diff options
| author | Pavel Odintsov <pavel.odintsov@gmail.com> | 2015-07-29 14:19:32 +0300 |
|---|---|---|
| committer | Pavel Odintsov <pavel.odintsov@gmail.com> | 2015-07-29 14:19:32 +0300 |
| commit | 471ea815943089e8132840164386cd3e13e0dbbe (patch) | |
| tree | f5f8ff22a5e78c87af13478fb9787c9c2bba3f3f /src/lib/protocols/ntp.c | |
| parent | dc1d7bf47f6476401e4d23b17e0b29d6633a6e4f (diff) | |
Enhance NTP support, add protocol version identification; Add pcap examples for NTPv2, NTPv3, NTPv4; Fix bug with identification of NTP monlist packets as QUIC
Diffstat (limited to 'src/lib/protocols/ntp.c')
| -rw-r--r-- | src/lib/protocols/ntp.c | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/src/lib/protocols/ntp.c b/src/lib/protocols/ntp.c index 8a2a8aa25..233317a57 100644 --- a/src/lib/protocols/ntp.c +++ b/src/lib/protocols/ntp.c @@ -46,14 +46,23 @@ void ndpi_search_ntp_udp(struct ndpi_detection_module_struct *ndpi_struct, struc NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP port detected\n"); - if (packet->payload_packet_len != 48) - goto exclude_ntp; + // It's not correct because packets could be bigger + //if (packet->payload_packet_len != 48) + // goto exclude_ntp; NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP length detected\n"); if ((((packet->payload[0] & 0x38) >> 3) <= 4)) { NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "detected NTP."); + + // 38 in binary representation is 00111000 + flow->protos.ntp.version = (packet->payload[0] & 0x38) >> 3; + + if (flow->protos.ntp.version == 2) { + flow->protos.ntp.request_code = packet->payload[3]; + } + ndpi_int_ntp_add_connection(ndpi_struct, flow); return; } |