MMT-Probe Help

Provide general information about MMT-Probe, its architecture, capabilities, and troubleshooting guidance.

Triggers

Use this skill when the user asks:

• What is MMT-Probe / what can MMT do
• About the architecture or how it works
• About supported protocols or modules
• For troubleshooting help (errors, crashes, performance)
• About the MMT ecosystem
• General questions not covered by install/configure/operate skills

What is MMT-Probe

MMT-Probe is a C-based network traffic analysis probe developed by Montimage.

• Repository: https://github.com/montimage/mmt-probe
• Version: 1.6.x
• License: Apache License 2.0
• Language: C
• Platforms: Linux (Ubuntu, Debian, CentOS, Fedora), Docker

Capabilities

• Deep Packet Inspection (DPI) via MMT-DPI library
• Real-time and offline (PCAP) traffic analysis
• Protocol classification and application identification
• Session-based flow statistics with QoS metrics
• Security rule verification via MMT-Security
• Multi-output: files, Redis, Kafka, MongoDB, MQTT, sockets
• HTTP/FTP data reconstruction
• PCAP packet dumping by protocol
• Custom event and query-based reporting
• Dynamic runtime configuration via Unix socket
• LTE/5G mobile network analysis (eNodeB, GTP, QFI)

Architecture

MMT-Probe uses a 3-process model:

start =========== monitor proc ================>> end
       |\                            |  |
       | '======= processing proc ==='  |
       |                                |
       '========= control proc ========='

1. Monitor process (root): Creates and monitors children. Restarts a child if it crashes.
2. Processing process: Main packet processing. Reads traffic, performs DPI, generates reports.
3. Control process (optional): Listens on a Unix domain socket for runtime control commands. Requires DYNAMIC_CONFIG_MODULE.

Multi-threading

Within the processing process:

• thread-nb = 0: Single thread reads and processes packets
• thread-nb = 1: One thread reads, one thread processes
• thread-nb = N: One reader thread dispatches to N processing threads

Packets are dispatched to threads by flow (same flow always goes to same thread). If a thread's queue is full, the packet is dropped.

Module System

Modules are selected at compile time via make targets.

Compile with ALL_MODULES to enable everything (all dependencies must be installed).

Module dependencies

• HTTP_RECONSTRUCT_MODULE automatically enables TCP_REASSEMBLY_MODULE
• FTP_RECONSTRUCT_MODULE automatically enables TCP_REASSEMBLY_MODULE
• TCP_REASSEMBLY_MODULE requires enable-tcp-reassembly = true + enable-ip-defragmentation = true in config
• NETCONF_MODULE automatically enables DYNAMIC_CONFIG_MODULE
• DPDK_CAPTURE and STATIC_LINK cannot be used together

Supported Protocols

MMT-Probe identifies protocols via MMT-DPI. Categories include:

Link Layer

Ethernet, IEEE 802.15.4, Linux cooked capture, ARP, PPP

Network Layer

IPv4, IPv6, ICMP, ICMPv6, GRE, GTP

Transport Layer

TCP, UDP, SCTP

Application Layer

HTTP, HTTPS/SSL/TLS, DNS, FTP, SSH, SMTP, IMAP, POP3, RTP, RTSP, SIP, DHCP, NTP, SNMP, MQTT, CoAP, and 700+ application signatures (Facebook, YouTube, Netflix, etc.)

Telco/5G

S1AP, NGAP, NAS, GTP-U, GTP-C, PFCP, Diameter, RADIUS

Quick Reference

Stack Types

Report Format IDs

Output Formats

Session Sub-format IDs (within report 100)

Troubleshooting Guide

Compilation Errors

Runtime Errors

No Output

1. Check file-output.enable is true
2. Check file-output.output-dir exists and is writable
3. Check session-report.enable is true
4. For non-file channels, verify the channel is globally enabled
5. For offline mode, verify the PCAP file has traffic matching your config

Packet Drops

1. Check status reports (ID 200) for nic-lost and mmt-lost counts
2. Increase thread-nb to add processing threads
3. Increase thread-queue to buffer more packets per thread
4. Increase input.buffer-size for NIC-level buffering
5. Apply BPF filters to reduce packet volume
6. Consider DPDK mode for high-throughput scenarios

High Memory Usage

1. Reduce session-timeout values
2. Reduce output.cache-max
3. Enable micro-flows to aggregate small flows
4. Disable unused session sub-reports (HTTP, SSL, RTP, FTP, GTP)

MMT Ecosystem

Typical deployment

Network Traffic -> MMT-Probe -> [Kafka/Redis/Files] -> MMT-Operator (Web UI)
                      |
                  MMT-Security (rule engine)

Environment Variables

Build-Time

System Requirements

Cross-references

• To install MMT-Probe, use /mmt-install.
• To configure the probe, use /mmt-configure.
• To run and monitor the probe, use /mmt-operate.