{{indexmenu_n>85}}
======Version 14.0 Shooting Stars======
=====Changes in version 14.0=====
  - [BRAS] DHCP-Dual support. [[dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:dual_dhcp|Description]]
  - [BRAS] Support for L2TP termination. [[dpi:bras_bng:bras_pppoe|Description]]
  - [DPI]  Migration to DPDK 24.11, support for new NICs (Intel E830 200G, Intel E610, Napatech SmartNIC). [[dpi:dpi_brief:dpi_requirements|Description]]
  - [CLI] Added support for ''subs_id'' in commands: ''dhcp show'', ''dhcp reauth'', ''dhcp6 show'', ''dhcp6 reauth'', and ''dhcp disconnect''. [[dpi:bras_bng:cli:dhcp|Description]]
  - [DPI] New protocols added: AGORA_STREAMS(49314), AZAR_CALL(49315), WECHAT_CALL(49316), TEAMS_CALL(49317). [[dpi:dpi_options:protocols]]
  - [DPI] Improved support for LINE_CALL, VYKE_CALL protocols. [[dpi:dpi_options:protocols]]
  - [DPI] Fixed smartdrop behavior
  - [DPI] Added validation for complex protocols. [[dpi:dpi_options:protocols]]
  - [DPDK] Increased the maximum number of dispatchers to 32. [[dpi:dpi_components:platform:dpi_config|Description]]
  - [IPFIX/Netflow] Added the ability to change IPFIX/Netflow parameters without restarting fastDPI using the ''ipfix_reserved'' parameter. [[dpi:dpi_options:opt_statistics:statistics_ipfix|Description]]
  - [FastRadius] It is now possible to set both ''bind_ipv6_address'' and ''bind_ipv6_subnet''. If the Framed-IPv6-Prefix has a /128 mask, it is not checked against the ''bind_ipv6_subnet'' restriction. [[dpi:dpi_components:radius:radius_requirements#ipv6_support|Description]]
  - CLI command ''dev info'' now includes the name of the LAG that the port belongs to. [[dpi:bras_bng:cli:subs#dev_info|Description]]
  - [PCRF][PPP][Framed-pool] Added: DHCP option ''Client-Id'' now includes ''tunnel-IP'' as part of the subscriber ID. For more details, see sections [[dpi:bras_bng:ip_pool:ipv4]] and [[dpi:bras_bng:ip_pool:ipv6]]
  - [IPFIX] Message aggregation added for IPFIX streams: FullFlow/DNS/META/NAT
  - [IPFIX] Added parameter ''ipfix_mtu_limit'' to restrict maximum message size for IPFIX UDP packets. Description: [[dpi:dpi_options:opt_li:li_ipfix#clickstream_export_setup|ClickStream export Setup]], [[dpi:dpi_options:opt_statistics:statistics_ipfix]]
  - [IPFIX DNS] New elements added to IPFIX DNS: 224 (ipTotalLength) and 43823:3206 (DNS transaction id). [[dpi:dpi_options:opt_li:li_ipfix#configuring_the_export_of_dns_responses_or_dns_queries|Description]]
  - [VRRP] Fixed proper handling of the ''vrrp_enable'' option change
  - [BRAS][PPP] PPP session key is now compound: ''l2subs_id'' + ''tunnel-IP''. For PPPoE sessions, tunnel IP = 0. CLI commands that use ''subs_id'' as a key (''subs prop show'', ''l2tp show session'', ''l2tp term'', etc.) may now return multiple entries with the same ''l2subs_id''. [[dpi:bras_bng:bras_pppoe|Description]]
  - [DPI] Added cloud protocols with identifiers 55296..58367
  - [IPFIX] Fixed IPFIX exporter reinitialization bugs
  - [BRAS][subs_grooming] Fixed potential crash due to race condition during fastDPI shutdown
  - [CLI] Added commands to display mempool properties and statistics<code>
    hal mempool props
    hal mempool stat</code>DPDK must be built with statistics collection enabled to display mempool stats
  - [BRAS][DHCP] Fixed crash when parsing Framed-Pool Renew response if it contains no DHCP options
  - [PCRF][Acct] Fixed: Interim-Update sending is now disabled when ''Acct-Interim-Interval = 0'' is explicitly set in the RADIUS response. For more details, see sections  [[dpi:bras_bng:radius_integration:radius_auth_server_integration:radius_auth_response#acct-interim-interval|]], [[dpi:bras_bng:bras_pppoe:pppoe_pppol2tp_parameters:bras_pppoe_radius]]
