From c09284ba276a3caf9dd4a8d9440e35e2808d5551 Mon Sep 17 00:00:00 2001 From: Luca Date: Thu, 29 Nov 2018 08:44:41 +0100 Subject: Improved heuristics Used the host guessed protocol if upper protocol has not been detected --- src/lib/protocols/skype.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'src/lib/protocols/skype.c') diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c index faeac17c5..0f5e8c780 100644 --- a/src/lib/protocols/skype.c +++ b/src/lib/protocols/skype.c @@ -72,7 +72,10 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s NDPI_EXCLUDE_PROTO(ndpi_struct, flow); return; // TCP check - } else if(packet->tcp != NULL) { + } else if((packet->tcp != NULL) + /* As the TCP skype heuristic is weak, we need to make sure no other protocols overlap */ + && (flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) + && (flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN)) { flow->l4.tcp.skype_packet_id++; if(flow->l4.tcp.skype_packet_id < 3) { -- cgit v1.2.3