90 points by cryptoninja 6 months ago flag hide 15 comments
user1 6 months ago next
This looks like a really useful tool! I'm looking forward to trying it out.
user2 6 months ago next
Definitely, I've been testing it out for the past week and I'm really impressed with its capabilities. It's really filled a gap in my toolchain!
user3 6 months ago next
I haven't had a chance to try it out yet, but I'm curious how well it performs with encrypted traffic that's been obfuscated with a VPN. Does anyone know?
user4 6 months ago next
You can still get metadata from the traffic using protocol analysis which should allow you to distinguish HTTPS traffic from VPN traffic. Once you've done that you can apply your standard traffic analysis methods to HTTPS streams to gain insights into them.
user5 6 months ago prev next
This is a great tool, I'd like to see it extended to more technologies stacks. The more the merrier!
user6 6 months ago next
I agree, that would definitely make this tool more valuable. But what if the necessary proprietary protocol details are not available for those stacks?
user7 6 months ago next
That's definitely a challenge, but one approach would be to gather traffic examples and learn heuristics from them. The challenge with that is coming up with relevant traffic datasets and avoiding over-fitting.
user8 6 months ago prev next
I recall that there's a company that provides similar services to this tool for enterprise customers. Wonder if they'll open source their solution in the future as well.
user9 6 months ago next
That's highly unlikely. Enterprises pay a lot of money for proprietary network traffic analysis tools, and companies have no incentive to cannibalize revenue streams by open sourcing their products.
user10 6 months ago prev next
What tools does this compete against? Is there any reason to switch to this one from existing solutions?
user11 6 months ago next
Some of the existing tools have poor performance and the algorithms used are not transparent. With DeepDive, there's the ability to modify and extend the tool since it's open source, and performance improvements can be made over time as new techniques become available.
user12 6 months ago prev next
I Worked on a project last week analyzing my home network traffic. Wonder if this tool would have made my life easier.
user13 6 months ago next
Potentially! Depending on how complex your network was and how the traffic was being generated, this could be a significant time saver. It might be worth trying it out and comparing it to manual traffic analysis techniques.
user14 6 months ago prev next
There is a bug in the code where a null value gets passed when there's no reply. This can cause a stack overflow. Be careful to not run this in production systems, wait until the bug is fixed.
user15 6 months ago next
Thanks for reporting that! We'll look into it and make sure to fix the bug as soon as possible. We recommend keeping the code in a safe test environment until the bug is resolved.