  - [VASE_CLI] Created a unified CLI for managing DPI, BRAS, DHCP (KEA), ROUTER (BIRD) with support for authorization and command logging via TACACS (VEOS 8.x required). [[dpi:dpi_components:utilities:vase_cli|Description]]
  - [SNMP] Created a module for monitoring system components via SNMP
  - [DPI] Added DOQ 49318 protocol (DNS-over-QUIC)
  - [Router] Announcing subscriber white addresses for 1:1 NAT individually and after authentication. [[dpi:opt_cgnat:сgnat_settings|Description]]
  - [PCRF] Added support for service 19 "DNS spoofing", profile required. [[dpi:dpi_options:dns_substitution|Description]]
  - [DPDK] Added ''dpdk_engine=6'' (''mqrx-bridge'') — number of RSS dispatchers per bridge. [[dpi:dpi_components:platform:dpi_config#dpdk_engine_6rss_dispatchers_per_bridge|Description]]
  - [DPDK] Removed dedicated mempools. The fastdpi.conf option ''dpdk_emit_mempool_size'' is deprecated and no longer used.
  - [VLAN-Rule] Moved vlan group data from UDR to SDR. Global rules for vlan drop/pass/hide/permit set by the previous CLI command ''vlan group'' were converted and moved from UDR to SDR, with removal from UDR. [[dpi:dpi_components:platform:vlan_traffic_handling|Description]]
  - Up to version 14, only one built-in database UDR (User Data Repository) is used, intended for permanent storage of data about services, policings, and other FastDPI settings.\\ Starting from Version 14, UDR is split into UDR and SDR. The split occurs automatically during version update.\\ SDR (System Data Repository) is intended for storing FastDPI settings not related to subscribers. It can be considered that SDR is an extension of fastdpi.conf. No special activation of SDR is required — the necessary .mdb files are created automatically when the corresponding mode is enabled in fastdpi.conf.
  - [VLAN] VLAN rules — added CLI commands. [[dpi:dpi_components:platform:vlan_traffic_handling#vlan_rule|Description]]
  - [IPv6] Added direction detection in combined traffic (IN+OUT on one port) based on the local flag for IP addresses. Enabled via ''combined_io_direction_mode'' option
  - [BRAS] Fixed compatibility with the old format of service 18, where there were fewer protocols and both fields in the profile needed to be filled
  - [DPI] Lowered detection priority for ''telegram_tls''
  - [DPI] Improved detection of ''WECHAT'' and ''WECHAT_CALL''
  - [BRAS][Framed-Route] Fixed: possible crash when freeing memory
  - [BRAS] Refactored PCRF connectivity: in the new implementation, all connections are equal; an error on any triggers reconnection of all connections and a switch to another PCRF. Added CLI commands:
    - ''pcrf connect show'' — show current status and accumulated statistics for PCRF connections.
    - Force connection to the specified PCRF ''pcrf connect switch [<pcrf_index>]'', where ''<pcrf_indxed>'' is the index of the connection line in the ''auth_server'' parameter. If ''<pcrf_indxed>'' is not specified — defaults to 0.\\ [[dpi:bras_bng:radius_integration:radius_auth_fastpcrf_setup|Description]]
  - [IPFIX DNS] Added the ability to send DNS MX responses via IPFIX. Enabled by setting bit 3 (4) of the ''ajb_save_dns'' parameter. [[dpi:dpi_options:opt_li:li_ipfix#configuring_the_export_of_dns_responses_or_dns_queries|Description]]
  - [DPI] Added FakeTLS protocol (49319) with validation
  - [BRAS][DHCP] Changed: sliding window algorithm for rate limit
  - [BRAS] Fixed: time comparison error when loading ip_prop from UDR
  - [VLAN-Rule] Added support for 'any' instead of '*' when describing VLAN range. [[dpi:dpi_components:platform:vlan_traffic_handling#vlan_rule|Description]]
  - [DPI][LOG] Messages about insufficient SSL parsers are written to the slave log not for every event, but at a frequency of 1/50000.
