SSG changelog and update [Документация VAS Experts]
Документация VAS Experts Документация VAS Experts-mobile
in

Settings

  • Show page
  • Old revisions
  • Export to PDF
  • Fold/unfold all
  • Backlinks
  • Show page
  • Old revisions
  • Export to PDF
  • Fold/unfold all
  • Backlinks

    • Differences

    This shows you the differences between two versions of the page.

    Link to this comparison view

    Both sides previous revisionPrevious revision
    Next revision    		Previous revision
    en:dpi:update [2025/07/01 08:59] – elena.krasnobryzhen:dpi:update [2025/10/22 10:34] (current) – elena.krasnobryzh
    Line 2: Line 2:
     {{indexmenu_n>10}} {{indexmenu_n>10}}
      
    -====== DPI/BNG Versions Update  ======+===== Update instructions  =====
     <note important>As of version 12.0, DPI is only installed on CentOS 8.x and [[en:veos:installation|VEOS]]!</note> <note important>As of version 12.0, DPI is only installed on CentOS 8.x and [[en:veos:installation|VEOS]]!</note>
      
    Line 43: Line 43:
      
     <note tip>Customers using BRAS functionality should note the changes when upgrading SSG to the new version.</note> <note tip>Customers using BRAS functionality should note the changes when upgrading SSG to the new version.</note>
    -===== DPI platform update to version 13.0 Congo ===== 
      
    -13.0 Congo ((Cradle of mankind: humans have lived here for over 50,000 years))+===== Updating SSG to Version 14.0 Shooting Stars =====
      
    -You can check the current installed version with the command:+14.0 Shooting Stars ((In memory of colleagues who made a huge contribution to the development of the company and its products and will forever remain in our memory)) 
     + 
     +You can check the currently installed version with the command:
     <code bash> <code bash>
     yum info fastdpi yum info fastdpi
     </code> </code>
        
    -Rollback to 12.4:+Rollback to 13.3:
     <code bash> <code bash>
    -yum downgrade fastdpi-12.4-0 fastpcrf-12.4-0+yum downgrade fastdpi-13.3-0 fastpcrf-13.3-0 dpiutils-13.3 fastradius-13.3
     </code> </code>
      
    -After an update or version change, a restart of the service is required:+After updating or changing the version, a service restart is required:
     <code bash> <code bash>
     service fastdpi restart service fastdpi restart
     </code> </code>
      
    -:!: If PCRF and/or Radius are used, they should also be restarted. The following order is preferred for restarting PCRF:+:!: If PCRF and/or Radius are used, they must also be restarted. For PCRF restart, the following order is preferred:
     <code bash> <code bash>
     service fastdpi stop service fastdpi stop
    Line 69: Line 70:
     </code> </code>
      
    -:!: Do not perform Linux kernel upgrades. Newer versions of the kernel may break binary compatibility with the Kernel ABI and the network driver will not load after the upgrade. If you do upgrade, set the GRUB boot loader to load the previous version of the kernel: set the ''default=1'' parameter in the ''/etc/grub.conf'' file while the problem is being resolved.+:!: Do not perform Linux kernel updates. In new kernel versions, binary compatibility with Kernel ABI may be broken, and the network driver may not load after the update. If you have already performed the update, temporarily configure the GRUB bootloader to boot the previous kernel version: in the ''/etc/grub.conf'' file, set the parameter ''default=1''.
      
    -If the update displays a message that the update was not found or there are dependency issues, run the command before updating:+If during the update a message appears that the update was not found or there are dependency issues, before updating, execute the command:
     <code bash> <code bash>
     yum clean all yum clean all
     </code> </code>
      
