nDPI: Open-source high-speed deep packet inspection

Deri, Luca; Martinelli, Maurizio; Bujlow, Tomasz; Cardigliano, Alfredo

doi:10.1109/iwcmc.2014.6906427

Cited by 154 publications

(66 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Deri, Luca et al (Deri et al, 2014), states that commercial firewalls that support DPI libraries are very expensive. Therefore, using Linux-based firewalls with iptables or netfilter is more cost effective.…”

Section: B Deep Packet Inspectionmentioning

confidence: 99%

“…The firewall will examine and analyze the protocol in the data packet up to the application layer of OSI model (Deri et al, 2014) (Radisys, 2010) (Thomason, 2012). This type of firewall can be used to stop or allow access to applications running in a network based on the type of the application (Bujlow, Carela-Español, & Barlet-Ros, 2013).…”

Section: B Deep Packet Inspectionmentioning

confidence: 99%

“…Application of DPI on the firewall has also been used in artificial firewall from various companies such as Cisco, SonicWall, Juniper, and Fortinet. (Deri et al, 2014) (Bujlow et al, 2015), that DPI was developed by creating an efficient DPI library and supports a high number of protocols. nDPI also has an influence on performance DPI protocol detection and recognition.…”

Section: B Deep Packet Inspectionmentioning

confidence: 99%

“…DPI is a packet filter which examines the payload of a packet when it passes an inspection point (Scarfone & Hoffman, 2009) (Deri, Martinelli, Bujlow, & Cardigliano, 2014) (Ou, 2013). DPI has been developed by many different vendors.…”

Section: Introductionmentioning

confidence: 99%

“…For example Cisco has ASA (Cisco, 2003), Juniper has Screenos (Garrett et al, 2002), and Fortinet has Fotigate (Fabbri & Volpe, 2013). The present research concerns open source DPI known as nDPI (Deri et al, 2014) (Bujlow, Carela-Español, & Barlet-Ros, 2015) (ntop, 2013) and L7-filter (Bober, 2009) (L7-Filter, 2008. By testing the accuracy and speed of nDPI (using Aho-Corasick string matching process) and L7-filter (using regular expression matching process), this research aims to provide recommendation for network and system administrator in optimizing existing open source firewalls.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Improving Network Security - A Comparison of Open Source DPI Software

Satrya

Nugroho

Brotoharsono

2017

ijoict

View full text Add to dashboard Cite

The classification of data traffic in a firewall using parameters such as port number, IP address, and MAC address is not sufficient. For example, currently, many applications can be used without a port number meaning they can easily circumvent a firewall. Firewalls inspecting up to only layer four could allow malicious data to pass. Next-generation deep packet inspection (DPI) is a method that can be used for firewalls as a method of classification up to layer seven in data traffic control. This research recommends the use of nDPI and L7-filter by network administrators on existing open source firewalls. Eleven internet applications were used to test and analyze nDPI and L7-filter which are capable of detecting traffic based on the data signature. nDPI and L7-filter were tested for accuracy and speed of total time of execution in live performance networks. We conclude that the development of next-generation deep packet inspection is important for the future of system and network security.

show abstract

Section: B Deep Packet Inspectionmentioning

confidence: 99%

Section: B Deep Packet Inspectionmentioning

confidence: 99%

Section: B Deep Packet Inspectionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Improving Network Security - A Comparison of Open Source DPI Software

Satrya

Nugroho

Brotoharsono

2017

ijoict

View full text Add to dashboard Cite

show abstract

A survey of methods for encrypted traffic classification and analysis

et al. 2015

View full text Add to dashboard Cite

Summary With the widespread use of encrypted data transport, network traffic encryption is becoming a standard nowadays. This presents a challenge for traffic measurement, especially for analysis and anomaly detection methods, which are dependent on the type of network traffic. In this paper, we survey existing approaches for classification and analysis of encrypted traffic. First, we describe the most widespread encryption protocols used throughout the Internet. We show that the initiation of an encrypted connection and the protocol structure give away much information for encrypted traffic classification and analysis. Then, we survey payload and feature‐based classification methods for encrypted traffic and categorize them using an established taxonomy. The advantage of some of described classification methods is the ability to recognize the encrypted application protocol in addition to the encryption protocol. Finally, we make a comprehensive comparison of the surveyed feature‐based classification methods and present their weaknesses and strengths. Copyright © 2015 John Wiley & Sons, Ltd.

show abstract

On the design and performance evaluation of automatic traffic report generation systems with huge data volumes

Vega

Sierra

Moreno³

et al. 2018

Int J Network Mgmt

View full text Add to dashboard Cite

In this paper, we analyze the performance issues involved in the generation of automated traffic reports for large IT infrastructures. Such reports allow the IT manager to proactively detect possible abnormal situations and roll out the corresponding corrective actions. With the ever-increasing bandwidth of current networks, the design of automated traffic report generation systems is very challenging. In a first step, the huge volumes of collected traffic are transformed into enriched flow records obtained from diverse collectors and dissectors. Then, such flow records, along with time series obtained from the raw traffic, are further processed to produce a usable report. As will be shown, the data volume in flow records turns out to be very large as well and requires careful selection of the key performance indicators (KPIs) to be included in the report. In this regard, we discuss the use of high-level languages versus low-level approaches, in terms of speed and versatility. Furthermore, our design approach is targeted for rapid development in commodity hardware, which is essential to cost-effectively tackle demanding traffic analysis scenarios. Actually, the paper shows feasibility of delivering a large number of KPIs, as will be detailed later, for several TBytes of traffic per day using a commodity hardware architecture and high-level languages.

show abstract

nDPI: Open-source high-speed deep packet inspection

Cited by 154 publications

References 16 publications

Improving Network Security - A Comparison of Open Source DPI Software

Improving Network Security - A Comparison of Open Source DPI Software

A survey of methods for encrypted traffic classification and analysis

On the design and performance evaluation of automatic traffic report generation systems with huge data volumes

Contact Info

Product

Resources

About