From 72efa329db996a45f394457238b218252bae3e00 Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Tue, 31 May 2016 12:20:25 +0200 Subject: Enhanced fragments support in ndpiReader Improved RX protocol dissection and removed port guess as it caused false positives. --- src/lib/ndpi_main.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src/lib/ndpi_main.c') diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 2c4b491ed..fa32146a9 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -1532,8 +1532,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0); - ports_b[0].port_low = 7000; - ports_b[0].port_high = 7032; /* See https://www-01.ibm.com/support/docview.wss?uid=swg21044407 */ + /* Port guess is disabled as this is UDP and we can figure our immediately looking + at the RX header, is this is RX or not + + See https://www-01.ibm.com/support/docview.wss?uid=swg21044407 + */ ndpi_set_proto_defaults(ndpi_mod,NDPI_PROTOCOL_ACCEPTABLE,NDPI_PROTOCOL_RX, no_master, no_master, "RX", -- cgit v1.2.3