Improve Ubiquiti device discovery request/response detection.improve/ubiquiti-device-discovery

Signed-off-by: Toni Uhlig <matzeton@googlemail.com>

3 files changed, 11 insertions, 8 deletions

diff --git a/src/lib/protocols/ubntac2.c b/src/lib/protocols/ubntac2.c
index 90e67b972..978587d07 100644
--- a/src/lib/protocols/ubntac2.c
+++ b/src/lib/protocols/ubntac2.c
@@ -43,8 +43,8 @@ static void ndpi_search_ubntac2(struct ndpi_detection_module_struct *ndpi_struct
 
   if(packet->payload_packet_len >= 4 &&
      (packet->udp->source == htons(10001) || packet->udp->dest == htons(10001)) &&
-     packet->payload[0] == 0x02 &&
-     packet->payload[1] == 0x06 &&
+     (ntohs(get_u_int16_t(packet->payload, 0)) == 0x0206 ||
+      ntohs(get_u_int16_t(packet->payload, 0)) == 0x0100 /* discovery request/reply */) &&
      (4 + ntohs(*(u_int16_t *)&packet->payload[2]) == packet->payload_packet_len)) {
     NDPI_LOG_INFO(ndpi_struct, "UBNT AirControl 2 request\n");
     ndpi_int_ubntac2_add_connection(ndpi_struct, flow);
diff --git a/tests/cfgs/default/pcap/ubntac2.pcap b/tests/cfgs/default/pcap/ubntac2.pcap
index 3141a9baf..964500c69 100644
--- a/tests/cfgs/default/pcap/ubntac2.pcap
+++ b/tests/cfgs/default/pcap/ubntac2.pcap
diff --git a/tests/cfgs/default/result/ubntac2.pcap.out b/tests/cfgs/default/result/ubntac2.pcap.out
index 92441ec91..e9ddd0318 100644
--- a/tests/cfgs/default/result/ubntac2.pcap.out
+++ b/tests/cfgs/default/result/ubntac2.pcap.out
@@ -1,7 +1,7 @@
 DPI Packets (TCP):	5	(5.00 pkts/flow)
-DPI Packets (UDP):	9	(1.00 pkts/flow)
-Confidence DPI              : 10 (flows)
-Num dissector calls: 23 (2.30 diss/flow)
+DPI Packets (UDP):	12	(1.00 pkts/flow)
+Confidence DPI              : 13 (flows)
+Num dissector calls: 26 (2.00 diss/flow)
 LRU cache ookla:      0/0/0 (insert/search/found)
 LRU cache bittorrent: 0/0/0 (insert/search/found)
 LRU cache stun:       0/0/0 (insert/search/found)
@@ -18,12 +18,12 @@ Patricia risk mask:   2/0 (search/found)
 Patricia risk mask IPv6: 0/0 (search/found)
 Patricia risk:        0/0 (search/found)
 Patricia risk IPv6:   0/0 (search/found)
-Patricia protocols:   20/0 (search/found)
+Patricia protocols:   26/0 (search/found)
 Patricia protocols IPv6: 0/0 (search/found)
 
-UBNTAC2	19	4039	10
+UBNTAC2	22	4514	13
 
-Safe                            19 4039          10           
+Safe                            22 4514          13           
 
 	1	TCP 192.168.1.138:35726 <-> 192.168.1.204:8080 [proto: 7.31/HTTP.UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 5][cat: Network/14][6 pkts/1559 bytes <-> 4 pkts/448 bytes][Goodput ratio: 78/49][0.02 sec][Hostname/SNI: 192.168.1.204][bytes ratio: 0.554 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/2 3/8 13/13 5/6][Pkt Len c2s/s2c min/avg/max/stddev: 54/54 260/112 1277/274 455/94][URL: 192.168.1.204:8080/inform][StatusCode: 200][Req Content-Type: application/x-binary][Content-Type: application/x-binary][User-Agent: AirControl Agent v1.0][Risk: ** Known Proto on Non Std Port **** HTTP/TLS/QUIC Numeric Hostname/SNI **][Risk Score: 60][Risk Info: Found host 192.168.1.204 / Expected on port 80][TCP Fingerprint: 2_64_29200_80d34a615d0a/Unknown][PLAIN TEXT (POST /inform HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,50,0,0,0,0,0,0,0,0,0]
 	2	UDP 192.168.1.138:60790 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/296 bytes -> 0 pkts/0 bytes][Goodput ratio: 86/0][< 1 sec][BZ.qca956x_6.6.77+15402.240813.0934][PLAIN TEXT (BZ.qca956)][Plen Bins: 0,0,0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
@@ -35,3 +35,6 @@ Safe                            19 4039          10
 	8	UDP 192.168.1.1:52220 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/217 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][UniFiSecurityGateway.ER-e120.v4.3.33.4936086.161203.2031][PLAIN TEXT (UniFiSecurityGateway.ER)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
 	9	UDP 192.168.1.1:55321 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/217 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][UniFiSecurityGateway.ER-e120.v4.3.33.4936086.161203.2031][PLAIN TEXT (UniFiSecurityGateway.ER)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
 	10	UDP 192.168.1.1:59772 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/217 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][UniFiSecurityGateway.ER-e120.v4.3.33.4936086.161203.2031][PLAIN TEXT (UniFiSecurityGateway.ER)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	11	UDP 192.168.178.61:10001 -> 192.168.178.176:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/215 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][UVC.S2L.v4.75.62.67.e71c6e5.250411.1421][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (Eingang)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	12	UDP 192.168.178.92:10001 -> 192.168.178.176:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/214 bytes -> 0 pkts/0 bytes][Goodput ratio: 80/0][< 1 sec][UVC.S2L.v4.75.62.67.e71c6e5.250411.1421][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][PLAIN TEXT (Garage)][Plen Bins: 0,0,0,0,0,100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
+	13	UDP 192.168.178.176:10001 -> 255.255.255.255:10001 [proto: 31/UBNTAC2][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 31/UBNTAC2, Confidence: DPI][DPI packets: 1][cat: Network/14][1 pkts/46 bytes -> 0 pkts/0 bytes][Goodput ratio: 9/0][< 1 sec][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]