# nDPId Configuration for OpenWrt
# /etc/config/ndpid

config ndpid 'main'
	option enabled '0'
	option user 'nobody'
	option group 'nogroup'
	# Interfaces to monitor (space-separated list)
	list interface 'br-lan'
	# Collector endpoint: UNIX socket path or IP:port for TCP
	option collector '/var/run/ndpid/collector.sock'
	# Berkeley Packet Filter expression
	option bpf ''
	# Restrict capture to the interface's own traffic via an auto-generated BPF
	# filter (ether host <mac>). nDPId still opens the interface in promiscuous
	# mode at the pcap level, but only packets addressed to/from the interface
	# are passed to the DPI engine. Combined with any manual bpf option above.
	option no_promisc '1'
	# Decapsulate Layer4 tunnel protocols (GRE)
	option decode_tunnel '0'
	# Paths to libnDPI data files (leave empty to use built-in defaults)
	option riskdomains ''
	option protocols ''
	option categories ''
	option ja4 ''
	option sha1 ''
	# TLS certificates for TCP collector (required when using TLS)
	option cert_pem_file ''
	option key_pem_file ''
	option ca_pem_file ''
	# Instance identification
	option alias ''
	option uuid ''
	# Filter: process only internal (src->dst) connections
	option internal '0'
	# Filter: process only external (dst->src) connections
	option external '0'
	# Enable zLib compression of long-lasting flow memory
	option compression '1'
	# Enable analyse events for machine learning (uses more heap memory)
	option analysis '0'
	# Force poll() even on systems that support epoll()
	option poll '0'
	# Use PF_RING packet capture instead of libpcap
	option pfring '0'

config tuning 'tuning'
	option max_flows_per_thread '2048'
	option max_idle_flows_per_thread '64'
	option max_reader_threads '10'
	option daemon_status_interval '600000000'
	option compression_scan_interval '20000000'
	option compression_flow_inactivity '30000000'
	option flow_scan_interval '10000000'
	option generic_max_idle_time '600000000'
	option icmp_max_idle_time '120000000'
	option tcp_max_idle_time '180000000'
	option udp_max_idle_time '7440000000'
	option tcp_max_post_end_flow_time '120000000'
	option max_packets_per_flow_to_send '15'
	option max_packets_per_flow_to_process '32'
	option max_packets_per_flow_to_analyse '32'
	option error_event_threshold_n '16'
	option error_event_threshold_time '10000000'

config ndpi 'ndpi'
	option packets_limit_per_flow '32'
	option flow_direction_detection 'enable'
	option flow_track_payload 'disable'
	option tcp_ack_payload_heuristic 'disable'
	option fully_encrypted_heuristic 'enable'
	option libgcrypt_init '1'
	option dpi_compute_entropy '1'
	option fpc 'disable'
	option dpi_guess_on_giveup '0x03'
	option flow_risk_lists_load '1'
	option log_level '0'

config protos 'protos'
	option tls_cert_expire_threshold '7'
	option tls_app_blocks_tracking 'enable'
	option stun_max_packets_extra_dissection '8'

config ndpisrvd 'distributor'
	option enabled '0'
	# Listen socket for consumers
	option listen_socket '/var/run/ndpid/distributor.sock'
	# TCP listen port (0 = disabled)
	option tcp_port '7000'
	option tcp_address '127.0.0.1'
	# Max clients
	option max_clients '10'

config compat 'compat'
	# Enable Netifyd compatibility layer
	option enabled '0'
	# Output paths (Netifyd-compatible)
	option status_file '/var/run/netifyd/status.json'
	option flows_file '/tmp/ndpid-flows.json'
	# Update interval (seconds)
	option update_interval '1'

config actions 'actions'
	# Enable flow actions (ipset/nftables)
	option enabled '0'
	# BitTorrent detection
	option bittorrent_ipset 'secubox-bittorrent'
	option bittorrent_timeout '900'
	# Streaming services
	option streaming_ipset 'secubox-streaming'
	option streaming_timeout '1800'
	# Blocked categories
	option blocked_ipset 'secubox-blocked'
	option blocked_timeout '3600'
	# List of blocked applications
	list blocked_app 'bittorrent'
	list blocked_app 'tor'
