diff options
| author | Toni Uhlig <matzeton@googlemail.com> | 2021-10-08 11:12:32 +0200 |
|---|---|---|
| committer | Toni Uhlig <matzeton@googlemail.com> | 2021-10-08 11:31:58 +0200 |
| commit | 315f90f9828ddfa2e580f45afb1a3d6804bab923 (patch) | |
| tree | 6433d64724d5988dbc9edca4fe933a35ac05e415 /nDPId.c | |
| parent | fe77c44e3f6e70e4dfa7c7aa4248f9964518d4f3 (diff) | |
Fixed invalid "flow_last_seen" timestamp for the first packet.
* After the first packet was processed, "flow_last_seen" was still 0.
This behaviour is invalid as the first packet may contain l4 payload data e.g. for UDP
and it also breaks nDPId json consistency "flow_first_seen" > 0, but "flow_last_seen" == 0.
* JSON schema: set minimum timestamp value for Epoch timestamps to 24710 for flow_*_seen and
1 for pcap packet ts. Those values are dependant on some manipulated pcap's in libnDPI/tests/pcap.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Diffstat (limited to 'nDPId.c')
| -rw-r--r-- | nDPId.c | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -2999,7 +2999,7 @@ static void ndpi_process_packet(uint8_t * const args, flow_to_process->flow_extended.total_l4_payload_len += l4_payload_len; if (flow_to_process->flow_extended.first_seen == 0) { - flow_to_process->flow_extended.first_seen = time_ms; + flow_to_process->flow_extended.first_seen = flow_to_process->flow_extended.flow_basic.last_seen = time_ms; } if (l4_payload_len > flow_to_process->flow_extended.max_l4_payload_len) { |