diff options
Diffstat (limited to 'example/reader_util.c')
| -rw-r--r-- | example/reader_util.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/example/reader_util.c b/example/reader_util.c index a5c99a88b..2fdf14b35 100644 --- a/example/reader_util.c +++ b/example/reader_util.c @@ -1,7 +1,7 @@ /* - * ndpi_util.c + * reader_util.c * - * Copyright (C) 2011-18 - ntop.org + * Copyright (C) 2011-19 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH @@ -727,7 +727,12 @@ static struct ndpi_flow_info *get_ndpi_flow_info(struct ndpi_workflow * workflow flow.src_ip = iph->saddr, flow.dst_ip = iph->daddr; flow.src_port = htons(*sport), flow.dst_port = htons(*dport); flow.hashval = hashval = flow.protocol + flow.vlan_id + flow.src_ip + flow.dst_ip + flow.src_port + flow.dst_port; - /* printf("hashval=%u [%u][%u][%u:%u][%u:%u]\n", hashval, flow.protocol, flow.vlan_id, flow.src_ip, flow.src_port, flow.dst_ip, flow.dst_port); */ + +#if 0 + printf("hashval=%u [%u][%u][%u:%u][%u:%u]\n", hashval, flow.protocol, flow.vlan_id, + flow.src_ip, flow.src_port, flow.dst_ip, flow.dst_port); +#endif + idx = hashval % workflow->prefs.num_roots; ret = ndpi_tfind(&flow, &workflow->ndpi_flows_root[idx], ndpi_workflow_node_cmp); @@ -1040,6 +1045,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, u_int16_t sport, dport, payload_len; u_int8_t *payload; u_int8_t src_to_dst_direction = 1; + u_int8_t begin_or_end_tcp = 0; struct ndpi_proto nproto = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; if(iph) @@ -1063,6 +1069,9 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, workflow->stats.total_ip_bytes += rawsize; ndpi_flow = flow->ndpi_flow; + if((tcph != NULL) && (tcph->fin || tcph->rst || tcph->syn)) + begin_or_end_tcp = 1; + if(flow->flow_last_pkt_time.tv_sec) { ndpi_timer_sub(&when, &flow->flow_last_pkt_time, &tdiff); @@ -1076,7 +1085,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, memcpy(&flow->flow_last_pkt_time, &when, sizeof(when)); if(src_to_dst_direction) { - if(flow->src2dst_last_pkt_time.tv_sec) { + if(flow->src2dst_last_pkt_time.tv_sec && (!begin_or_end_tcp)) { ndpi_timer_sub(&when, &flow->src2dst_last_pkt_time, &tdiff); if(flow->iat_c_to_s) { @@ -1091,7 +1100,7 @@ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, flow->src2dst_l4_bytes += payload_len; memcpy(&flow->src2dst_last_pkt_time, &when, sizeof(when)); } else { - if(flow->dst2src_last_pkt_time.tv_sec) { + if(flow->dst2src_last_pkt_time.tv_sec && (!begin_or_end_tcp)) { ndpi_timer_sub(&when, &flow->dst2src_last_pkt_time, &tdiff); if(flow->iat_s_to_c) { |