diff options
| author | Ivan Nardi <12729895+IvanNardi@users.noreply.github.com> | 2024-05-09 21:18:18 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-05-09 21:18:18 +0200 |
| commit | d4650f0f817c8d1663284b7dd225df802104a60b (patch) | |
| tree | b89b00b37b9ad01212fa755e1f44d8d3e8b92eaf /src/lib/protocols/stun.c | |
| parent | e4fd6e47a323923cf320880c2dd3bb1d149c4fbe (diff) | |
Raknet/RTP: avoid Raknet false positives and harden RTP heuristic (#2427)
There is some overlap between RTP and Raknet detection: give precedence
to RTP logic.
Consequences:
* Raknet might require a little bit more packets for some flows (not a
big issue)
* some very small (1-2 pkts) Raknet flows are not classified (not sure
what do do about that..)
Diffstat (limited to 'src/lib/protocols/stun.c')
| -rw-r--r-- | src/lib/protocols/stun.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lib/protocols/stun.c b/src/lib/protocols/stun.c index 0cc0d1d80..d12a51843 100644 --- a/src/lib/protocols/stun.c +++ b/src/lib/protocols/stun.c @@ -789,7 +789,7 @@ static int stun_search_again(struct ndpi_detection_module_struct *ndpi_struct, NDPI_LOG_DBG(ndpi_struct, "QUIC range. Unexpected\n"); } else if(first_byte <= 191) { - rtp_rtcp = is_rtp_or_rtcp(ndpi_struct); + rtp_rtcp = is_rtp_or_rtcp(ndpi_struct, NULL); if(rtp_rtcp == IS_RTP) { NDPI_LOG_DBG(ndpi_struct, "RTP (dir %d)\n", packet->packet_direction); NDPI_LOG_INFO(ndpi_struct, "Found RTP over STUN\n"); |