NDPI

nDPI este un toolkit de deep packet inspection și un clasificator de protocoale de rețea conceput pentru a identifica protocoalele și a detecta amenințările de securitate prin inspecția payload-ului pachetelor. Funcționează ca un monitor de securitate a rețelei și un framework de analiză a traficului utilizat pentru a determina serviciile care generează fluxurile de rețea.

Sistemul utilizează o arhitectură modulară de disecție și un lanț de disecție bazat pe secvențe pentru a interpreta traficul de rețea. Suportă definirea protocoalelor personalizate și extensii de disecție a protocoalelor, permițând identificarea protocoalelor de rețea proprietare sau noi.

Toolkit-ul oferă capabilități pentru identificarea protocoalelor de rețea, detectarea amenințărilor de securitate și filtrarea traficului de rețea. Aceste funcții permit monitorizarea modelelor de comunicare pentru a identifica comportamentul malițios și blocarea selectivă a pachetelor de rețea nedorite.

Features

Packet Inspection - Provides deep analysis of network packet payloads to identify underlying protocols and services in real time.
Network Security Monitoring - Analyzes network traffic and flow behavior to identify malicious communication patterns and security risks.
Flow Tracking Engines - Maintains stateful tracking of network flows to analyze communication behavior across multiple packets.
Protocol Dissectors - Implements a modular system of pluggable protocol dissectors for parsing and analyzing network traffic.
Analysis Chains - Uses a sequence-based chain of dissectors to progressively identify the originating protocol of a network flow.
Protocol Classifiers - Determines the originating service of a network flow using a sequence of specialized protocol dissectors.
Behavioral Threat Detection - Monitors network flow behavior and traffic patterns to detect malicious activity and security threats.
Payload-Based Traffic Filtering - Inspects packet payloads to differentiate between protocols and filter traffic beyond port-level analysis.
Protocol Signature Matching - Matches packet payloads against a database of predefined signatures to identify specific network services.
Analysis Frameworks - Provides a framework for defining custom protocol detection rules and interpreting proprietary network traffic.
Custom Network Protocols - Supports the definition of custom communication rules to recognize proprietary or new network protocols.
Malicious Traffic Blocking - Identifies and selectively drops unwanted network packets to block communication with malicious entities.
Network Traffic Filtering - Enables selective blocking or dropping of unwanted network packets based on identified protocol traffic.

Istoric stele

ntopnDPI

Name: ntop/ndpi
Author: ntop

View on GitHub

4,506 stele992 fork-uriCLGPL-3.05 vizualizăriwww.ntop.org

NDPI

Features

Packet Inspection - Provides deep analysis of network packet payloads to identify underlying protocols and services in real time.
Network Security Monitoring - Analyzes network traffic and flow behavior to identify malicious communication patterns and security risks.
Flow Tracking Engines - Maintains stateful tracking of network flows to analyze communication behavior across multiple packets.
Protocol Dissectors - Implements a modular system of pluggable protocol dissectors for parsing and analyzing network traffic.
Analysis Chains - Uses a sequence-based chain of dissectors to progressively identify the originating protocol of a network flow.
Protocol Classifiers - Determines the originating service of a network flow using a sequence of specialized protocol dissectors.
Behavioral Threat Detection - Monitors network flow behavior and traffic patterns to detect malicious activity and security threats.
Payload-Based Traffic Filtering - Inspects packet payloads to differentiate between protocols and filter traffic beyond port-level analysis.
Protocol Signature Matching - Matches packet payloads against a database of predefined signatures to identify specific network services.
Analysis Frameworks - Provides a framework for defining custom protocol detection rules and interpreting proprietary network traffic.
Custom Network Protocols - Supports the definition of custom communication rules to recognize proprietary or new network protocols.
Malicious Traffic Blocking - Identifies and selectively drops unwanted network packets to block communication with malicious entities.
Network Traffic Filtering - Enables selective blocking or dropping of unwanted network packets based on identified protocol traffic.

Alternative open-source pentru NDPI

Proiecte open-source similare, clasificate după numărul de funcționalități comune cu NDPI.

ntop/ntopng
ntop/ntopng
7,880Vezi pe GitHub
ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security monitor, an SNMP network management system, and an industrial protocol analyzer for OT and SCADA environments. The system provides specialized inspection for industrial protocols such as Modbus, DNP3, and IEC 60870. It distinguishes itself through behavioral threat detection, encrypted traffic analysis via handshake fingerprinting, and the ability to identify hardware and operating systems using DHCP and MAC address patterns. Its broader capabilities include real-time traffic an
Lua
Vezi pe GitHub7,880
secdev/scapy
secdev/scapy
12,068Vezi pe GitHub
Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics. The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to bin
Pythonhacktoberfestnetworknetwork-analysis
Vezi pe GitHub12,068
soheilhy/cmux
soheilhy/cmux
2,710Vezi pe GitHub
cmux is a TCP connection multiplexer and layer four protocol dispatcher. It routes incoming network traffic to different backend handlers by analyzing the initial bytes of the payload, allowing multiple network protocols to share a single IP address and port. The project identifies traffic using protocol signatures, byte-prefix matching, and header-value evaluation. It supports the detection of specific protocols including TLS, HTTP/1, and HTTP/2, and enables bidirectional handshaking where data can be sent back to a client during the matching phase. The routing system includes a first-match
Go
Vezi pe GitHub2,710
stamparm/maltrail
stamparm/maltrail
8,498Vezi pe GitHub
Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network intrusion sensor for monitoring interfaces, a threat intelligence aggregator for syncing blacklists, and a detection engine that identifies security threats through signature matching and heuristic attack patterns. The system distinguishes itself through a distributed sensor architecture that collects traffic data from multiple remote probes and forwards events to a central analysis server. It employs heuristic behavioral analysis to identify unknown threats, such as port scanning o
Pythonattack-detectionintrusion-detectionmalware
Vezi pe GitHub8,498

Vezi toate cele 30 alternative pentru NDPI

Întrebări frecvente

Ce face ntop/ndpi?

Care sunt principalele funcționalități ale ntop/ndpi?

Principalele funcționalități ale ntop/ndpi sunt: Packet Inspection, Network Security Monitoring, Flow Tracking Engines, Protocol Dissectors, Analysis Chains, Protocol Classifiers, Behavioral Threat Detection, Payload-Based Traffic Filtering.

Care sunt câteva alternative open-source pentru ntop/ndpi?

Alternativele open-source pentru ntop/ndpi includ: ntop/ntopng — ntopng is a web-based network traffic monitoring tool and flow data aggregator. It functions as a network security… secdev/scapy — Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and… soheilhy/cmux — cmux is a TCP connection multiplexer and layer four protocol dispatcher. It routes incoming network traffic to… stamparm/maltrail — Maltrail is a malicious traffic detection system used for network intrusion detection. It consists of a network… 3proxy/3proxy — 3proxy is a multi-protocol proxy server and network access control gateway. It functions as a network traffic… lgandx/pcredz — PCredz is a network credential extraction tool and traffic analyzer designed to intercept passwords, hashes, and…