lpi_live output files are now opened in append mode to avoid overwriting any previous data ( r96).
lpi_live now reports flow counts as well as bytes now ( r96).
Fixed bug in RADIUS length checking ( r111).
Added missing documentation for CLI options to lpi_live ( r113).
Renamed HTTP P2P to be HTTP Nonstandard and moved from P2P to Web category ( r112).
Fixed typo in RTMFP name string ( r112).
Output format for lpi_live tool has changed significantly! Apologies if this breaks anyone's analysis scripts / code ( r119).
lpi_live tool can now produce output suitable for writing straight to an RRD ( r124).
Added new API function (lpi_is_protocol_inactive) which can be used to determine whether there is a module for a given protocol enum ( r118).
All protocols that use both TCP and UDP now have unique name strings ( r118).
Behaves the same as lpi_protoident, except the output is in the ARFF format which can be read by WEKA (thanks to Paweł Foremski for writing much of the code for this tool) ( r116)
Fixed bug where a flow could be classified as No Payload but still have > 0 bytes in either direction ( r129).
Fixed a number of integer underflow problems in lpi_live which was causing impossibly large values to be reported ( r126).
All protocols previously in the P2P Structure category will be moved to the P2P category.
Libprotoident-2.0.6 (7) Important Changes
Fixed some false positives that were matching ApplePush ( r158).
Fixed bug where NO_PAYLOAD was being erroneously reported for flows, due to reordering ( r147).
lpi_live tool has been removed in favour of the lpicollector tool (available at ).
Thanks to elnappo for some contributions towards this release. Overhead Image (right-click, "Save Target As. If a modified version of this map goes online, you might have to delete the map version you can download now. WARNING! This map is still under development and is most likely not final. Under development - waiting for being fixed Added behaviours to dissuade Behe camping
0 kommentar(er)
