diff options
| author | deboracerretini <90244894+deboracerretini@users.noreply.github.com> | 2021-09-17 11:01:50 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-09-17 11:01:50 +0200 |
| commit | 8f113c1d379f30f469313c995941696760922330 (patch) | |
| tree | 5585e0db061134e2961cb8dd5d6199e15ddd8b3e /wireshark/ndpi.lua | |
| parent | 6325aebda6c583d8acb21e664ad805418bb4e747 (diff) | |
Progetto esame Gestione di Reti - Debora Cerretini (#1290)
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
* Add files via upload
Co-authored-by: Luca Deri <lucaderi@users.noreply.github.com>
Diffstat (limited to 'wireshark/ndpi.lua')
| -rw-r--r-- | wireshark/ndpi.lua | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/wireshark/ndpi.lua b/wireshark/ndpi.lua index d2737ac71..643dc3235 100644 --- a/wireshark/ndpi.lua +++ b/wireshark/ndpi.lua @@ -75,9 +75,11 @@ flow_risks[33] = ProtoField.bool("ndpi.flow_risk.suspicious_extension", "TLS sus flow_risks[34] = ProtoField.bool("ndpi.flow_risk.fatal_alert", "TLS fatal alert detected", num_bits_flow_risks, nil, bit(2), "nDPI Flow Risk: TLS fatal alert") flow_risks[35] = ProtoField.bool("ndpi.flow_risk.suspicious_entropy", "Suspicious entropy", num_bits_flow_risks, nil, bit(3), "nDPI Flow Risk: suspicious entropy") flow_risks[36] = ProtoField.bool("ndpi.flow_risk.clear_text_credentials", "Cleat-Text credentials", num_bits_flow_risks, nil, bit(3), "nDPI Flow Risk: cleat-text credentials") +flow_risks[37] = ProtoField.bool("ndpi.flow_risk.dns_large_packet", "DNS large packet", num_bits_flow_risks, nil, bit(4), "nDPI Flow Risk: DNS packet is larger than 512 bytes") +flow_risks[38] = ProtoField.bool("ndpi.flow_risk.dns_fragmented", "DNS fragmented", num_bits_flow_risks, nil, bit(5), "nDPI Flow Risk: DNS message is fragmented") -- Last one: keep in sync the bitmask when adding new risks!! -flow_risks[64] = ProtoField.new("Unused", "ndpi.flow_risk.unused", ftypes.UINT32, nil, base.HEX, bit(32) - bit(4)) +flow_risks[64] = ProtoField.new("Unused", "ndpi.flow_risk.unused", ftypes.UINT32, nil, base.HEX, bit(32) - bit(7)) for _,v in pairs(flow_risks) do ndpi_fds[#ndpi_fds + 1] = v |