From f91f2c57ef75bbb2206440edd6e2156731d6f56a Mon Sep 17 00:00:00 2001 From: Luca Deri Date: Wed, 20 Nov 2019 23:28:24 +0100 Subject: Fixed skype/soom false positives --- src/lib/protocols/skype.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'src/lib/protocols/skype.c') diff --git a/src/lib/protocols/skype.c b/src/lib/protocols/skype.c index e758fd5b8..ed76c66a1 100644 --- a/src/lib/protocols/skype.c +++ b/src/lib/protocols/skype.c @@ -55,8 +55,14 @@ static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, s ) { ; } else { - if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d)) || + /* Too many false positives */ + if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d)) + || ((payload_len >= 16) + && (((packet->payload[0] & 0xC0) >> 6) == 0x02 /* RTPv2 */ + || (((packet->payload[0] & 0xF0) >> 4) == 0 /* Zoom */) + || (((packet->payload[0] & 0xF0) >> 4) == 0x07 /* Skype */) + ) && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */ && (packet->payload[0] != 0x0) /* Avoid invalid CAPWAP detection */ && (packet->payload[2] == 0x02))) { -- cgit v1.2.3