    -==== Changes in version 13.0 ==== +====Changes in version 14.0====
    -===DPI=== +
    -  - On-stick support for LAG/LACP. [[en:dpi:dpi_components:platform:dpi_inst_spec:dpi_onstick|Description]] +
    -  - Transition to DPDK 23.11 +
    -  - Modified: for QUIC and QUIC_IETF: if no SNI is detected - check by AS  +
    -  - Modified: when analyzing STUN, AS from Facebook is checked - define FACEBOOK_VIDEO, not WHATSAPP_VOICE +
    -  - Setting RSS hash flags for UDP and TCP +
    -  - Modified: openvpn protocol definition +
    -  - Fixed: SIGHUP processing only if fastDPI is fully initialized. Possible crash if SIGHUP is received during fastDPI startup process +
    -  - Trace/debug packet recording moved to new API +
    -  - Added: wechat protocol support for UDP +
    -  - Support for additional markup of autonomous systems ''mark1'', ''mark2'', ''mark3''. [[en:dpi:dpi_options:opt_priority:priority_config_as|Description]] +
    -  - Prioritize SNI detection in custom signatures for autonomous systems marked as ''mark1''. [[en:dpi:dpi_options:opt_priority:priority_config_as|Description]] +
    -  - Prioritize more specific custom SNI signatures.\\ Example: for host ''a.b.c.d'', if the signatures ''*.d'', ''*.c.d'' and ''*.b.c.d'' are present, the protocol defined by the signature ''*.b.c.d'' will be selected :!: works only for signatures with ''*''. [[en:dpi:dpi_components:dpiui:user_guide:vas_cloud_services:custom_protocols#protocols|Description]]  +
    -  - Support for hard locks (despite hostname/SNI) - set in an additional field in the address blacklist, example: ''1.1.1.1 443 hard''. [[en:dpi:dpi_options:opt_filtration:making_dictionary|Description]] +
    -  - Improved detection of YOUTUBE, SIGNAL +
    -  - Added the DPITUNNEL protocol, which includes traffic anomalies commonly used for DPI traversal +
    -  - Updating dpiutils +
    -  - New protocols VK_CDN_VIDEO, META_CHAT +
    -  - Improved signatures of FACEBOOK_VIDEO, META_CALLS protocols +
    -  - Fixed protocol name VK_CDN_VIDEO +
    -  - Fixed: SNI decoding in QUIC IETF and possibility of crusting in exceptional cases +
    -  - Fixed: clearing search structures when deleting CUSTOM protocols +
    -  - Added ability to add comments (#) and blank lines in input files for utilities [[en:dpi:dpi_options:opt_priority:priority_config#to_convert_into_an_internal_format|lst2dscp]], [[en:dpi:dpi_options:opt_shaping:shaping_session#configuring_policing_by_session|lst2tbf]] +
    -  - Added protocols QUIC_UNKNOWN - QUIC without SNI and QUIC_UNKNOWN_MARKED - QUIC without SNI and AS labeled MARK2. [[en:dpi:dpi_options:opt_priority:priority_config_as|Description]] +
    -  - Fixed: stun character definition for TCP +
    -  - Modified: if the stun packet viewing limit is reached - set this protocol with AS in mind +
    -  - Updated utilities to support new protocols +
    -  - Improvements in QUIC_UNKNOWN, QUIC_UNKNOWN_MARKED, SIGNAL, DpiTunnel protocols +
    -  - SNI/HOST embedded protocol definitions are cloud-based, SNI/IP prioritization is supported +
    -  - Modified: SNI comparison is case-insensitive +
    -  - Added LANTERN_WEAK protocol signature +
    -  - Improved IMAP protocol recognition +
    -  - Corrects LPM when selecting channel by IP/CIDR +
    -  - Added: to DNS text file record format - format vchnl - virtual channel number. +
    -  - Added: to the IPFIX data transfer template for DNS channel number. [[en:dpi:dpi_options:opt_li:li_ipfix#dns|Description]] +
    -  - Fixed: crash on DNS trace +
    -  - Improved VIBER_VSTREAMS protocol definition +
    -  - Fixed: fastDPI does not accept or process any ctl requests during fastDPI stop process +
    -  - Added SSTP protocol (49296) +
    -  - Added ANYDESK protocol (54273) +
    -  - LANTERN recognition improved+
      
