diff options
| author | Luca Deri <deri@ntop.org> | 2021-07-22 01:35:57 +0200 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2021-07-22 01:35:57 +0200 |
| commit | b01b60a2b523b98f2801c4752213b9468f63cad5 (patch) | |
| tree | 7b134b1896e0d69be4514f828f8c294b98040cf6 /example | |
| parent | fc9901292d617f1ecd38f37d063d5f046978c1aa (diff) | |
Implementation of flow risk eception (work in progress)
Diffstat (limited to 'example')
| -rw-r--r-- | example/protos.txt | 12 | ||||
| -rw-r--r-- | example/reader_util.c | 7 |
2 files changed, 17 insertions, 2 deletions
diff --git a/example/protos.txt b/example/protos.txt index d82860631..de3a8f1de 100644 --- a/example/protos.txt +++ b/example/protos.txt @@ -39,3 +39,15 @@ ip:213.75.170.11/32:443@CustomProtocol ip:8.248.73.247:443@AmazonPrime ip:54.80.47.130@AmazonPrime +# +# Risk Exceptions +# +# ip_risk_mask: used to mask flow risks for IP addresses +# host_risk_mask: used to mask exceptions for domain names and hosts +# +# Syntax: <name>=<64 bit mask to be put in AND with the risk +# +# For IPs, the flow risk is put in AND (source IP mask OR destination IP mask) +# For Flows with a hostname (e.g. TLS) the risk is also put in AND with the host_risk_mask +ip_risk_mask:192.168.1.6=0 +host_risk_mask:"api-global.netflix.com"=0 diff --git a/example/reader_util.c b/example/reader_util.c index 89a3fcfff..e53cb3f3b 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -1297,6 +1297,7 @@ void update_tcp_flags_count(struct ndpi_flow_info* flow, struct ndpi_tcphdr* tcp } /* ****************************************************** */ + /** Function to process the packet: determine the flow of a packet and try to decode it @@ -1567,11 +1568,13 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, #endif *flow_risk = flow->risk; + return(flow->detected_protocol); } -int ndpi_is_datalink_supported(int datalink_type) -{ +/* ****************************************************** */ + +int ndpi_is_datalink_supported(int datalink_type) { /* Keep in sync with the similar switch in ndpi_workflow_process_packet */ switch(datalink_type) { case DLT_NULL: |