diff options
| author | Campus <campus@ntop.org> | 2016-12-13 19:00:34 +0100 |
|---|---|---|
| committer | Campus <campus@ntop.org> | 2016-12-13 19:00:34 +0100 |
| commit | 8b1aa4a7bd5d9504b90df29cddb04da4985f3968 (patch) | |
| tree | 57eb88f79b2aae041bcd5dc77318ebaa689f8ad6 /src | |
| parent | b2b36be6cf23243b05b4f0271f6989be82be4dc6 (diff) | |
improved steam detection
Diffstat (limited to 'src')
| -rw-r--r-- | src/lib/ndpi_content_match.c.inc | 8 | ||||
| -rw-r--r-- | src/lib/protocols/http.c | 10 |
2 files changed, 17 insertions, 1 deletions
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 9e08f4a01..a06c2d8e0 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -7379,6 +7379,12 @@ static ndpi_network host_protocol_list[] = { */ { 0xC01EFC00 /* 192.30.252.0/22 */, 22, NDPI_SERVICE_GITHUB }, + /* + Steam + 162.254.192.0/21 + */ + { 0xA2FEC000 /* 162.254.192.0/21 */, 21, NDPI_PROTOCOL_STEAM }, + { 0x0, 0, 0 } }; @@ -7579,6 +7585,8 @@ ndpi_protocol_match host_match[] = { { ".1kxun.", "1kxun", NDPI_SERVICE_1KXUN, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "tcad.wedolook.com", "1kxun", NDPI_SERVICE_1KXUN, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, + { ".steampowered.com", "Steam", NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, + { NULL, 0 } }; diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c index dc17921bd..795a6e5b7 100644 --- a/src/lib/protocols/http.c +++ b/src/lib/protocols/http.c @@ -805,8 +805,16 @@ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct packet->http_method.ptr = packet->line[0].ptr; packet->http_method.len = filename_start - 1; - /* Check for additional field introduced by Facebook */ + /* Check for additional field introduced by Steam */ int x = 1; + if((memcmp(packet->line[x].ptr, "x-steam-sid", 11)) == 0) { + ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_STEAM); + check_content_type_and_change_protocol(ndpi_struct, flow); + return; + } + + /* Check for additional field introduced by Facebook */ + x = 1; while(packet->line[x].len != 0) { if((memcmp(packet->line[x].ptr, "X-FB-SIM-HNI", 12)) == 0) { ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_SERVICE_FACEBOOK); |