    -===BRAS=== +  - [BRAS] Support for L2TP termination. [[en:dpi:bras_bng:bras_pppoe|Description]] 
    -  - Added: accounting of DHCP packets from subscriber in billing statistics: subscriber CPE (i.e. Wi-Fi router) without clients (e.g. at night) - sends only license renewal requests. Since these requests were intercepted by BRAS and were not included in the accounting, the session was terminated by idle timeout +  - [DPI]  Migration to DPDK 24.11, support for new NICs (Intel E830 200G, Intel E610, Napatech SmartNIC). [[en:dpi:dpi_brief:dpi_requirements|Description]] 
    -  - Corrected: actions when QinQ/VLAN is changed for a subscriber +  - [CLI] Added support for ''subs_id'' in commands: ''dhcp show'', ''dhcp reauth'', ''dhcp6 show'', ''dhcp6 reauth'', and ''dhcp disconnect''. [[en:dpi:bras_bng:cli:dhcp|Description]] 
    -  - Fixed: ''framed-pool renew''\\ In some cases, incorrect DHCP responses were generated. Added trace to DHCP packets log for ''framed-pool renew''. +  - [DPI] New protocols added: AGORA_STREAMS(49314), AZAR_CALL(49315), WECHAT_CALL(49316), TEAMS_CALL(49317). [[en:dpi:dpi_options:protocols]] 
    -  - Fixed: receiving packets from relay. Previously it was checked that relay was on the fc::/7 network. Now this check is unnecessary and has been removed - relay can have any address. +  - [DPI] Improved support for LINE_CALL, VYKE_CALL protocols. [[en:dpi:dpi_options:protocols]] 
    -  - Fixed: DHCPv6 options parsing from Radius +  - [DPI] Fixed smartdrop behavior 
    -  - The ''subs prop show active'' command has been added. The command outputs a dump of L2 properties of all active (not-expired) subscribers. [[en:dpi:bras_bng:cli:subs#subs_prop_show|Description]] +  - [DPI] Added validation for complex protocols. [[en:dpi:dpi_options:protocols]] 
    -  - Modified: Prohibit calling CLI commands while stopped +  - [DPDK] Increased the maximum number of dispatchers to 32. [[en:dpi:dpi_components:platform:dpi_config|Description]] 
    -  - Fixed: idle-timeout for session. For PPPoE sessions idle timeout should be taken from the ''bras_ppp_idle_timeout'' setting if not explicitly set in the authorization response (Idle-Timeout attribute). +  - [IPFIX/Netflow] Added the ability to change IPFIX/Netflow parameters without restarting fastDPI using the ''ipfix_reserved'' parameter. [[en:dpi:dpi_options:opt_statistics:statistics_ipfix|Description]] 
    -  - Added priority forwarding with DSCP translation. [[en:dpi:dpi_options:opt_priority:priority_settings#configuring_dscp_inheritance_and_conversion|Description]]  +  - [FastRadius] It is now possible to set both ''bind_ipv6_address'' and ''bind_ipv6_subnet''. If the Framed-IPv6-Prefix has a /128 mask, it is not checked against the ''bind_ipv6_subnet'' restriction. [[en:dpi:dpi_components:radius:radius_requirements#ipv6_support|Description]] 
    -  - Corrected: Adding unnecessary option 61 (Client-Id) to fastDPI response when distributing address from Framed-Pool +  - CLI command ''dev info'' now includes the name of the LAG that the port belongs to. [[en:dpi:bras_bng:cli:subs#dev_info|Description]] 
    -  - Fixed: Logging of DHCP server IP addresses +  - [PCRF][PPP][Framed-pool] Added: DHCP option ''Client-Id'' now includes ''tunnel-IP'' as part of the subscriber ID. For more details, see sections [[en:dpi:bras_bng:ip_pool:ipv4]] and [[en:dpi:bras_bng:ip_pool:ipv6]] 
    -  - Fixed: Enabling services with profiles. The `VasExperts-Service-Profile` attribute (service profile name, implicitly enables the service) has higher priority than `VasExperts-Enable-Service` (enabling/disabling a service without specifying a profile). +  - [IPFIX] Message aggregation added for IPFIX streams: FullFlow/DNS/META/NAT 
    -  - Added ''ping inet'' command on behalf of subscribers through the entire BRAS/NAT/ROUTER processing chain. The prompt is ''fdpi_cli ping inet ?''. [[en:dpi:bras_bng:cli:subs#subs_ping_inet|Description]] +  - [IPFIX] Added parameter ''ipfix_mtu_limit'' to restrict maximum message size for IPFIX UDP packets. Description: [[en:dpi:dpi_options:opt_li:li_ipfix#clickstream_export_setup|ClickStream export Setup]], [[en:dpi:dpi_options:opt_statistics:statistics_ipfix]] 
    -  - Fixed: call of subscriber IP address deanounce when acct idle. Added new flag to router option ''router_subs_announce'': ''0x10000'' - deanounce L3 subscriber at acct idle (closing acct session by idle timeout). [[en:dpi:dpi_components:router#subscriber_announcements_and_nat_pool|Description]] +  - [IPFIX DNS] New elements added to IPFIX DNS: 224 (ipTotalLength) and 43823:3206 (DNS transaction id). [[en:dpi:dpi_options:opt_li:li_ipfix#configuring_the_export_of_dns_responses_or_dns_queries|Description]] 
    -  - Added support for specifying the profile of service 18 during authorization. Enabling service 18 in the Access-Accept Radius response is set in the usual way for a service with a mandatory profile (here ''serv18'' is the profile name):<code bash>VasExperts-Service-Profile = "18:serv18"</code> +  - [VRRP] Fixed proper handling of the ''vrrp_enable'' option change 
