There is nothing special to do. If it does not work please provide a pcap file to test with
Regards Luca > On 12 Mar 2015, at 13:35, Ming-Ching Tiew <[email protected]> wrote: > > Sorry the mailer on mobile phone messed things up and I am resending. > > Thanks for the info, I will do further testing to find out why my tests did > not pick up youtube traffic over ssl. > > Is the a compile options of nDPI where some missing libraries on my test > machine which could have caused this ? > > > From: Luca Deri <[email protected]> > To: [email protected]; Ming-Ching Tiew <[email protected]> > Sent: Thursday, March 12, 2015 7:18 PM > Subject: Re: [Ntop-misc] ndpi to support youtube over ssl ? > > Not quite I have just tested it > > 1 TCP 149.3.176.18:443 <-> 192.168.1.92:52002 [proto: > 124/YouTube][19 pkts/6626 bytes][SSL client: > r7---sn-nx5cvox-hpa6.googlevideo.com > <http://sn-nx5cvox-hpa6.googlevideo.com/>] > 2 TCP 149.3.176.14:443 <-> 192.168.1.92:52004 [proto: > 124/YouTube][772 pkts/698990 bytes][SSL client: > r3---sn-nx5cvox-hpa6.googlevideo.com > <http://sn-nx5cvox-hpa6.googlevideo.com/>] > 6 TCP 173.194.40.1:443 <-> 192.168.1.92:51983 [proto: > 124/YouTube][20 pkts/6100 bytes][SSL client: www.youtube.com > <http://www.youtube.com/>] > 7 TCP 173.194.40.6:443 <-> 192.168.1.92:51985 [proto: > 124/YouTube][22 pkts/6262 bytes][SSL client: s.ytimg.com > <http://s.ytimg.com/>] > 8 TCP 173.194.40.6:443 <-> 192.168.1.92:51987 [proto: > 124/YouTube][20 pkts/6096 bytes][SSL client: s.ytimg.com > <http://s.ytimg.com/>] > 9 TCP 173.194.40.6:443 <-> 192.168.1.92:51989 [proto: > 124/YouTube][20 pkts/6095 bytes][SSL client: s.ytimg.com > <http://s.ytimg.com/>] > 11 TCP 173.194.40.8:443 <-> 192.168.1.92:52007 [proto: > 124/YouTube][39 pkts/9046 bytes][SSL client: www.youtube-nocookie.com > <http://www.youtube-nocookie.com/>] > 31 TCP 192.168.1.92:52027 <-> 74.125.6.183:443 [proto: > 124/YouTube][140 pkts/116031 bytes][SSL client: > r18---sn-5uaeznl7.googlevideo.com <http://sn-5uaeznl7.googlevideo.com/>] > 33 TCP 149.3.176.14:443 <-> 192.168.1.92:52003 [proto: > 124/YouTube][2378 pkts/2707249 bytes][SSL client: > r3---sn-nx5cvox-hpa6.googlevideo.com > <http://sn-nx5cvox-hpa6.googlevideo.com/>] > 37 TCP 173.194.40.1:443 <-> 192.168.1.92:51982 [proto: > 124/YouTube][388 pkts/138593 bytes][SSL client: www.youtube.com > <http://www.youtube.com/>] > 38 TCP 173.194.40.6:443 <-> 192.168.1.92:51984 [proto: > 124/YouTube][2461 pkts/2010874 bytes][SSL client: s.ytimg.com > <http://s.ytimg.com/>] > 39 TCP 173.194.40.6:443 <-> 192.168.1.92:51986 [proto: > 124/YouTube][20 pkts/6095 bytes][SSL client: s.ytimg.com > <http://s.ytimg.com/>] > 40 TCP 173.194.40.6:443 <-> 192.168.1.92:51988 [proto: > 124/YouTube][20 pkts/6096 bytes][SSL client: s.ytimg.com > <http://s.ytimg.com/>] > > > Regards Luca >> >> >> On 12 Mar 2015, at 11:31, Ming-Ching Tiew <[email protected] >> <mailto:[email protected]>> wrote: >> >> Yes I test it, from ndpiReader and netfilter ndpi, both could not see >> youtube over SSL. >> >> Only SSL is detected, nothing is recorded for youtube when I watch youtube >> over https. Btw, it's build 8598. >> >> From: Luca Deri <[email protected] <mailto:[email protected]>> >> To: [email protected] <mailto:[email protected]>; >> Ming-Ching Tiew <[email protected] <mailto:[email protected]>> >> Sent: Thursday, March 12, 2015 6:08 PM >> Subject: Re: [Ntop-misc] ndpi to support youtube over ssl ? >> >> Ming >> did you test nDPI? >> >> Luca >> >>> >>> >>> On 12 Mar 2015, at 09:46, Ming-Ching Tiew <[email protected] >>> <mailto:[email protected]>> wrote: >>> >>> Is there a support for ndpi to detect youtube over ssl ? >>> >>> Most of the youtube traffic today are carried over ssl. That practically >>> rendered vanilla youtube detection useless. >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] <mailto:[email protected]> >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> <http://listgateway.unipi.it/mailman/listinfo/ntop-misc> >> >> >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] <mailto:[email protected]> >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