  - [DPI] Added protocols ZALO_CALL(49320) and VK_CALL(49321)
  - [DPI] Fixed blocking in hard mode for SSL
  - [Acct] Added attribute ''VASExperts-Service-Type''. Radius acct start/interim/stop sends the authorization type in the ''VASExperts-Service-Type'' attribute. [[dpi:bras_bng:radius_integration:radius_accounting:radius_attr|Description]]
  - [CLI] Added: ''stat flow ip6'' command to display IPv6 flow statistics. [[dpi:bras_bng:cli:stat|Description]]
  - [CLI] Added: ''stat flow ip4'' command to display IPv4 flow statistics. Analogous to the output in ''fastdpi_stat.log''. [[dpi:bras_bng:cli:stat|Description]]
  - [IPFIX] Fixed ExportTime formation error in IPFIX Fullflow
  - [CLI] Added ''stat netflow'' command. Displays general statistics for Netflow/IPFIX (same as in ''fastdpi_stat.log'' under the "Statistics on NFLW_export" section). [[dpi:bras_bng:cli:stat|Description]]
  - [DNS] Added support for substitution/blocking/dropping of DNS requests A, AAAA, MX, HTTPS. [[dpi:dpi_options:dns_substitution|Description]]
  - [CLI] Added ''stat firewall'' command. [[dpi:bras_bng:cli:stat|Description]]
  - [DPI] Added BIGO_CDN protocol (49324)
  - [DPI] Added UDP support for BIGOTV
  - [PCRF][L2TP] Fixed: NAS attributes for L2TP during authorization
  - [BRAS][L2TP] Fixed: data race when closing sessions
  - [DPDK] Removed deprecated rx channels settings and related checks
  - [IPFIX] Added configurable sending of drop octets/packets counters when generating IPFIX fullflow. [[dpi:dpi_options:opt_statistics:statistics_ipfix|Description]]
  - [PCAP] Added capability to save traffic of a specified vlan using the ''ajb_save_vlan'' parameter. [[dpi:dpi_options:opt_li:li_settings#pcap_by_vlan|Description]]
  - [DPIUTILS] Updated checknat utility. [[dpi:dpi_components:utilities:management_utilities#checknat|Description]]
  - [DPIUTILS] Updated dns2dic utility with domain blocking support. [[dpi:dpi_options:dns_substitution|Description]]
  - [BRAS][L2TP] Fixed: data race during tunnel creation
  - [Router] Fixed: interception and diversion of IPv6 packets to tap interfaces. Link-local addresses were not diverted to tap, even if explicitly specified in the ''router.subnet6'' settings.
  - [BRAS][L2TP] Fixed: length field in L2TP header for data packets. According to RFC, the len field in L2TP header is optional for data packets. Some L2TP client implementations do not understand data packets with the len field in the L2TP header. This fix adjusts FastDPI's behavior: if data packets from the subscriber arrive without the len field, then SSG will also send data packets without this field. If data packets from the subscriber contain the len field, SSG will include it as well.
  - [BRAS] Fixed: sending commands from the ''pending_queue''. In some cases (e.g., during state transitions of the pcrf monitor ''initial -> connected''), sending commands from the ''pending_queue'' was not triggered, which caused commands to "hang" in the queue indefinitely (until reconnection due to a socket error).
  - Fixed a recently introduced error (affecting betas 4.6 and 4.7) in the session lifecycle that leads to resource exhaustion over time; an operational update from these versions (or rollback) is recommended.

=====Changes in version 14.1=====
===DPI===
  - [DPI][ajb_save_vlan] Fixed an error when the engine operates in read-only mode
  - [DPDK][tap_device] Fixed: setting the tx queue length using the ''dpdk_tx_queue_size'' option. Previously, the tx queue length of the TAP device was always set to 256, which caused errors on the VMware VMXNET3 Ethernet Controller: ETHDEV: Invalid value for nb_tx_desc(=256), should be: <= 4096, >= 512, and a product of 1
  - [LAG] Fixed: added load balancing for pass packets
  - [DPI][ip_node stg] Added statistics on bucket occupancy. The new CLI command ''stat storage ip4 detail'' outputs statistics on bucket filling in the IPv4 node storage
  - [DPI] Added validation for the MULTIPROXY_STRONG protocol
  - [DPI] Improved scalability on 128-core systems
  - [DPI][log] Improved the logging subsystem in cases of log file overflow
  - [DPI][tethering] Added tethering detection. The parameter ''tethering_ttl_allowed = 128:64'' [hot] defines the list of allowed TTL values for subscriber traffic that are not considered tethering. Values are separated by ':'. The number of values is up to 256 (0–255). [[dpi:dpi_options:opt_statistics:statistics_ipfix|Description]]

===BNG===
  - [BNG][framed-route] Fixed: Framed-Route delivery when a subscriber login is changed. Previously, when the login was changed, Framed-Route subnets remained attached to the old login, and all services and policing for Framed-Route subnets were taken from the old login.
