Add NetMotion Mobility (IMP) protocol detection#3195
Conversation
| ========================= | ||
| NetMotion Mobility (formerly Mobility XE) is an enterprise mobile VPN that keeps sessions persistent across network changes, widely deployed in public-sector and first-responder fleets. Clients tunnel to the Mobility server using the Internet Mobility Protocol (IMP), by default over UDP/5008. | ||
|
|
||
| References: `Official site: <https://www.netmotionsoftware.com>`_ |
There was a problem hiding this comment.
Unrelated to your PR, but it is funny that the site of a VPN provider triggers:
There was a problem hiding this comment.
I found this odd (unfortunate?) as well and dug a bit more.. it seems like NetMotion was maybe acquired by a company called Aboslute so I guess they abandoned the old domain? The only clients I've seen running are all still branded NetMotion and point to this old URL. I can dig more if you want but the new owner has very little useful info on their site.
|
Oops, I will fix the error here shortly. |
NetMotion Mobility (Mobility XE) tunnels clients to the Mobility server using the Internet Mobility Protocol (IMP), by default over UDP/5008. The payload is encrypted, but every datagram carries a fixed header: a 0x4c magic, a self-inclusive length prefix, a per-direction connection id plus sequence, and a per-direction session token. Detection verifies these framing invariants are constant within a direction and differ across directions, following the same stateful approach as the Hamachi dissector. Add NDPI_PROTOCOL_NETMOTION (VPN category) with the netmotion dissector and its unit test. The remaining unit-test results are regenerated because the new protocol id shifts the auto-numbered custom-rule ids and adds one dissector call per UDP flow. Signed-off-by: Chad Monroe <chad@monroe.io>
|
IvanNardi
left a comment
IvanNardi
left a comment
There was a problem hiding this comment.
Thanks!
I simply rebased the code
2 participants
Please sign (check) the below before submitting the Pull Request:
Link to the related issue:
Describe changes:
NetMotion Mobility (Mobility XE) tunnels clients to the Mobility server using the Internet Mobility Protocol (IMP), by default over UDP/5008. The payload is encrypted, but every datagram carries a fixed header: a 0x4c magic, a self-inclusive length prefix, a per-direction connection id plus sequence, and a per-direction session token. Detection verifies these framing invariants are constant within a direction and differ across directions, following the same stateful approach as the Hamachi dissector.
Add NDPI_PROTOCOL_NETMOTION (VPN category) with the netmotion dissector and its unit test. The remaining unit-test results are regenerated because the new protocol id shifts the auto-numbered custom-rule ids and adds one dissector call per UDP flow.
This feels a little hacky to me but I didn't see any other good way. I'm happy to look into it more if you don't like it.