2022年4月21日 · All you need is nProbe (dev) that can collect export flows over UDP/TCP/SCTP (export only on Linux), and now over TLS. All you need to do is to use the method with command line options –collector-port (flow collection) and –collector (flow export). Examples: When collecting flows, nProbe opens the specified port and listens for TLS connections.

When using TLS, it is compulsory to have a valid TLS certificate that is validated during handshake. The following sections explain how to generate a TLS certificate and what are the command line options available for TLS. When nProbe is used for flow collection over TLS, nProbe needs a valid certificate file.

2019年5月31日 · When a SSL communication is not satisfying all safety criteria, ntopng detected it, and triggers an alert. In essence we have implemented a lightweight SSL monitoring console that allows you (without having to install an IDS or similar application) to understand the security risks and fix them before it’s too late.

It would be good to add a mildly-scored TLS flow risk ERR_CERT_VALIDITY_TOO_LONG as. In a move that's meant to boost security, Apple, Google, and Mozilla are set to reject publicly rooted digital certificates in their respective web browsers that expire more than 13 months

NDPI_LOG_DBG2(ndpi_struct, "TLS-Obf-Heur: too many pkts in the first burst %d\n", set->pkts[0]);

Added detection of encrypted/obfuscated/proxied TLS flows Implemented nDPI TCP fingerprint ( 6b6dad4 ) For further details on these three topics, see https://www.ntop.org/ntop/a-deep-dive-into-traffic-fingerprints/

2022年7月3日 · Detect SMTPs w/ STARTTLS as TLS and dissect client/server hello. Fixe… utoni/nDPI

2018年10月5日 · As you know ntopng web interface supports both HTTP (default) and HTTPS. The reason why ntopng does not default to HTTPS is because we provide self-signed certificates that web browsers dislike. Fortunately today you can create a free SSL certificate recognised by all browsers by using Let’s Encrypt open certificate authority (CA).

nDPI是流行的OpenDPI库的ntop维护超集。 它是根据LGPL许可发布，其目标是通过添加新协议来扩展原始库，这些协议否则仅在OpenDPI的付费版本上可用。 除了Unix平台，我们还支持Windows，以便为您提供跨平台的DPI体验。 此外，我们还对nDPI进行了修改，使其更适合流量监控应用程序，方法是禁用降低DPI引擎速度的特定功能，而这些功能对于网络流量监控不是必需的。 无论使用哪个端口，ntop和nProbe都使用nDPI来添加协议的应用层检测。 这意味着既可以 …

nDPI是流行的OpenDPI库的ntop维护超集。 它是根据LGPL许可发布，其目标是通过添加新协议来扩展原始库，这些协议否则仅在OpenDPI的付费版本上可用。 除了Unix平台，我们还支持Windows，以便为您提供跨平台的DPI体验。