  - [BNG] Added the ''bras_disable_l3_auth'' option — an explicit prohibition of L3 auth in L2 BNG mode for all subscribers. [[dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_proxy:bras_l2_vlan_dhcp_proxy_l3auth#global_disable_l3_authentication|Description]]
  - [BNG] Added a new subscriber flag — prohibition of L3 auth for a specific subscriber. This flag can be set or cleared only via CLI: a new parameter ''disable_l3_auth=[1:0]'' has been added to the ''subs prop set'' command. [[dpi:bras_bng:cli:subs#subs_prop_set|Description]]
  - [BNG][srcIP spoofing] Added filtering by source AS flags on the subs→inet path before packet processing to block operator-originated DDoS attacks with IP address spoofing. [[dpi:bras_bng:bras_l2_options:bras_l2_vlan_ipsg#filtering_by_source_as_flags|Description]]
  - [BNG][PPP] Added database session utilization statistics to the ''ppp show stat'' command. [[dpi:bras_bng:cli:pppoe#pppoe_show_stat|Description]]
  - [BNG][PCEF][Policing] Added configuration of common policing from parameters passed in the ''VasExperts-Policing-Profile'' attribute with the ''BR##'' prefix. [[dpi:bras_bng:radius_integration:radius_auth_server_integration:radius_auth_response#policing_with_absolute_value_transmission_extended_htb_format|Description]]
  - [BNG][PCEF][Services] Added configuration of a personal (''noname'') user profile for services from parameters passed in the ''VasExperts-Service-Profile'' attribute with the ''BP##'' prefix. [[dpi:bras_bng:radius_integration:radius_auth_server_integration:radius_auth_response#example_3_overriding_traffic_classes_and_policing|Description]]
  - [BNG][PCEF][rating-group] New options (cold, fastDPI restart required):
    * ''rating_group_count'' — number of rating groups, ''0'' — RG disabled. Default value: ''0''
    * ''rating_group_max_subs'' — maximum number of subscribers with RG. Default value: ''0'' (RG disabled)\\ [[dpi:bras_bng:radius_integration:radius_accounting#rating_group|Description]]
  - [BNG][PCEF][rating-group][RADIUS Accounting] Output of RG statistics in RADIUS Accounting. RG statistics are transmitted in separate Interim-Update packets. Only non-zero RG data are sent. [[dpi:bras_bng:radius_integration:radius_accounting#rating_group|Description]]
  - [BNG][PCEF][rating-group][CLI] Added the ''subs traffic stat'' CLI command. The command outputs billing statistics and rating group statistics for the specified subscriber, if enabled. [[dpi:bras_bng:cli:subs#subs_traffic_stat|Description]]
  - [BNG][PCEF][rating-group][RADIUS Accept] Added configuration of the RG service during authorization. RG statistics accumulation can be enabled only if service 9 (bill stat) is enabled for the subscriber. [[dpi:bras_bng:radius_integration:radius_accounting#rating_group|Description]]
  - [BNG][SHCV][hot] Added activity monitoring for static IP L2 subscribers (subscribers for whom RADIUS returned the ''VasExperts-L2-User=1'' flag during L3 authorization). [[dpi:bras_bng:bras_l2_options:subs_activity#monitoring_subscriber_activity_with_session_termination_subscriber_host_connectivity_verification|Description]]
  - [BNG][DHCP][hot] New values are available for the ''bras_dhcp_check_secondary_keys'' option: 2 (check only opt82) and 4 (check only QinQ). [[dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_proxy:bras_l2_vlan_dhcp_proxy_secondary_keys|Description]]
  - [BNG][L2TP] Fixed: crash when receiving a duplicate out-of-order ctl packet
  - [BNG][dhcp-relay] Added the ability to preserve the siaddr field value.\\ New flag in the ''bras_dhcp_server'' option: ''keep_siaddr=1'' — preserve the DHCP packet siaddr field. Example:<code bash>bras_dhcp_server=188.227.73.42%eth0;arp_proxy=1;reply_port=67;keep_siaddr=1</code> By default, the siaddr field may be modified to hide the real DHCP server address. [[dpi:bras_bng:bras_l2_vlan:bras_l2_vlan_dhcp:bras_l2_vlan_dhcp_relay#configuration|Description]]
