Skip to content

Conversation

IvanNardi
Copy link
Collaborator

@IvanNardi IvanNardi commented Aug 13, 2025

Application should keep calling nDPI until flow state became
NDPI_STATE_CLASSIFIED.

The main loop in the application is simplified to something like:

res = ndpi_detection_process_packet(...);
if(res->state == NDPI_STATE_CLASSIFIED) {
  /* Done: you can get finale classification and all metadata.
     nDPI doesn't need more packets for this flow */
} else {
  /* nDPI needs more packets for this flow. The provided
     classification is not final and more metadata might be
     extracted.
     If `res->state` is `NDPI_STATE_PARTIAL`, partial/initial
     classification is available in `flow->detected_protocol_stack[]`
     as usual but it can be updated later.
  */
}

/*
    Example A (QUIC flow):
     pkt 1: proto QUIC state NDPI_STATE_PARTIAL
     pkt 2: proto QUIC/Youtube  state NDPI_STATE_CLASSIFIED
    Example B (GoogleMeet call):
     pkt 1:   proto STUN state NDPI_STATE_PARTIAL
     pkt N:   proto DTLS state NDPI_STATE_PARTIAL
     pkt N+M: proto DTLS/GoogleCall state NDPI_STATE_CLASSIFIED
    Example C (standard TLS flow):
     pkt 1:   proto Unknown state NDPI_STATE_INSPECTING
     pkt 2:   proto Unknown state NDPI_STATE_INSPECTING
     pkt 3:   proto Unknown state NDPI_STATE_INSPECTING
     pkt 4:   proto TLS/Facebook state NDPI_STATE_PARTIAL
     pkt N:   proto TLS/Facebook state NDPI_STATE_CLASSIFIED
 */
}

You can take a look at ndpiReader for a slightly more complex example.

API changes:

  • remove the third parameter from ndpi_detection_giveup(). If you need
    to know if the classification flow has been guessed, you can access
    flow->protocol_was_guessed
  • remove ndpi_extra_dissection_possible()
  • change some prototypes from accepting ndpi_protocol foo to
    ndpi_master_app_protocol bar. The update is trivial: from foo to
    foo.proto

@IvanNardi IvanNardi force-pushed the dpi-state3 branch 3 times, most recently from e98e340 to 9dcaa71 Compare August 13, 2025 17:30
@IvanNardi IvanNardi changed the title Provide an explicit state in the flow classification process Provide an explicit state for the flow classification process Aug 13, 2025
@IvanNardi IvanNardi force-pushed the dpi-state3 branch 2 times, most recently from e9a6196 to 8d648f0 Compare August 13, 2025 17:33
@IvanNardi IvanNardi force-pushed the dpi-state3 branch 2 times, most recently from 4471562 to deda9f7 Compare September 24, 2025 07:21
@IvanNardi IvanNardi force-pushed the dpi-state3 branch 4 times, most recently from 4fb0bd8 to bd8831b Compare October 21, 2025 11:15
Application should keep calling nDPI until flow state became
`NDPI_STATE_CLASSIFIED`.

The main loop in the application is simplified to something like:
```
res = ndpi_detection_process_packet(...);
if(res->state == NDPI_STATE_CLASSIFIED) {
  /* Done: you can get finale classification and all metadata.
     nDPI doesn't need more packets for this flow */
} else {
  /* nDPI needs more packets for this flow. The provided
     classification is not final and more metadata might be
     extracted.
     If `res->state` is `NDPI_STATE_PARTIAL`, partial/initial
     classification is available in `flow->detected_protocol_stack[]`
     as usual but it can be updated later.
  */
}

/*
    Example A (QUIC flow):
     pkt 1: proto QUIC state NDPI_STATE_PARTIAL
     pkt 2: proto QUIC/Youtube  state NDPI_STATE_CLASSIFIED
    Example B (GoogleMeet call):
     pkt 1:   proto STUN state NDPI_STATE_PARTIAL
     pkt N:   proto DTLS state NDPI_STATE_PARTIAL
     pkt N+M: proto DTLS/GoogleCall state NDPI_STATE_CLASSIFIED
    Example C (standard TLS flow):
     pkt 1:   proto Unknown state NDPI_STATE_INSPECTING
     pkt 2:   proto Unknown state NDPI_STATE_INSPECTING
     pkt 3:   proto Unknown state NDPI_STATE_INSPECTING
     pkt 4:   proto TLS/Facebook state NDPI_STATE_PARTIAL
     pkt N:   proto TLS/Facebook state NDPI_STATE_CLASSIFIED
 */
}
```
You can take a look at `ndpiReader` for a slightly more complex example.

API changes:
* remove the third parameter from `ndpi_detection_giveup()`. If you need
to know if the classification flow has been guessed, you can access
`flow->protocol_was_guessed`
* remove `ndpi_extra_dissection_possible()`
* change some prototypes from accepting `ndpi_protocol foo` to
`ndpi_master_app_protocol bar`. The update is trivial: from `foo` to
`foo.proto`
Copy link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant