From ca8ac946f48ab853f47b557ae643d36045d7ae95 Mon Sep 17 00:00:00 2001 From: lns Date: Sat, 4 Jun 2022 21:03:17 +0200 Subject: Fixed syslog false negatives. - RSH vs Syslog may still happen for midstream traffic Signed-off-by: lns --- src/lib/protocols/syslog.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'src/lib/protocols') diff --git a/src/lib/protocols/syslog.c b/src/lib/protocols/syslog.c index 866e0a0c0..1b072de07 100644 --- a/src/lib/protocols/syslog.c +++ b/src/lib/protocols/syslog.c @@ -73,7 +73,8 @@ void ndpi_search_syslog(struct ndpi_detection_module_struct if (ndpi_isalnum(packet->payload[i]) == 0) { if (packet->payload[i] == ' ' || packet->payload[i] == ':' || - packet->payload[i] == '=') + packet->payload[i] == '=' || packet->payload[i] == '[' || + packet->payload[i] == '-') { break; } -- cgit v1.2.3