diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2023-06-21 09:16:20 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2023-06-21 09:16:20 +0200 |
| commit | 3608ab01b61bde1b7ac88baa448fe37724a313db (patch) | |
| tree | 6e3223c4908f82bf057c0d2477c2780baf9fc8b6 /src/lib/protocols/rtp.c | |
| parent | 04be3080921507b69899d01bc79be86181e6f536 (diff) | |
STUN: keep monitoring/processing STUN flows (#2012)
Look for RTP packets in the STUN sessions.
TODO: tell RTP from RTCP
Diffstat (limited to 'src/lib/protocols/rtp.c')
| -rw-r--r-- | src/lib/protocols/rtp.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/src/lib/protocols/rtp.c b/src/lib/protocols/rtp.c index 093e509af..3ac7f83cb 100644 --- a/src/lib/protocols/rtp.c +++ b/src/lib/protocols/rtp.c @@ -179,7 +179,6 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct, if((payload_len < 2) || (d_port == 5355 /* LLMNR_PORT */) || (d_port == 5353 /* MDNS_PORT */) - || flow->stun.num_binding_requests ) { NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; @@ -237,12 +236,21 @@ static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct, /* It seems that it is a LINE stuff; let its dissector to evaluate */ return; } else { - NDPI_LOG_INFO(ndpi_struct, "Found RTP\n"); - isValidMSRTPType(payload_type, &flow->protos.rtp.stream_type); - ndpi_set_detected_protocol(ndpi_struct, flow, - NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_RTP, - NDPI_CONFIDENCE_DPI); + + /* Previous pkts were STUN */ + if(flow->stun.num_binding_requests > 0 || + flow->stun.num_processed_pkts > 0) { + NDPI_LOG_INFO(ndpi_struct, "Found RTP (previous traffic was STUN)\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_RTP, NDPI_PROTOCOL_STUN, + NDPI_CONFIDENCE_DPI); + } else { + NDPI_LOG_INFO(ndpi_struct, "Found RTP\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_RTP, + NDPI_CONFIDENCE_DPI); + } return; } } |