-
Protocol detectionIdentifying network protocols, extracting fields, decoding values -
Classification of Internet servicesClassification of services and definition of the nature of the flow (audio/video/file transfer). -
Integration into IT solutionsIntegration into IT solutions (IPS/IDS, SIEM, DLP, etc.) -
Data collection for AICollecting an array of data for use in AI systems -
Network activity loggingLogging of network activity that can be used in the investigation of incidents -
User controlPutting users under control (saving all or selected information for certain users) -
Collecting information for billingAccumulation of information on streams for use in billing -
HotFix of new vulnerabilitiesPrevention of exploitation of new vulnerabilities, before the release of official fixes (HotFix)
> Integration into other software solutions
SL DC Engine is a DPI Engine class solution and can be integrated into third-party products. DC Engine provides the ability to dissect packets, obtain protocol fields, collect statistics on network flows, and configure classification rules. DC Engine also makes it possible to expand the basic functionality through an extension mechanism that allows users to add their code to the traffic processing pipeline and use the results of its execution in classification rules.
> Detailed package analysis
Each processed packet is divided into layers which belong to a specific protocol. SL DC Engine parses each supported protocol and maps its fields, after which their values can be obtained via the API. In addition to, the DC Engine also maintains a hierarchy of fields to provide the ability to visualize a layer's structure in detail. After processing the packet, a user can obtain information about the state of each layer, and if errors occur during the dissection process, the DC Engine will report what exactly went wrong
> Many supported protocols
SL DC Engine is designed as a universal framework for processing network traffic, which does not depend on which network traffic is processed. DC Engine can process traffic from local, mobile, and industrial networks; the Internet network, and also supports protocols used by IoT devices.
> Logging system
One of the main elements when monitoring a network is activity logging. The DLog module is responsible for collecting logs and allows the user to configure what data should be included in each log journal. The log may include data received from custom extensions. DLog also provides the ability to set policies for log rotation. In addition, the user can configure the count of processing threads according to the characteristics of their hardware, which will increase performance.
> Traffic filtering opportunities
Traffic control allows you to solve problems such as load balancing in the network, restricting access to prohibited resources, preventing malicious network activity, and assigning quotas to individual network users. These problems are common to any type of network, from local to mobile. Solving such problems allows users to comply with regulatory requirements, ensure stable network operation, and respond in time to malicious network activity, preventing its further spread.
> Classification of network services and Internet services
Classification tasks are typical for such areas as information security, where data is classified as malicious or malicious, system administration, where incorrect network operation is diagnosed, and in the field of mobile operators and Internet providers, where network flows are classified as popular Internet services. SL DC Engine provides functionality to classify network activity through a tagging mechanism. This means that the user can independently create any tag and describe the rule for assigning it to a packet or flow (for example, tethering, fraud, etc.). This approach implies universality in matters of classification and allows users to create their tags for any purpose.
- IPv4/IPv6 CIDR configuration
- New 'address' field for IPv4/IPv6 protocols (to simplify configuration rules)
- SPID (Statistical Protocol IDentification) extension. The extension allows to assign tags by flow statistic metrics such as average packet size, bitrate, IAT
- Introduce the opportunity for extension to assign flow tags independently from matchers
- POP3 protocol
- IMAP protocol
- RTCP protocol
- IGMP protocol
- Session and DNS Cache optimization
- Extensions priority options
Benchmarks
On request.
- Packet direction detection
- Packet API is changed
- ILayer API is changed
- HTTP Authentication data extraction
- HTTP FileType and Mime information extraction
- Telnet protocol
- ISAKMP protocol
- OpenVPN protocol
- Wireguard protocol
- NTP protocol
- FTP protocol
- SFTP protocol
- STUN protocol
- SSH protocol
- SOCKS protocol
- IPv6 protocol
- ICMPv6 protocol
- RTP protocol
- L2TP protocol
- SIP protocol
- SIP Over TLS protocol
- Teredo protocol
- PPTP Protocol
- PPP protocol
- PPPOE (Session and Discovery) protocol
- BitTorrent protocol
- BitTorrent DHT
- BitTorrent UTP
- BitTorrent Tracker
- IPv6 Flow table
- Data cache is added for session context to allow detect protocols which have high entropy
- Update protocol tree extension
- TLS/DTLS Session Cache
- FTP Cache extension. The extension helps to classify FTP Data Plane flows
- Final extension. The extension allows to finalize protocol detection and service classification process
- Update Protocol Tree extension to allow build tree based on TLS ALPN and PPP types
- Extension configuration
- Fixed small bugs and improved library stability
- CLI is updated: time measuring, printing specific fields, table/flow/packet output modes for printing events
- Apple Push Notification service classification
- Fixed small bugs and improved library stability
Benchmarks
On request.
- Hotline update: updating configuration for DC Engine without application stopping
- HTTP/2 protocol: implementation of dissection functionality of HTTP/2 protocol
- DTLS protocol: implementation of dissection functionality of DTLS protocol (Datagram Transport Layer Security)
- Performance optimization
- QUIC Cache extension is removed. The functionality are going to be re-implemented as session migration mechanism for TLS, DTLS, and QUIC protocols.
- Protocol Tree extension for printing protocol list of the packet
- HTTP/2 Field Block extension for decoding HTTP/2 headers
- HTTP Host extension is removed. Host Name extension is introduced. Host Name extension extracts hostname value from TLS, DTLS, HTTP/1.*, SSDP, and HTTP/2.0 protocols.
- Data Structure extension checks the payload structure (when protocol is undefined) what helps to detect some service patterns.
Benchmarks
On request.
- Partial matching for String/Bytesequence types
- "Try Dissect" protocol detection method implementation
- CLI: expression compiler (verifying tag expression without application launching)
Benchmarks
On request.
- Supported 17 protocols
- Tagging system
- Internal log system
- Extension mechanism (built-in and user extensions)
- DC Engine CLI
- Force tag extraction mode
- Configurable packet frame manager
- Configurable reassembler
- Internal and External flow table mode
- Benchmarks
Benchmarks
On request.
- Performance optimization
- Improve classification pipeline
- Update API to dissect only required protocol fields
- New 10 services for classification
Deadline: 31.05.2025
- Performance optimization
- Improve library stability
- New 10 services for classification
- Introduction of a tool for automatic updating of the signature and domain name database for the supported services
Deadline: 31.07.2025
- Workflow type classification (audio, video, file transfer, etc.)
Deadline: 31.11.2025
- User:Which version of the C++ standard is used in the DC Engine?Support:C++20
- User:Where can I find a list of supported protocols?Support:Documentation is available upon request. The list of protocols, services, and built-in extensions can be found on the product description page.
- User:Is it possible to configure network flow tagging rules?Support:Creating your own rules for tagging is one of the key features of our product.
- User:Is DC Engine an exclusively C++ solution?Support:Currently yes.
- User:What if the protocol I need is not in the supported list?Support:You can independently implement the extraction of the required fields through the extension mechanism. If for some reason this is not enough, then you can write to us and we will discuss adding the protocol you requested.
- User:What platforms are supported?Support:Unix-like, MacOS, Windows.
- User:What about performance?Support:Performance tests are carried out after each release. Therefore, they can be found on the release descriptions page.