    -  - A search by ''MAC'' and ''subs_id'' has been added to the ''subs prop show'' command. The result of a search by ''MAC'' or ''subs_id'' can be multi-valued - several different entries for the same ''MAC''/''subs_id''. The result of the ''subs prop show active'' command has been changed, which may be critical when parsing the command's json wiggle. [[en:dpi:bras_bng:cli:subs#subs_prop_show|Description]] +  - [BRAS][PPP] PPP session key is now compound: ''l2subs_id'' + ''tunnel-IP''. For PPPoE sessions, tunnel IP = 0. CLI commands that use ''subs_id'' as a key (''subs prop show'', ''l2tp show session'', ''l2tp term'', etc.) may now return multiple entries with the same ''l2subs_id''. [[en:dpi:bras_bng:bras_pppoe|Description]] 
    -  - Fixed: setting link up/down flag for ports that do not support link up/down interrupts (e.g. af_packet) +  - [DPI] Added cloud protocols with identifiers 55296..58367 
    -  - The return code of the uptime command. The CLI command ''uptime'' can be used to check if fastDPI is fully started: it returns ''result=0'' (Success) only when fastDPI is fully initialized and all worker threads are started. Upon receiving a response from fastDPI to the ''fdpi_cli uptime'' command, the fdpi_cli utility itself checks the result of the execution and if ''result!=0'' - sets a non-zero return code. +  - [IPFIX] Fixed IPFIX exporter reinitialization bugs 
    -  - Corrected: If VRF (service 254) was present in Access-Accept, the packet was incorrectly logged as invalid. +  - [BRAS][subs_grooming] Fixed potential crash due to race condition during fastDPI shutdown 
    -  - Restoring UDR operation after calling a command with a large number of parameters +  - [CLI] Added commands to display mempool properties and statistics<code> 
    - +    hal mempool props 
    -===NAT=== +    hal mempool stat</code>DPDK must be built with statistics collection enabled to display mempool stats 
    -  - Added a ''checknat'' utility to check the distribution of white addresses. [[en:dpi:dpi_components:utilities:management_utilities#checknat|Description]] +  - [BRAS][DHCP] Fixed crash when parsing Framed-Pool Renew response if it contains no DHCP options 
    -  - Fixed online change of ''nat_private_cidr'' parameter +  - [PCRF][Acct] Fixed: Interim-Update sending is now disabled when ''Acct-Interim-Interval = 0'' is explicitly set in the RADIUS response. For more details, see sections  [[en:dpi:bras_bng:radius_integration:radius_auth_server_integration:radius_auth_response#acct-interim-interval|]], [[en:dpi:bras_bng:bras_pppoe:pppoe_pppol2tp_parameters:bras_pppoe_radius]] 
    - +  - [VASE_CLI] Created a unified CLI for managing DPI, BRAS, DHCP (KEA), ROUTER (BIRD) with support for authorization and command logging via TACACS (VEOS 8.x required). [[en:dpi:dpi_components:utilities:vase_cli|Description]] 
    -===Load Balancer=== +  - [SNMP] Created a module for monitoring system components via SNMP 
    -  - Added L2 traffic balancer mode. This enhancement allows to use SSG as a traffic balancer based on IP addresses owned by AS and defined as ''local'' in ''asnum.dscp''. [[en:dpi:load_balancer|Description]] +  - [DPI] Added DOQ 49318 protocol (DNS-over-QUIC) 
    -  - Added mqrx_lb_engine, which is activated when dpdk_engine=2. [[en:dpi:load_balancer#setting_etc_dpi_fastdpiconf|Description]] +  - [Router] Announcing subscriber white addresses for 1:1 NAT individually and after authentication. [[en:dpi:opt_cgnat:сgnat_settings|Description]] 
    - +  - [PCRF] Added support for service 19 "DNS spoofing", profile required. [[en:dpi:dpi_options:dns_substitution|Description]] 
    -===Router=== +  - [DPDK] Added ''dpdk_engine=6'' (''mqrx-bridge'') — number of RSS dispatchers per bridge. [[en:dpi:dpi_components:platform:dpi_config#dpdk_engine_6rss_dispatchers_per_bridge|Description]] 
    -  - Mempool allocation for emit packets: we do not allow the pool to be completely exhausted, there should be at least 256 free elements in the pool +  - [DPDK] Removed dedicated mempools. The fastdpi.conf option ''dpdk_emit_mempool_size'' is deprecated and no longer used. 
    -  - The error of route deletion ''errno=3'' (No record found) has been moved to TRACE to avoid clogging the log +  - [VLAN-Rule] Moved vlan group data from UDR to SDR. Global rules for vlan drop/pass/hide/permit set by the previous CLI command ''vlan group'' were converted and moved from UDR to SDR, with removal from UDR. [[en:dpi:dpi_components:platform:vlan_traffic_handling|Description]] 
    -  - Fixed the order of router components termination +  - Up to version 14, only one built-in database UDR (User Data Repository) is used, intended for permanent storage of data about services, policings, and other FastDPI settings.\\ Starting from Version 14, UDR is split into UDR and SDR. The split occurs automatically during version update.\\ SDR (System Data Repository) is intended for storing FastDPI settings not related to subscribers. It can be considered that SDR is an extension of fastdpi.conf. No special activation of SDR is required — the necessary .mdb files are created automatically when the corresponding mode is enabled in fastdpi.conf. 
    -  - Changed: system error when clearing route tables. Cleaning of route tables (deleting all entries added by SSG) is done at stop and start of fastDPI. During cleaning process EBUSY error may occur, which is fatal for netlink socket, socket should be closed. +  - [VLAN] VLAN rules — added CLI commands. [[en:dpi:dpi_components:platform:vlan_traffic_handling#vlan_rule|Description]] 
