{"action":"created","issue":{"url":"https://api.github.com/repos/eglooca/netify-daemon/issues/1","repository_url":"https://api.github.com/repos/eglooca/netify-daemon","labels_url":"https://api.github.com/repos/eglooca/netify-daemon/issues/1/labels{/name}","comments_url":"https://api.github.com/repos/eglooca/netify-daemon/issues/1/comments","events_url":"https://api.github.com/repos/eglooca/netify-daemon/issues/1/events","html_url":"https://github.com/eglooca/netify-daemon/issues/1","id":161820140,"number":1,"title":"Services/Applications marked as protocols","user":{"login":"pcbaldwin","id":578451,"avatar_url":"https://avatars.githubusercontent.com/u/578451?v=3","gravatar_id":"","url":"https://api.github.com/users/pcbaldwin","html_url":"https://github.com/pcbaldwin","followers_url":"https://api.github.com/users/pcbaldwin/followers","following_url":"https://api.github.com/users/pcbaldwin/following{/other_user}","gists_url":"https://api.github.com/users/pcbaldwin/gists{/gist_id}","starred_url":"https://api.github.com/users/pcbaldwin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pcbaldwin/subscriptions","organizations_url":"https://api.github.com/users/pcbaldwin/orgs","repos_url":"https://api.github.com/users/pcbaldwin/repos","events_url":"https://api.github.com/users/pcbaldwin/events{/privacy}","received_events_url":"https://api.github.com/users/pcbaldwin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/eglooca/netify-daemon/labels/bug","name":"bug","color":"ee0701"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-06-23T01:13:23Z","updated_at":"2016-08-11T19:59:55Z","closed_at":null,"body":"It looks like nDPI will mark some \"service\" traffic as a \"protocol\".  For example, I noticed the following flow data:\r\n\r\n```\r\n+-------+-------------------+------------------------+-----------------+\r\n| id    | detected_protocol | detected_protocol_name | other_ip        |\r\n+-------+-------------------+------------------------+-----------------+\r\n|  4252 |               126 | Google                 | 173.194.198.188 |\r\n|  4255 |               126 | Google                 | 173.194.198.188 |\r\n|  7510 |               126 | Google                 | 173.194.68.156  |\r\n```\r\n\r\nI'm never expecting the 126/NDPI_SERVICE_GOOGLE as a \"detected_protocol\" in a flow... it's not a protocol!  Doing some digging, it looks like all the nDPI network matching is treated as a protocol, i.e. in ndpi_content_match.c.inc, I see this network match defined:\r\n\r\n```\r\n{ 0xADC20000 /* 173.194.0.0 */, 16, NDPI_SERVICE_GOOGLE },\r\n{ 0x40E91600 /* 64.233.160.0 */, 19, NDPI_SERVICE_GOOGLE },\r\n```\r\n\r\n... which jives with the \"other_ips\" listed in the above flow table output.  In the same source file, I also see:\r\n\r\n```\r\n{ \".google.\",         \"Google\",   NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE },\r\n{ \".gstatic.com\",     \"Google\",   NDPI_SERVICE_GOOGLE, NDPI_PROTOCOL_ACCEPTABLE },\r\n  ... etc ...\r\n```\r\n\r\nSo this same 126/NDPI_SERVICE_GOOGLE constant ends up as a \"detected_service\" in the flow data (as expected).\r\n"},"comment":{"url":"https://api.github.com/repos/eglooca/netify-daemon/issues/comments/239273965","html_url":"https://github.com/eglooca/netify-daemon/issues/1#issuecomment-239273965","issue_url":"https://api.github.com/repos/eglooca/netify-daemon/issues/1","id":239273965,"user":{"login":"dsokoloski","id":1752670,"avatar_url":"https://avatars.githubusercontent.com/u/1752670?v=3","gravatar_id":"","url":"https://api.github.com/users/dsokoloski","html_url":"https://github.com/dsokoloski","followers_url":"https://api.github.com/users/dsokoloski/followers","following_url":"https://api.github.com/users/dsokoloski/following{/other_user}","gists_url":"https://api.github.com/users/dsokoloski/gists{/gist_id}","starred_url":"https://api.github.com/users/dsokoloski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dsokoloski/subscriptions","organizations_url":"https://api.github.com/users/dsokoloski/orgs","repos_url":"https://api.github.com/users/dsokoloski/repos","events_url":"https://api.github.com/users/dsokoloski/events{/privacy}","received_events_url":"https://api.github.com/users/dsokoloski/received_events","type":"User","site_admin":false},"created_at":"2016-08-11T19:59:55Z","updated_at":"2016-08-11T19:59:55Z","body":"I have fixed the twitter.c issue.  It was reversed in there for some reason, along with one other obscure protocol.\r\n\r\nThe ndpi_content_match.c.inc issues will be resolved by us not including it at all.  We will pull content from there that we want to keep, storing that in a database.  The daemon will pull that configuration and load it dynamically.  That way we have total control over the content of that include.\r\n\r\nI will close this issue when that has been completed."}}
{"actor":{"display_login":"dsokoloski"}}