GitLocker: The Coding Marketplace

Description:

heiDPI 1.3.0

nDPId Docker Image for deep packet inspection. As described in nDPId, we split the image into producer and consumer image for a more generic purpose. For the producer, the image starts the UNIX and UDP socket and nDPId respectively. Via environment variables, users can adapt the nDPId daemon and nDPIsrvd. As by now, we support all current nDPId parameters.

Live Notebook

Latest Release

Supported Versions

Project License

Continuous Integration

Getting Started
Install using PyPi:
pip install heiDPI

Use the CLI for quick usage:
> heiDPI -h
usage: heiDPI [-h] [--host HOST | --unix UNIX] [--port PORT] [--write WRITE] [--config CONFIG] [--show-daemon-events SHOW_DAEMON_EVENTS] [--show-packet-events SHOW_PACKET_EVENTS] [--show-error-events SHOW_ERROR_EVENTS] [--show-flow-events SHOW_FLOW_EVENTS]

heiDPI Python Interface

options:
-h, --help show this help message and exit
--host HOST nDPIsrvd host IP (default: None)
--unix UNIX nDPIsrvd unix socket path (default: None)
--port PORT nDPIsrvd TCP port (default: 7000)
--write WRITE heiDPI write path for logs (default: /var/log)
--config CONFIG heiDPI write path for logs (default: /home/smachmeier/projects/emcl/heiDPI/config.yml)
--show-daemon-events SHOW_DAEMON_EVENTS
heiDPI shows daemon events (default: 0)
--show-packet-events SHOW_PACKET_EVENTS
heiDPI shows packet events (default: 0)
--show-error-events SHOW_ERROR_EVENTS
heiDPI shows error events (default: 0)
--show-flow-events SHOW_FLOW_EVENTS
heiDPI shows flow events (default: 0)

Prerequisities
In order to run this container you'll need docker installed.

Windows
OS X
Linux

Usage
Pull images:
docker pull stefan96/heidpi-producer:main
docker pull stefan96/heidpi-consumer:main

Run producer and consumer separately from each other using UDP socket:
docker run -p 127.0.0.1:7000:7000 --net host stefan96/heidpi-producer:main
docker run -e HOST=127.0.0.1 --net host stefan96/heidpi-consumer:main

or use the docker-compose.yml:
docker-compose up

Additionally, you use a UNIX socket:
docker run -v ${PWD}/heidpi-data:/tmp/ --net host stefan96/heidpi-producer:main
docker run -v ${PWD}/heidpi-data:/tmp/ -v ${PWD}/heidpi-logs:/var/log -e UNIX=/tmp/nDPIsrvd-daemon-distributor.sock --net host stefan96/heidpi-consumer:main

Environment Variables
Consumer

Variable
Type
Default

UNIX
string

HOST
string

PORT
int
7000

JSON_PATH
string
/var/log/nDPIdsrvd.json

SHOW_ERROR_EVENTS
int
0

SHOW_DAEMON_EVENTS
int
0

SHOW_PACKET_EVENTS
int
0

SHOW_FLOW_EVENTS
int
1

MAX_BUFFERED_LINES
int
1024

Config file
You can change the default configuration by mounting a config file /usr/src/app/config.yml:
flow_event:
ignore_fields: []
flow_event_name:
- update
- end
- idle
- detected
filename: flow_event
threads: 25

License
This project is licensed under the GPL-3.0 license - see the LICENSE.md file for details.