mirror of https://github.com/outbackdingo/nDPId.git synced 2026-01-28 10:19:39 +00:00

Files

Toni Uhlig 315f90f982 Fixed invalid "flow_last_seen" timestamp for the first packet.

* After the first packet was processed, "flow_last_seen" was still 0.
   This behaviour is invalid as the first packet may contain l4 payload data e.g. for UDP
   and it also breaks nDPId json consistency "flow_first_seen" > 0, but "flow_last_seen" == 0.
 * JSON schema: set minimum timestamp value for Epoch timestamps to 24710 for flow_*_seen and
   1 for pcap packet ts. Those values are dependant on some manipulated pcap's in libnDPI/tests/pcap.

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

2021-10-08 11:31:58 +02:00

basic_event_schema.json

Extended nDPIsrvd.h with address parsing.

2021-02-23 14:46:47 +01:00

daemon_event_schema.json

Use layer4 specific flow timeouts.

2021-05-13 15:41:24 +02:00

flow_event_schema.json

Fixed invalid "flow_last_seen" timestamp for the first packet.

2021-10-08 11:31:58 +02:00

packet_event_schema.json

Fixed invalid "flow_last_seen" timestamp for the first packet.

2021-10-08 11:31:58 +02:00

README.md

Updated README.md

2021-03-24 14:44:27 +01:00

README.md

schema

All schema's placed in here are nDPId exclusive, meaning that they are not necessarily representing a "real-world" JSON string received by e.g. ./example/py-json-stdout. This is due to the fact that libnDPI itself add's some JSON information to the serializer of which we have no control over. IMHO it makes no sense to include stuff here that is part of libnDPI.