From 0109014f2c640106bd970dc7559fb0f15cc51271 Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Tue, 21 May 2024 12:47:25 +0200
Subject: Follow-up of 2093ac5bf (#2451)

---
 src/lib/protocols/sip.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'src/lib/protocols/sip.c')

diff --git a/src/lib/protocols/sip.c b/src/lib/protocols/sip.c
index 23a88ebf8..670933167 100644
--- a/src/lib/protocols/sip.c
+++ b/src/lib/protocols/sip.c
@@ -69,6 +69,12 @@ void ndpi_search_sip(struct ndpi_detection_module_struct *ndpi_struct, struct nd
     }
   }
 
+  if(payload_len == 5 && memcmp(packet_payload, "hello", 5) == 0) {
+    NDPI_LOG_INFO(ndpi_struct, "found sip via HELLO (kind of ping)\n");
+    ndpi_int_sip_add_connection(ndpi_struct, flow);
+    return;
+  }
+
   if(payload_len >= 14) {    
     if((memcmp(packet_payload, "NOTIFY ", 7) == 0 || memcmp(packet_payload, "notify ", 7) == 0)
        && (memcmp(&packet_payload[7], "SIP:", 4) == 0 || memcmp(&packet_payload[7], "sip:", 4) == 0)) {
-- 
cgit v1.2.3