:
/home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.h:30:24: error: redefinition of ‘ntohll’
30 | static inline uint64_t ntohll(uint64_t x){
| ^~~~~~
In file included from /home/zujany/mmt-dpi/src/mmt_core/public_include/plugin_defs.h:14,
from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.h:11,
from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.c:8:
/home/zujany/mmt-dpi/src/mmt_core/public_include/data_defs.h:77:24: note: previous definition of ‘ntohll’ was here
77 | static inline uint64_t ntohll(uint64_t x){
| ^~~~~~
In file included from /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.c:9:
/home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int_report.h:87:1: note: offset of packed bit-field ‘report_metadata_bits’ has changed in GCC 4.4
87 | int_report_v10_t;
| ^~~~~~~~~~~~~~~~
make: *** [/home/zujany/mmt-dpi/rules/common.mk:288: /home/zujany/mmt-dpi/src/mmt_tcpip/lib/protocols/proto_int.o] Error 1

segmentation faut

when testing bigFlows.pcap: ./probe -t ~/share_vbox/pcaps/bigFlows.pcap -Xfile-output.enable=false -Xthread-nb=3