Re: nDPI support for deep packet inspection

Ubiquiti Networks

Quick Links
turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Search instead for

Do you mean

nDPI support for deep packet inspection

Submitted by -

So, I was looking into EdgeOS ability to classify/block/prioritize traffic for certain application and I figured out that it falls really short of such capability. Even built-in p2p support in firewall (i.e. keywords "p2p" and "edonkey" for matching) seem to be broken, or at least I couldn't get it to work.

As the standard l7-filter has been known to perform poorly, hereby I suggest that EdgeMax team adds support for nDPI to EdgeOS so we can perform deep packet inspection and prioritise, block, or otherwise modify traffic based on packet inspection. It goes without saying that this should be tied into the firewall so that mark/match concept can be applied.

Comments

Yeah as discussed before the p2p match implementation is quite old and does not work well with matching newer applications for example. As mentioned before we have been looking at different options for DPI solutions and may be able to provide that in the future but don't have a time estimate at the moment.

Permalink

@UBNT-ancheng p2p seems not to work at all. I had a rule with "edonkey" in it and eMule was getting low id until I removed the keyword.

Permalink

- edited

Maybe it's time to reiterate the DPI issue. I'm testing ndpi-netfilter ability to recon the L7 protos and the results looks very promising. So, looking at betolj/ndpi-netfilter fork, i think that it worth your attention and maybe in the near future your devices will perform DPI at least as accurate as nDPI in these days.