![Page 1: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/1.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Title Text
ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF
![Page 2: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/2.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Topology
![Page 3: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/3.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
SSH Extcap
SSH extcap
![Page 4: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/4.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
SSH Extcap
SSH
SSH extcap
![Page 5: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/5.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
SSH Extcap
SSH
SSH extcap
BPF Filtering
![Page 6: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/6.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
SSH Extcap
Traffic Mirror
SSH extcap
BPF Filtering
![Page 7: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/7.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Ntop Remote Extcap
ntop extcap
![Page 8: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/8.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Ntop Remote Extcap
SSH
ntop extcap
![Page 9: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/9.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Ntop Remote Extcap
SSH
ntop extcap
PF_RING Filtering
![Page 10: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/10.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Ntop Remote Extcap
SSH
ntop extcap
PF_RING
nDPI
Filtering
L7 Filtering
![Page 11: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/11.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Ntop Remote Extcap
Traffic Mirror
ntop extcap nDPI
PF_RING Filtering
L7 FilteringImproved L7 Visibility
![Page 12: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/12.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Advantages
• Improved L7 visibility
• HTTP requests for www.facebook.com are marked as HTTP.Facebook)
• Protocol detection on non-standard ports
• L7 filtering on the remote machine
• Support for FPGA cards, with hw filtering (when available)
![Page 13: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/13.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
1. Install the ntop “remote” extcap module
git clone https://github.com/ntop/n2disk.git n2disk-pub cd n2disk-pub/wireshark/extcap/ && make cp remotentopdump /Applications/Wireshark.app/Contents/MacOS/extcap/
2. Install the nDPI plugin
git clone https://github.com/ntop/nDPI.git ~/nDPI mkdir -p ~/.wireshark/plugins cp ~/nDPI/wireshark/ndpi.lua ~/.wireshark/plugins
Laptop Configuration
![Page 14: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/14.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
1. Install PF_RING tools
git clone https://github.com/ntop/PF_RING.git ~/PF_RING cd ~/PF_RING/kernel && make && sudo insmod ./pf_ring.ko cd ~/PF_RING/userland/lib && ./configure && make cd ~/PF_RING/userland/libpcap && ./configure && make cd ~/PF_RING/userland/examples && make && sudo make install
2. Install nDPI tools
git clone https://github.com/ntop/nDPI.git ~/nDPI cd ~/nDPI && ./autogen.sh && ./configure && make cd ~/nDPI/example && sudo make install
Remote Box Configuration
![Page 15: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/15.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Demo
![Page 16: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/16.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Demo
![Page 17: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/17.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Demo
![Page 18: ntop Extcap: Where Wireshark Meets DPI and HW-Based BPF · Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017 Title Text ntop Extcap: Where Wireshark Meets DPI](https://reader031.vdocument.in/reader031/viewer/2022020122/5cabe05b88c993453d8dfef1/html5/thumbnails/18.jpg)
Sharkfest EU 2017 • Estoril, Portugal • November 7th - 10th, 2017
Demo