    -  - Fixed: TAP link down in LAG. If a port enters a lag, TAP this port to Link down state only when ALL LAG ports are down. +  - [IPv6] Added direction detection in combined traffic (IN+OUT on one port) based on the local flag for IP addresses. Enabled via ''combined_io_direction_mode'' option 
    -  - Fixed: control of selfgen mempool exhaustion +  - [BRAS] Fixed compatibility with the old format of service 18, where there were fewer protocols and both fields in the profile needed to be filled 
    -  - Optimization of data readout from TAP +  - [DPI] Lowered detection priority for ''telegram_tls'' 
    -  - Fixed LAG+On-stick: put TAP in link down state. TAP is set to link down only when all ports in LAG are in down state. If there is at least one port in Up state - TAP should be in Link Up state. +  - [DPI] Improved detection of ''WECHAT'' and ''WECHAT_CALL'' 
    -  - Corrected: Traffic diversion in router for on-stick device in LAG. When forming VRF topology, it was not taken into account that the LAG includes the base (physical) device, and the on-stick (virtual) device is specified in the router description. +  - [BRAS][Framed-Route] Fixed: possible crash when freeing memory 
    -  - Fixed: Read all data from TAP device. At fastDPI startup there were possible situations when router is not fully initialized yet and TAP is already monitored but not read out. +  - [BRAS] Refactored PCRF connectivity: in the new implementation, all connections are equal; an error on any triggers reconnection of all connections and a switch to another PCRF. Added CLI commands: 
    -  - The router_subs_announce option is made hot (hot) +    - ''pcrf connect show'' — show current status and accumulated statistics for PCRF connections. 
    -  - Fixed: mbuf leak on fastDPI startup +    - Force connection to the specified PCRF ''pcrf connect switch [<pcrf_index>]'', where ''<pcrf_indxed>'' is the index of the connection line in the ''auth_server'' parameter. If ''<pcrf_indxed>'' is not specified — defaults to 0.\\ [[en:dpi:bras_bng:radius_integration:radius_auth_fastpcrf_setup|Description]] 
    - +  - [IPFIX DNS] Added the ability to send DNS MX responses via IPFIX. Enabled by setting bit 3 (4) of the ''ajb_save_dns'' parameter. [[en:dpi:dpi_options:opt_li:li_ipfix#configuring_the_export_of_dns_responses_or_dns_queries|Description]] 
    -===SDS=== +  - [DPI] Added FakeTLS protocol (49319) with validation 
    -  - The ''storage_tag'' value is set based on directional priority or protocol priority +  - [BRAS][DHCP] Changed: sliding window algorithm for rate limit 
    - +  - [BRAS] Fixed: time comparison error when loading ip_prop from UDR 
    -===Radius=== +  - [VLAN-Rule] Added support for 'any' instead of '*' when describing VLAN range. [[en:dpi:dpi_components:platform:vlan_traffic_handling#vlan_rule|Description]] 
    -  - Added the ability to work with standard linux interfaces using ''libpcap''. [[en:dpi:dpi_components:radius:radius_config#linux_interfaces_setup|Description]] +  - [DPI][LOG] Messages about insufficient SSL parsers are written to the slave log not for every event, but at a frequency of 1/50000. 
    - +  - [DPI] Added protocols ZALO_CALL(49320) and VK_CALL(49321) 
    - +  - [DPI] Fixed blocking in hard mode for SSL 
    -====Changes in Version 13.1==== +  - [Acct] Added attribute ''VASExperts-Service-Type''. Radius acct start/interim/stop sends the authorization type in the ''VASExperts-Service-Type'' attribute. [[en:dpi:bras_bng:radius_integration:radius_accounting:radius_attr|Description]] 
    -<note warning>Warning! An error has been detected in version 13.1. PPPoE sessions do not close when ''idle_timeout'' expires.\\ The fix is planned for the next release.</note> +  - [CLI] Added: ''stat flow ip6'' command to display IPv6 flow statistics. [[en:dpi:bras_bng:cli:stat|Description]] 
    -===DPI=== +  - [CLI] Added: ''stat flow ip4'' command to display IPv4 flow statistics. Analogous to the output in ''fastdpi_stat.log''. [[en:dpi:bras_bng:cli:stat|Description]] 
    -  - Global code refactoring - discontinued support for ''pf_ring'' +  - [IPFIX] Fixed ExportTime formation error in IPFIX Fullflow 
    -  - Added: service 19 - DNS response substitution. [[en:dpi:dpi_options:dns_substitution|Description]] +  - [CLI] Added ''stat netflow'' command. Displays general statistics for Netflow/IPFIX (same as in ''fastdpi_stat.log'' under the "Statistics on NFLW_export" section). [[en:dpi:bras_bng:cli:stat|Description]] 
    -  - Modified: minimum PCAP file size to 100 MB. PCAP file rotation on reload [[en:dpi:dpi_options:opt_li:li_ctrl|Description]] +  - [DNS] Added support for substitution/blocking/dropping of DNS requests A, AAAA, MX, HTTPS. [[en:dpi:dpi_options:dns_substitution|Description]] 
    -  - Modified: improved DROP event tracing +  - [CLI] Added ''stat firewall'' command. [[en:dpi:bras_bng:cli:stat|Description]] 
    -  - Fixed: erroneous ERROR level message appearing for certain ''fdpi_ctrl'' requests +  - [DPI] Added BIGO_CDN protocol (49324) 
    -  - Fixed: incorrect TLS (SNI) parsing when multiple 'ALPN Protocols' are specified +  - [DPI] Added UDP support for BIGOTV 
    -  - Modified: mechanism for updating AS and IP compliance lists. [[en:dpi:dpi_options:opt_statistics:statistics_asn|Description]] +  - [PCRF][L2TP] Fixed: NAS attributes for L2TP during authorization 
    - +  - [BRAS][L2TP] Fixed: data race when closing sessions 
    -===BRAS=== +  - [DPDK] Removed deprecated rx channels settings and related checks 
