From d72a40a0fc1e1711094224dc8c4e33c490f4d3cf Mon Sep 17 00:00:00 2001
From: Luca Deri <deri@ntop.org>
Date: Sun, 26 Dec 2021 19:41:35 +0100
Subject: Improved BitTorrent guess

---
 src/lib/ndpi_main.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'src/lib/ndpi_main.c')

diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 84c32d79b..3529e9f11 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -6534,6 +6534,16 @@ ndpi_protocol ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct
       }
     }
 
+    if((flow != NULL)
+       && ndpi_search_into_bittorrent_cache(ndpi_str, flow,
+					    flow->saddr, flow->sport,
+					    flow->daddr, flow->dport)) {
+      /* This looks like BitTorrent */
+      ret.app_protocol = NDPI_PROTOCOL_BITTORRENT;
+      ret.category = ndpi_get_proto_category(ndpi_str, ret);
+      return(ret);
+    }
+
   check_guessed_skype:
     addr.s_addr = htonl(shost);
     if(ndpi_network_ptree_match(ndpi_str, &addr) == NDPI_PROTOCOL_SKYPE_TEAMS) {
-- 
cgit v1.2.3