Sign inSign up

stefan96/heidpi-consumer

By stefan96

•Updated 10 months ago

nDPId Docker Image for packet inspection

Image
Networking
Security
Monitoring & observability
0

3.3K

stefan96/heidpi-consumer repository overview

heiFIP Logo

nDPId⁠ Docker Image for deep packet inspection. As described in nDPId⁠, we split the image into producer and consumer image for a more generic purpose. For the producer, the image starts the UNIX and UDP socket and nDPId respectively. Via environment variables, users can adapt the nDPId daemon and nDPIsrvd. As by now, we support all current nDPId parameters.

Project License License ⁠
Continuous Integration Docker WorkFlows ⁠

⁠Getting Started

Install using PyPi:

cd ./heidpi-logger && cmake . && make

Use the CLI for quick usage:

> ./heidpi_cpp -h
usage: heidpi_cpp [-h] [--host HOST | --unix UNIX] [--port PORT] [--write WRITE]
            [--config CONFIG] [--filter FILTER]
            [--show-daemon-events]
            [--show-packet-events]
            [--show-error-events]
            [--show-flow-events]
⁠Prerequisities

In order to run this container you'll need docker installed.

⁠Usage

Pull images:

docker pull stefan96/heidpi-producer:main
docker pull stefan96/heidpi-consumer:main

Run producer and consumer separately from each other using UDP socket:

docker run -p 127.0.0.1:7000:7000 --net host stefan96/heidpi-producer:main
docker run -e HOST=127.0.0.1 --net host stefan96/heidpi-consumer:main

or use the docker-compose.yml:

docker-compose up

Additionally, you use a UNIX socket:

docker run -v ${PWD}/heidpi-data:/tmp/ --net host stefan96/heidpi-producer:main
docker run -v ${PWD}/heidpi-data:/tmp/ -v ${PWD}/heidpi-logs:/var/log -e UNIX=/tmp/nDPIsrvd-daemon-distributor.sock --net host stefan96/heidpi-consumer:main

⁠Environment Variables

⁠Consumer
VariableTypeDefault
UNIXstring
HOSTstring
PORTint7000
JSON_PATHstring/var/log/nDPIdsrvd.json
SHOW_ERROR_EVENTSint0
SHOW_DAEMON_EVENTSint0
SHOW_PACKET_EVENTSint0
SHOW_FLOW_EVENTSint1
MAX_BUFFERED_LINESint1024
⁠Config file

You can change the default configuration by mounting a config file /usr/src/app/config.yml:

flow_event:
  ignore_fields: []
  flow_event_name:
    - update
    - end
    - idle
    - detected
  filename: flow_event
  threads: 25

⁠License

This project is licensed under the GPL-3.0 license - see the LICENSE.md⁠ file for details.

Tag summary

Content type

Image

Digest

sha256:b1f8c2904…

Size

5.2 MB

Last updated

10 months ago

docker pull stefan96/heidpi-consumer