    -  - Fixed: subscriber activity control via unicast ARP Request. Previously, it was a broadcast ARP Request, which is not optimal for the network. [[en:dpi:bras_bng:bras_l2_options:subs_activity|Description]] +  - [IPFIX] Added configurable sending of drop octets/packets counters when generating IPFIX fullflow. [[en:dpi:dpi_options:opt_statistics:statistics_ipfix|Description]] 
    -  - Added: SHCV (Subscriber Host Connectivity Verification) — DHCP subscriber activity control. Considered scenario for an already "closed" record to prevent repeated SHCV trigger and increase in the 'SHCV: session closed by inactivity' counter. [[en:dpi:bras_bng:bras_l2_options:subs_activity|Description]] +  - [PCAP] Added capability to save traffic of a specified vlan using the ''ajb_save_vlan'' parameter. [[en:dpi:dpi_options:opt_li:li_settings#pcap_by_vlan|Description]] 
    -  - Added: ARP Proxy for known routes (router mode only). This feature is applied only if the ARP request initiator is a known subscriber. A new flag - 0x0004 has been added to the ''bras_arp_proxy'' option. [[en:dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_arp_proxy|Description]] +  - [DPIUTILS] Updated checknat utility. [[en:dpi:dpi_components:utilities:management_utilities#checknat|Description]] 
    -  - Fixed: help() for IPv6 addresses in the ''subs prop show'' command +  - [DPIUTILS] Updated dns2dic utility with domain blocking support. [[en:dpi:dpi_options:dns_substitution|Description]] 
    -  - Fixed: error in parsing parameters for the ''subs prop del'' command, which resulted in the inability to delete properties by IP with the error <code bash>ERROR: Result code=9: No subscriber IP address</code> +  - [BRAS][L2TP] Fixed: data race during tunnel creation 
    -  - Added: CLI command ''dhcp disconnect''. This is a CLI analog of CoA Disconnect. The disconnect mode is set by the ''bras_dhcp_disconnect'' option. +  - [Router] Fixed: interception and diversion of IPv6 packets to tap interfaces. Link-local addresses were not diverted to tap, even if explicitly specified in the ''router.subnet6'' settings. 
    -    - ''dhcp disconnect all'' - disconnect all DHCP sessions +  - [BRAS][L2TP] Fixed: length field in L2TP header for data packets. According to RFC, the len field in L2TP header is optional for data packets. Some L2TP client implementations do not understand data packets with the len field in the L2TP header. This fix adjusts FastDPI's behavior: if data packets from the subscriber arrive without the len field, then SSG will also send data packets without this field. If data packets from the subscriber contain the len field, SSG will include it as well. 
    -    - ''dhcp disconnect [ mac=X | ip=X ]'' - disconnect specified session +  - [BRAS] Fixed: sending commands from the ''pending_queue''. In some cases (e.g., during state transitions of the pcrf monitor ''initial -> connected''), sending commands from the ''pending_queue'' was not triggered, which caused commands to "hang" in the queue indefinitely (until reconnection due to a socket error). 
    -  - Fixed: sending L3 reauth for L2 subscriber in advance, not waiting for session timeout +  - Fixed a recently introduced error (affecting betas 4.6 and 4.7) in the session lifecycle that leads to resource exhaustion over time; an operational update from these versions (or rollback) is recommended.
    -  - Added: number of sessions closed due to inactivity (SHCV) in the ''dhcp show stat'' CLI command +
    -  - Fixed: error in intercepting and processing ICMPv6 packets, checksum not recalculated in some cases when modifying ICMPv6 packet +
    - +
    -===NAT=== +
    -  - Modified: tracing in ''vdpi_new_flow_nat_ipv4'' is always output +
    -  - Fixed: based on the value of ''nat_exclude_private'', additionally checking the pair CHECK_AS_LOCAL or CHECK_AS_PEER for AS in local interconnect +
    - +
    -===Router=== +
    -  - Added: ARP management. [[en:dpi:dpi_components:router#arp_management|Description]] +
    -  - Fixed: port selection for recording in a pass-through LAG. If LAG passes through fastDPI, port selection for recording from TAP should consider the Link Up/Down state of both bridge sides of the port +
    -  - Fixed: announcing NAT profile subnets upon addition +
    -  - Added: CLI command ''router vrf dump''. The command outputs the list of VRFs set in the system and their properties +
    -  - Fixed: do not consider term by AS when announcing NAT subnets. The ''term_by_AS'' mode applies to subscribers, not to NAT profiles, hence it should **not** be considered when announcing a NAT subnet +
    -  - Fixed: order of packet interception from the general processing pipeline +
    -  - Fixed: increased number of ''mbuf'' in ''selfgen mempool'' if router enabled: if router disabled: ''mempool size=512 * number_of_slaves_in_cluster'', if router enabled: ''mempool size=8 * 1024 * number_of_slaves_in_cluster'' +
    - +
    -===LAG=== +
    -  - Fixed: zeroing the array when building a new list of active ports. The error leads to array overflow and memory corruption +
    -  - Added: logging of the "no mbuf" error when sending LACP +
    - +
    -====Changes in version 13.2==== +
    -  - [BRAS][PPPoE] Fixed: ping of inactive client via Echo requests +
    -  - Added: support for service profile 19 (DNS response substitution). For service 19, it is possible to specify AAAA records and use * for domains. [[en:dpi:dpi_options:dns_substitution|Description]] +
