Newbee Question to Group

[ben]

I've just started to use Opendpi to analyze some network traffic with
maybe a couple hundred very normal users. My pcap file is a
combination of all the traffic for these users. Opendpi reports
about 60% of the packets to be 'unknown' protocol. Is this to be
expected? I have noticed that many of the packets are TCP
continuation segments (when I look at the wireshark output.

I would very much appreciate any help or advise. OpenDpi wouldn't
seem too useful if it winds up finding the majority of packets to be
'unknown' protocol. But maybe I am missing something here.

Thanks

[Hendrik]

Hi Ben,

I'm sorry for the late answer. But I was traveling the last weeks and
had very limited Internet access.

There are a lot of possible explanations for the weak detection rate
and a remote diagnosis is not really possible.

One reason could be a lot of open flows in your trace files where no
handshake was seen by the DPI. Especially if you trace is shorter than
10-15 min the detection quality could be bad, because OpenDPI depends
on the handshake of a flow. An other reason could be that you have
indeed a huge amount of encrypted protocols like encrypted BitTorrent
in your network or the trace contains really new protocols that are
not supported by OpenDPI.

If it is possible for you to provide us the trace, we could analyze
the trace for you with ipoque's commercial DPI engine and some
internal tools to find the real reason.

Best Regards
Hendrik