libprotoident mit Homebrew, Nix installieren

Projektlinks

• Homepage

Befehle und Aliase

• lpi_arff
• lpi_find_unknown
• lpi_protoident

Projektgeschichte

The source headers credit the University of Waikato WAND research group and carry copyright years beginning in 2011. The public GitHub repository was created on 2014-03-20, and the README identifies Shane Alcock as author with additional contributors.

The project frames itself as a deliberately limited form of deep packet inspection: it uses the first four bytes of application payload sent in each direction, plus flow metadata, instead of requiring complete packet payload capture.

Adoptionsgeschichte

libprotoident's adoption is concentrated in packet-trace and traffic-analysis circles rather than broad application development. Its README ties it to `libtrace` and `libflowmanager`, and its bundled tools operate on libtrace trace URIs, including live network-interface sources.

Wie es verwendet wird

The package provides a library API plus command-line tools: `lpi_protoident` identifies flows, `lpi_find_unknown` reports unidentified flows to aid new rule development, and `lpi_arff` emits ARFF output for Weka workflows.

Warum Paket-Nerds sich dafür interessieren

For package maintainers, libprotoident is interesting because it sits between academic network measurement and practical CLI tooling. It pulls in the LibtraceTeam stack and gives users a packaged way to run protocol classification experiments without building the WAND tools by hand.

Zeitleiste

• 2011: Source headers identify University of Waikato WAND work beginning in this period.
• 2014-03-20: The public GitHub repository was created.
• 2017-06-28: Version 2.0.11 added many protocols and moved tools to parallel libtrace and libflowmanager 3 compatibility.
• 2020-11-12: Version 2.0.15 added protocols, an industrial-control-systems category, and category lookup APIs.

Related projects

• libtrace, libflowmanager, Weka, packet-trace analysis tools, and other traffic-classification projects such as nDPI and Zeek occupy adjacent space.

Quellen

• https://api.github.com/repos/LibtraceTeam/libprotoident
• https://api.github.com/repos/LibtraceTeam/libprotoident/releases
• https://github.com/LibtraceTeam/libprotoident
• https://raw.githubusercontent.com/LibtraceTeam/libprotoident/master/README
• https://raw.githubusercontent.com/LibtraceTeam/libprotoident/master/lib/libprotoident.h