    -  - Fixed: service profile 18 no longer requires setting both DSCP and TBF simultaneously. [[en:dpi:dpi_options:opt_shaping:shaping_session#creating_a_service_profile|Description]] +
    -  - Fixed: IP:PORT takes priority over IP and CIDR for custom protocol definitions. [[en:dpi:dpi_components:dpiui:user_guide:vas_cloud_services:custom_protocols|Description]] +
    -  - Changed: user-defined protocol priority is now higher than cloud-defined ones. [[en:dpi:dpi_components:dpiui:user_guide:vas_cloud_services:custom_protocols|Description]] +
    -  - Fixed: AAAA record length in service 19 +
    -  - Added: ''block_options'' parameter, mask 8 — do not generate RST packets for blocking and redirection for direction inet→subs. [[en:dpi:dpi_options:opt_filtration:filtration_settings#blocking_settings|Description]] +
    -  - [DPI] Improved: analysis of out-of-order packets (now you can set number of buffers for out-of-order handling), decryption of fragmented QUIC. Also eliminated buffer exhaustion for out-of-order packets. [[en:dpi:dpi_options:opt_filtration:filtration_common|Description]] +
    -  - [DPI] Fixed: DOT recognition +
    -  - [CTRL] Added: new output format for policing. [[en:dpi:dpi_options:opt_bandwidth_mgmt:bandwidth_json#the_second_option|Description]] <code bash>fdpi_ctrl list profile --policing --profile.name htb_6 --outformat=json2</code> +
    -  - [CTRL] Added: loading policing profiles with the new format (includes value and unit). [[en:dpi:dpi_options:opt_bandwidth_mgmt:bandwidth_json#the_second_option|Description]] +
    -  - [BRAS][IPv6] Added: when client sends DHCPv6 confirm and session is absent in BRAS DB, reply with ''NotOnLink'' status +
    -  - [FastPCRF][DHCPv6] Fixed: issue that caused current IPv6 accounting session to close and reopen when handling client's DHCPv6 lease renew requests +
    -  - [DPI] Added: update of ''asnum.bin'' from the cloud, ''asnum_download'' parameter matches ''[[en:dpi:dpi_options:opt_filtration:filtration_settings|federal_black_list]]'' in values. [[en:dpi:dpi_options:opt_priority:priority_config_as|Description]] +
    -  - Added: ''mem_ssl_savebl'' parameter (cold). Sets number of saved buffers for SSL packet parsing. [[en:dpi:dpi_components:platform:dpi_admin:mem_problems#mem_ssl_savebl|Description]] +
    -  - Added: statistics for SSL parsing buffer usage. [[en:dpi:dpi_components:platform:dpi_admin:mem_problems#ssl_parsing_buffer_save_utilization_statistics|Description]] +
    -  - [BRAS][DHCPv6] Added: ability to extract option 37 and option 38 from client packet +
    -  - [Router][tap] Fixed: bridge status initialization at fastDPI start. TAP device for LAG passthrough is Up if at least one LAG port is Up and its peer bridge port is also Up. Previously bridge status was determined only on link Up/Down events. This patch initializes bridge status at router start based on port states. +
    -  - [BRAS] Fixed: allow local interconnect only if srcIP belongs to a known subscriber. Previously, srcIP was not verified, which could allow IP spoofing and local DDoS with forged subscriber IPs. +
    -  - Added: CLI command ''permit''. +
    -  - [CLI][Ping] Changed: error message when subs IP not found +
    -  - [CLI] Added: boolean flag ''on_stick'' in JSON output of ''dev xstat'' command +
    -  - [CLI] Changed: JSON output of ''dev info'' for on-stick devices.\\ Previously:<code bash>"pci_address": "on-stick based on 82:00.3"</code>Now:<code bash>    // base device address +
    -    "pci_address": "82:00.3" +
    -    // on-stick flag +
    -    "on-stick": "true|false"</code> +
    -  - Removed fake Yandex SNI from TELEGRAM_TLS +
    -  - Added: ''mem_quic_ietf_savebl'' parameter. Sets number of buffers for parsing ''quic_ietf'' requests (multi-packet). Default is 15% of ''mem_ssl_parsers''. [[en:dpi:dpi_components:platform:dpi_admin:mem_problems#mem_quic_ietf_savebl|Description]] +
    -  - [DPI] Added protocols <code bash> +
    -"HLS VIDEO" 49298  +
    -"ICMP TUNNEL" 49299  +
    -"DNS TUNNEL" 49300  +
    -"FORTICLIENT_VPN" 49301  +
    -"CISCO_ANYCONNECT_VPN" 49302 +
    -"SHADOWSOCKS_VPN" 49303 +
    -"NOT_DNS" 49304  +
    -</code> +
    -  - Added: support for sending DNS query over IPFIX +
    -  - [DPDK] Added read-only engines: RSS and port dispatcher +
    -  - [BRAS][SHCV] Fixed: SHCV was called before pipeline fully started, which could happen in multi-port configs with long pipeline init time +
    -  - [DPDK] Added mempool type output on fastDPI start +
    -  - [Router] Added TAP device statistics to CLI command ''router vrf show'' — number of packets/bytes read from TAP, written to port, transmitted to TAP, number of events and errors +
    -  - [Router] Changed: packets from TAP now use same thread for 5 seconds to reduce reordering under high load +
    -  - [DPI] Improved detection of DNS TUNNEL, CISCO_ANYCONNECT_VPN, SHADOWSOCKS_VPN, DPITUNNEL, FORTICLIENT_VPN +
    -  - Changed log level for telemetry requests to INFO regardless of outcome +
    -  - [fastPCRF][ACCT] Fixed: Interim-Update sent properly when switching to backup RADIUS server +
    -  - [BRAS][CLI] Fixed: subscribers closed via SHCV are no longer shown by ''fdpi_cli subs prop show active'' +
    -  - [BRAS][Auth] Optimized service attach/detach +
