diff options
| author | Luca <deri@ntop.org> | 2019-09-24 16:37:42 +0200 |
|---|---|---|
| committer | Luca <deri@ntop.org> | 2019-09-24 16:37:42 +0200 |
| commit | 0ed679e79584e6454d4e4f0015bdd68af6a50c30 (patch) | |
| tree | 23e784612b0b01ecbea9ab3dc0eed3adadbadfd6 /example/reader_util.c | |
| parent | 19dbcaa3a9653f1e910db332572dd86ba3963b46 (diff) | |
Improves IAT calculation
Diffstat (limited to 'example/reader_util.c')
| -rw-r--r-- | example/reader_util.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/example/reader_util.c b/example/reader_util.c index 82251e85d..51701d533 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -1,7 +1,7 @@ /* - * ndpi_util.c + * reader_util.c * - * Copyright (C) 2011-18 - ntop.org + * Copyright (C) 2011-19 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH @@ -1031,6 +1031,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, u_int16_t sport, dport, payload_len; u_int8_t *payload; u_int8_t src_to_dst_direction = 1; + u_int8_t begin_or_end_tcp = 0; struct ndpi_proto nproto = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; if(iph) @@ -1054,6 +1055,9 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, workflow->stats.total_ip_bytes += rawsize; ndpi_flow = flow->ndpi_flow; + if((tcph != NULL) && (tcph->fin || tcph->rst || tcph->syn)) + begin_or_end_tcp = 1; + if(flow->flow_last_pkt_time.tv_sec) { ndpi_timer_sub(&when, &flow->flow_last_pkt_time, &tdiff); @@ -1067,7 +1071,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, memcpy(&flow->flow_last_pkt_time, &when, sizeof(when)); if(src_to_dst_direction) { - if(flow->src2dst_last_pkt_time.tv_sec) { + if(flow->src2dst_last_pkt_time.tv_sec && (!begin_or_end_tcp)) { ndpi_timer_sub(&when, &flow->src2dst_last_pkt_time, &tdiff); if(flow->iat_c_to_s) { @@ -1082,7 +1086,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, flow->src2dst_l4_bytes += payload_len; memcpy(&flow->src2dst_last_pkt_time, &when, sizeof(when)); } else { - if(flow->dst2src_last_pkt_time.tv_sec) { + if(flow->dst2src_last_pkt_time.tv_sec && (!begin_or_end_tcp)) { ndpi_timer_sub(&when, &flow->dst2src_last_pkt_time, &tdiff); if(flow->iat_s_to_c) { |