From fa79f07d1552490a2dc0710059d56d3bb4b1efbe Mon Sep 17 00:00:00 2001 From: Toni Date: Tue, 19 Apr 2022 17:46:40 +0200 Subject: Improved sflow protocol detection false-positives. (#1518) Signed-off-by: lns --- src/lib/protocols/sflow.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/lib/protocols/sflow.c b/src/lib/protocols/sflow.c index 7151e6ad7..cf0b9fcad 100644 --- a/src/lib/protocols/sflow.c +++ b/src/lib/protocols/sflow.c @@ -35,10 +35,19 @@ void ndpi_search_sflow(struct ndpi_detection_module_struct *ndpi_struct, struct if((packet->udp != NULL) && (payload_len >= 24) /* Version */ - && (packet->payload[0] == 0) && (packet->payload[1] == 0) && (packet->payload[2] == 0) - && ((packet->payload[3] == 2) || (packet->payload[3] == 5))) { - NDPI_LOG_INFO(ndpi_struct, "found sflow\n"); - ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SFLOW, NDPI_PROTOCOL_UNKNOWN, NDPI_CONFIDENCE_DPI); + && ntohl(get_u_int32_t(packet->payload, 0)) == 0x00000005 + /* Agent Address type: IPv4 / IPv6 */ + && (ntohl(get_u_int32_t(packet->payload, 4)) == 0x00000001 || + ntohl(get_u_int32_t(packet->payload, 4)) == 0x00000002)) { + NDPI_LOG_INFO(ndpi_struct, "found (probably) sflow\n"); + if (flow->packet_counter >= 2) + { + NDPI_LOG_INFO(ndpi_struct, "found sflow\n"); + ndpi_set_detected_protocol(ndpi_struct, flow, + NDPI_PROTOCOL_SFLOW, + NDPI_PROTOCOL_UNKNOWN, + NDPI_CONFIDENCE_DPI); + } return; } -- cgit v1.2.3