    -  - [FastRadius] Config file parsing migrated to new engine +
    -  - [BRAS][DHCP] Offer now sent first to bcast 255.255.255.255 +
    -  - [BRAS][CLI] Fixed: ''dhcp show stat vrf'' supported only in Radius proxy mode (previously crashed in DHCP Relay mode) +
    -  - [DPI] Improved recognition of DNS Tunnel and Shadowsocks +
    -  - [Utils] Improved tools. ''checkproto'': if IP and SNI are set, result will reflect MARK1 and priority. ''ascheckip'': shows DSCP and MARK1 +
    -  - [Utils] Added support for hostnames ending with '':'' in url2norm — allows "any port" for HTTP +
    -  - [CLI] Fixed: ''dhcp disconnect'' command +
    -  - [DPI] Fixed: allow protocol change via CUSTOM SNI even after builtin signature match +
    -  - [DPI] Added integrity check for AS list file from cloud +
    -  - [DPI] Fixed loading of black and white lists from cloud +
    -  - [utils] Added support for new formats in bin2ip for converting black/white lists +
    -  - Fixed potential core crash +
    -  - Support for 128-core CPUs [[en:dpi:dpi_brief:dpi_requirements#recommended_requirements|Description]] +
    - +
    -====Changes in version 13.3==== +
    - +
    -  - [DPI] Added protocols:\\ <code bash> +
    -BIGOTV 49305 +
    -SAYHI_CALL 49306 +
    -AZARLIVE 49307 +
    -LINE_CALL 49308 +
    -QQ_CALL 49309 +
    -VYKE_CALL 49310 +
    -VEEGO_STREAMS 49311 +
    -BHABI_CAM 49312 +
    -WEPARTY 49313 +
    -</code> +
    -  - [DPI] Improved Viber recognition +
    -  - [DPI] Reduced false positives for DPI TUNNEL +
    -  - [DPI] Increased packet inspection depth for BIGOTV detection +
    -  - [DPI] Changed FACETIME protocol +
    -  - [DPI] Changed: if protocol is matched by ip/sni/cname, it is no longer overridden by built-in signatures +
    -  - [DPI] Streamlined protocol priority enforcement to avoid unnecessary switching +
    -  - [DPI] Fixed: searching both '*' and ':' in HTTP domains +
    -  - [DPI] Fixed: virtual channel IP removal on reload +
    -  - [DPI] Fixed: drop ignored when ''smartdrop'' is set during SSL parsing errors +
    -  - [BRAS][PPP] Fixed: ''bras_pppoe_trace_mac'' now respected for DHCPv6 packets in pcap. Previously only ''bras_dhcp_trace_mac'' was used +
    -  - [DPI] Fixed: errors assigning vchannel by IP/CIDR +
    -  - [DPI] Fixed: blocking by IP for DNS over TCP +
    -  - [DPI][PCRF] Changed log level from INFO to WARNING for start/stop messages +
    -  - [DPI Utils] Fixed: ''checkproto'' when IP protocol is Unknown +
    -  - [Utils] Fixed: ''checkproto'' now respects MARK1 and port presence. ''checkproto 8.8.8.8 443 www.google.com'' vs ''checkproto 8.8.8.8 www.google.com'' may give different results +
    -  - [Utils] ''bin2as'' now accepts multiple input files +
    -  - [Utils] ''ascheckip'' supports group checks from ''stdin'' +
    -  - [Utils] ''bgp2bin'' is a ''as2bin''-like tool but: +
    -    * only accepts /24 and larger subnets +
    -    * supports IP1-IP2 range as in RIPE records +
    -    * later entries take precedence +
    -    * output is slightly larger than ''as2bin'' but contains no overlapping ranges +
    -  - [BRAS] L3-auth improvements: +
    -    * On Reject for IP bound to multi-bind login: first unbind IP, then assign services (whitelist, policing) +
    -    * On successful Access-Accept with a login for unbound IP: unbind all services before linking IP with new login +
    -  - [BRAS][PPP] Fixed: mixed dual-stack where one address is specified, the other via framed-pool +
    -  - [BRAS][PPP] Fixed: silently drop broadcast packets +
    -  - [PCRF] Added syslog support. New param ''syslog_level'' in fastpcrf.conf — controls alert log to syslog. ''0'' disables (default) +
    -  - Added: hot param ''smartdrop = 1'' — if drop set for protocol, it’s delayed until TLS is parsed or error occurs +
    -  - Fixed: adding HTTP domains ending with ':' (port number) +
    -  - Changed: ASNUM path from VAS Cloud (cloud.vasexperts.ru) +
    -  - Blocking by blacklist in GTP tunnel (with ''detect_gtp_tunnel'' enabled) +
    -  - Fixed: https blocking with ''hard'' option +
    -  - IPv6 AS reload support +
    -  - Initial alert log to syslog support. Enable with ''syslog_level=7''. Default is off. Notes: +
    -    - rsyslog replaces tab/newline with codes. To disable, add in ''/etc/rsyslog.d/fastdpi.conf'': <code bash>global(parser.escapeControlCharactersOnReceive="off")</code> or use ''journalctl''. Example: <code bash>journalctl -t fastdpi -p 4 --since "1 hour ago" -o verbose --output-fields PRIORITY,MESSAGE</code> +
    -    - Logs can be forwarded remotely. Example from ''/etc/rsyslog.conf'': +
    -      - on fastdpi server:<code bash>*.*  action(type="omfwd" target="192.0.0.1" port="10514" protocol="tcp" +
    -            action.resumeRetryCount="100" +
    -            queue.type="linkedList" queue.size="10000")</code> +
    -      - on remote server:<code bash>input(type="imptcp" port="10514" +
    -      ruleset="writeRemoteData") +
    -ruleset(name="writeRemoteData" +
    -        queue.type="fixedArray" +
    -        queue.size="250000" +
    -        queue.dequeueBatchSize="4096" +
    -        queue.workerThreads="4" +
    -        queue.workerThreadMinimumMessages="60000" +
    -       ) { +
    -    action(type="omfile" file="/var/log/fastdpi.log" +
    -           ioBufferSize="64k" flushOnTXEnd="off" +
    -           asyncWriting="on")</code>+