From 013212c67c2b9f9c227e1c0db0becea040af2b6b Mon Sep 17 00:00:00 2001
From: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
Date: Sun, 31 Jul 2022 16:57:17 +0200
Subject: TLS: avoid useless extra dissection (#1690)

If we have seen Application Data blocks in both directions, it means we
are after the handshake. At that point, extra dissection is useless.

Useful feature with TLS mid-sessions, i.e. sessions without initial
packets.
---
 tests/result/skype_no_unknown.pcap.out | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'tests/result/skype_no_unknown.pcap.out')

diff --git a/tests/result/skype_no_unknown.pcap.out b/tests/result/skype_no_unknown.pcap.out
index 8925ac38b..390261d2a 100644
--- a/tests/result/skype_no_unknown.pcap.out
+++ b/tests/result/skype_no_unknown.pcap.out
@@ -1,6 +1,6 @@
-Guessed flow protos:	72
+Guessed flow protos:	69
 
-DPI Packets (TCP):	1120	(14.74 pkts/flow)
+DPI Packets (TCP):	1080	(14.21 pkts/flow)
 DPI Packets (UDP):	288	(1.55 pkts/flow)
 DPI Packets (other):	5	(1.00 pkts/flow)
 Confidence Unknown          : 45 (flows)
-- 
cgit v1.2.3