diff options
| author | Luca Deri <deri@ntop.org> | 2021-02-09 21:26:48 +0100 |
|---|---|---|
| committer | Luca Deri <deri@ntop.org> | 2021-02-09 21:27:09 +0100 |
| commit | 512f73f3817bbeeea06217d9250887d11446e9bf (patch) | |
| tree | 08498910583273836b4dc3f8598878d8344c3bdf /src/lib/protocols/irc.c | |
| parent | 1a557d091845783429b0a3fb7320ad4f2e40edba (diff) | |
Added checks for giving up faster on IRC and SMTP
Diffstat (limited to 'src/lib/protocols/irc.c')
| -rw-r--r-- | src/lib/protocols/irc.c | 12 |
1 files changed, 3 insertions, 9 deletions
diff --git a/src/lib/protocols/irc.c b/src/lib/protocols/irc.c index c89960bfd..d8b6766bc 100644 --- a/src/lib/protocols/irc.c +++ b/src/lib/protocols/irc.c @@ -386,17 +386,12 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc u_int8_t space = 0; NDPI_LOG_DBG(ndpi_struct, "search irc\n"); - if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter > 70) { + if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && (flow->packet_counter > 10)) { NDPI_LOG_DBG(ndpi_struct, "exclude irc, packet_counter > 70\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IRC); return; } - if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter > 30 && - flow->l4.tcp.irc_stage2 == 0) { - NDPI_LOG_DBG(ndpi_struct, "exclude irc, packet_counter > 30\n"); - NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IRC); - return; - } + if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_IRC) { if (src != NULL && ((u_int32_t) (packet->current_time_ms - src->irc_ts) < ndpi_struct->irc_timeout)) { @@ -444,8 +439,6 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc } } - - if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter == 2 && (packet->payload_packet_len > 400 && packet->payload_packet_len < 1381)) { for (c1 = 50; c1 < packet->payload_packet_len - 23; c1++) { @@ -475,6 +468,7 @@ void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struc } } } + if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(ndpi_struct, flow) != 0) { return; |