Major Changes

• Reworked lists implementation that decreased memory usage of orders of magnitude
• Improved code robustness via extensive code fuzzing
• Various improvements to overall library performance
• Extended IPv6 support

New Supported Protocols and Services

• Add "Heroes of the Storm" video game signature detection. (#1949)
• Add Apache Thrift protocol dissector. (#2007)
• Add Remote Management Control Protocol (RMCP).
• Add Service Location Protocol dissector. (#2036)
• Add VK detection (#1880)
• Add Yandex services detection (#1882)
• Add a new protocol id for generic Adult Content traffic (#1906)
• Add a new protocol id for generic advertisement/analytics/tracking stuff (#1904)
• Add bitcoing protocol dissector. (#1992)
• Add detection of Roblox games (#2054)
• Add support for (un-encrypted) HTTP/2 (#2087)
• Add support for Epic Games and GeForceNow/Nvidia (#1990)
• Add support for SRTP (#1977)
• Added BACnet dissector. (#1940)
• Added HAProxy protocol. (#2088)
• Added OICQ dissector. (#1950)
• Added OperaVPN detection
• ProtonVPN: add basic detection (#2006)
• Added detection of Facebook Reels and Stories
• Add an heuristic to detect fully encrypted flows (#2058)
• Added NDPI_MALWARE_HOST_CONTACTED flow risk
• Added NDPI_TLS_ALPN_SNI_MISMATCH flow risk

Improvements

• Improve protocol detection for:
• FreeBSD compilation fix (C) update
• Gnutella: improve detection (#2019)
• H323: fix false positives (#1916)
• HTTP: fix another memory access error (#2049)
• HTTP: fix extraction of filename (#2046)
• HTTP: fix heap-buffer-overflow (#2044)
• HTTP: improve extraction of metadata and of flow risks (#1959)
• HTTP: remove useless code about XBOX (#1958)
• HTTP: rework state machine (#1966)
• Hangout: detect Hangout/Duo/GoogleMeet/... in the STUN code (#2025)
• Enhance DNS risk for long hostnames (> 32)
• Enhanced MS teams STUN/Azure detection
• Enhanced custom port definition and improved error reporting in case of duplications
• Improve detection of Alibaba flows (#1991)
• Improve detection of crawler/bot traffic (#1956)
• Improve detection of crawlers/bots (#1968)
• Improved MGCP detection by allowing '\r' as line feed.
• Improved MS Teams detection with heuristic
• Improved Steam detection by adding steamdiscover pattern. (#2105)
• Improved Wireguard detection
• Improved checks for duplicated entries in protocols file
• Improved classification further reducing memory used
• Improved detection of invalid chars in DNS names
• Improved domain search tet unit
• Improved helper scripts. (#1986)
• MS Teams enhancement
• MySql: improve detection (#1928)
• zabbix: improve detection (#2055)

Tools

• ndpiReader: allow to configure LRU caches TTL and size (#2004)
• ndpiReader: fix VXLAN de-tunneling (#1913)
• ndpiReader: fix export of DNS/BitTorrent attributes (#1985)
• ndpiReader: fix export of HTTP attributes (#1982)
• ndpiReader: fix flow stats (#1943)
• ndpiReader: fix print of flow payload (#1960)
• ndpiReader: improve printing of payload statistics (#1989)
• ndpiReader: print how many packets (per flow) were needed to perform full DPI (#1891)
• ndpireader: fix detection of DoH traffic based on packet distributions (#2045)

Misc

• ARM compilation fix
• Add ndpi_domain_classify_finalize() function (#2084)
• Add a configuration knob to enable/disable loading of gambling list (#2047)
• Add a new flow risk about literal IP addresses used as SNI (#1892)
• Add an heuristic to detect/ignore some anomalous TCP ACK packets (#1948)
• Add another example of custom rules (#1923)
• Add support for multiline json
• Add support for roaring_bitmap_xor_inplace (#1983)
• Add support for vxlan decapsulation (#1441) (#1900)
• Added Source Engine dissector. (#1937)
• Added lists/gambling.list to extra dist.
• Added slackb.com SNI. (#2067)
• Added ability to define an unlimited number of custom rules IP:port for the same IP (it used tobe limited to 2)
• Added check to avoid skype heuristic false positives
• Added comment
• Added coverage targets to Makefile.am for convenience. (#2039)
• Added fix for better handling exceptions rollback in case of later match
• Added hyperlink
• Added ndpi_binary_bitmap data structure
• Added ndpi_bitmap64 support
• Added ndpi_bitmap_andnot API call
• Added ndpi_bitmap_copy() API call
• Added ndpi_bitmap_is_empty() and ndpi_bitmap_optimize() API calls
• Added ndpi_domain_classify_XXX(0 API
• Added ndpi_filter_add_multi() API call
• Added ndpi_murmur_hash to the nDPI API
• Added new API calls for implementing Bloom-filter like data structures
• Added printf/fprintf replacement for some internal modules. (#1974)
• Added scripts to auto generate hostname/SNI *.inc files. (#1984)
• Added sub-domain classification fix
• Added the ability to define custom protocols with arbitrary Ids in proto.txt
• Added vlan_id in ndpi_flow2json() prototype
• Adds new pcap for testing "funny" HTTP servers
• All protocols should be excluded sooner or later (#1969)
• Allow init of app protocols w/o any hostnames set. (#2057)
• Avoid calling ndpi_reconcile_protocols() twice in ndpi_detection_giveup() (#1996)
• Boundary check
• CI: fix Performance job (#1936)
• Centos7 fixes
• Changed logging callback function sig. (#2000)
• Changes for supporting more efficient sub-string matching
• Classification fixes
• DNS: extract geolocation information, if available (#2065)