diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2021-10-26 11:52:01 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2021-10-26 11:52:01 +0200 |
| commit | 2efb1a8084ad93dc715ff93419f0bc8b2ab6cc4d (patch) | |
| tree | a6078b9318786a7702eb00ba6e3170066fe89469 /src | |
| parent | 3ffb65a81c2e61650646d7382c8779f814993d0b (diff) | |
Added FastFlux risk.add/fast-flux-risk
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'src')
| -rw-r--r-- | src/include/ndpi_typedefs.h | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_main.c | 1 | ||||
| -rw-r--r-- | src/lib/ndpi_utils.c | 5 |
3 files changed, 6 insertions, 1 deletions
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 123c9edec..6ce36a123 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -118,6 +118,7 @@ typedef enum { NDPI_CLEAR_TEXT_CREDENTIALS, NDPI_DNS_LARGE_PACKET, NDPI_DNS_FRAGMENTED, + NDPI_DNS_FAST_FLUX, /* Leave this as last member */ NDPI_MAX_RISK /* must be <= 63 due to (**) */ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index d0ff8c486..6b54a70e2 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -106,6 +106,7 @@ static ndpi_risk_info ndpi_known_risks[] = { { NDPI_CLEAR_TEXT_CREDENTIALS, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, { NDPI_DNS_LARGE_PACKET, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, { NDPI_DNS_FRAGMENTED, NDPI_RISK_MEDIUM, CLIENT_FAIR_RISK_PERCENTAGE }, + { NDPI_DNS_FAST_FLUX, NDPI_RISK_HIGH, CLIENT_HIGH_RISK_PERCENTAGE }, /* Leave this as last member */ { NDPI_MAX_RISK, NDPI_RISK_LOW, CLIENT_FAIR_RISK_PERCENTAGE } diff --git a/src/lib/ndpi_utils.c b/src/lib/ndpi_utils.c index 9839d8863..cd0e9db8d 100644 --- a/src/lib/ndpi_utils.c +++ b/src/lib/ndpi_utils.c @@ -1791,7 +1791,10 @@ const char* ndpi_risk2str(ndpi_risk_enum risk) { case NDPI_DNS_FRAGMENTED: return("Fragmented DNS message"); - + + case NDPI_DNS_FAST_FLUX: + return("Possible Fast-Flux botnet"); + default: snprintf(buf, sizeof(buf), "%d", (int)risk); return(buf); |