  - [BNG][CLI] Added the ''subs db stat'' command to display L2 BNG database statistics. [[dpi:bras_bng:cli:subs#subs_db_stat|Description]]
  - [BNG][DHCP6] Fixed: crash when processing DHCPv6 with an invalid UDP header length

===NAT===
  - [CG-NAT] Added ''rx_dispatcher=3'' — a method with uniform load balancing across an arbitrary number of threads with support for NAT 1:1 and the requirement to assign specific addresses. [[dpi:opt_cgnat:сgnat_settings#parameters_and_possible_values|Description]]
  - [CG-NAT] Accounting of translation lifetime in the ''fdpi_ctrl list status --service 11 --login UserName (--ip IP)'' command. Additional fields were added to the command output: ''active_sess_tcp'' — number of active NAT translations for TCP and ''active_sess_udp'' — number of active NAT translations for UDP.\\ Translation activity is determined by the time of its last use and the lifetime parameter configured in the cluster options. [[dpi:opt_cgnat:cgnat_diagnostics#legend_for_the_nat_statistics_view_by_subscriber|Description]]
  - [CG-NAT][CLI] Accounting of translation lifetime in the ''nat show <internal_ip> [<lifetime>]'' command. Displays a list of all NAT translations for the specified gray IP. [[dpi:opt_cgnat:cgnat_diagnostics#list_of_nat_translations|Description]]

===CLI===
  - [CLI] Added the ''subs bind show'' command to view the list of IP addresses bound to the login ''<login>''. [[dpi:bras_bng:cli:subs#subs_bind_show|Description]]
  - [CLI] Added the ''stat http'' CLI command. This command outputs internal statistics similar to those in fastdpi_stat.log. [[dpi:bras_bng:cli:stat#stat_http|Description]]
  - [CLI] Fixed the ''list status --service 11'' (NAT) and ''nat show'' commands

===IPFIX===
  - [IPFIX] Storage of TTL information from the IP packet header. [[dpi:dpi_options:opt_statistics:statistics_ipfix#export_template_in_ipfix_format_netflow_v10_for_ipv4_protocol|Description]]\\ TTL statistics added to Full NetFlow in IPFIX format:
    * Packet TTL, id 192. The field is used for both directions: subs2inet and inet2subs
    * Rating group, id 2020
  - [IPFIX] Fixed an error in time conversion to unix format
  - [IPFIX] New 64-bit fields added to Full NetFlow IPFIX. [[dpi:dpi_options:opt_statistics:statistics_ipfix#export_template_in_ipfix_format_netflow_v10_for_ipv4_protocol|Description]]\\ ''service_flags'' — information about the tags assigned to the flow in DPI. Detected tethering is reported via IPFIX in bit 1 of the service_flags field. 63 bits are available for further use.\\ ''detection_flags'' — reserved for detection methods.\\ ''action_flags'' — reserved for transmitting actions applied to the flow.
  - [IPFIX] Fixed TTL transmission in Full NetFlow IPFIX in a single field with identifier 192 depending on direction. [[dpi:dpi_options:opt_statistics:statistics_ipfix#export_template_in_ipfix_format_netflow_v10_for_ipv4_protocol|Description]]

===Utilities===
  - [utils] Added the name2custom utility to view the list of protocols loaded from the cloud (as opposed to built-in ones)

===RADIUS===
  - [FastRADIUS] Added support for logging to syslog. New parameter ''syslog_level'' in fdpi_radius.conf — the level of logging messages from the alert log to syslog. ''0'' — syslog logging disabled (default). [[dpi:dpi_components:radius:radius_admin#syslog_logging_support|Description]]
  - [FastRADIUS] Added extraction of the 3GPP User Location Info RADIUS attribute and its export to IPFIX. [[dpi:dpi_components:radius:radmon_acct_ipfix|Description]]