summaryrefslogtreecommitdiff
path: root/nDPId.c
diff options
context:
space:
mode:
authorToni Uhlig <matzeton@googlemail.com>2022-01-25 11:16:41 +0100
committerToni Uhlig <matzeton@googlemail.com>2022-01-25 11:16:41 +0100
commit29a1b13e7ac8f20512b7a066c351bad614998f83 (patch)
treec4fa55710b91581ecf088c10d97ab62dae12f06b /nDPId.c
parent9e07a57566cc45bf92a845d8cee968d72e0f314e (diff)
Improved Plotly/Dash example. It is now somehow informative.
* TCP timeout after FIN/RST: switched back to the value from a35fc1d5ea8570609cc0c8cf6edadc81f8f5bb76 * py-flow-info: reset 'guessed' flag after detection/detection-update received Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'nDPId.c')
-rw-r--r--nDPId.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/nDPId.c b/nDPId.c
index 3320f5733..c4666c3ca 100644
--- a/nDPId.c
+++ b/nDPId.c
@@ -1540,12 +1540,13 @@ static uint64_t get_l4_protocol_idle_time(uint8_t l4_protocol)
static int is_l4_protocol_timed_out(struct nDPId_workflow const * const workflow,
struct nDPId_flow_basic const * const flow_basic)
{
+ uint64_t sdiff = flow_basic->last_seen % nDPId_options.flow_scan_interval;
uint64_t itime =
- get_l4_protocol_idle_time(flow_basic->l4_protocol) - (flow_basic->last_seen % nDPId_options.flow_scan_interval);
+ get_l4_protocol_idle_time(flow_basic->l4_protocol) - sdiff;
return (flow_basic->last_seen + itime <= workflow->last_time) ||
(flow_basic->tcp_fin_rst_seen == 1 &&
- flow_basic->last_seen + nDPId_options.tcp_max_post_end_flow_time <= workflow->last_time);
+ flow_basic->last_seen + nDPId_options.tcp_max_post_end_flow_time - sdiff <= workflow->last_time);
}
static int is_flow_update_required(struct nDPId_workflow const * const workflow,
@@ -3339,7 +3340,7 @@ static void ndpi_process_packet(uint8_t * const args,
struct nDPId_flow_basic * const flow_basic_to_process = *(struct nDPId_flow_basic **)tree_result;
/* Update last seen timestamp for timeout handling. */
flow_basic_to_process->last_seen = workflow->last_time;
- /* TCP-FIN: indicates that at least one side wants to end the connection. */
+ /* TCP-FIN/TCP-RST: indicates that at least one side wants to end the connection. */
if (flow_basic.tcp_fin_rst_seen != 0)
{
flow_basic_to_process->tcp_fin_rst_seen = 1;
@@ -4380,7 +4381,7 @@ int main(int argc, char ** argv)
sleep(1);
}
- if (nDPId_main_thread_shutdown == 1 && stop_reader_threads() != 0)
+ if (stop_reader_threads() != 0)
{
return 1;
}