From 315f90f9828ddfa2e580f45afb1a3d6804bab923 Mon Sep 17 00:00:00 2001
From: Toni Uhlig <matzeton@googlemail.com>
Date: Fri, 8 Oct 2021 11:12:32 +0200
Subject: Fixed invalid "flow_last_seen" timestamp for the first packet.
* After the first packet was processed, "flow_last_seen" was still 0.
This behaviour is invalid as the first packet may contain l4 payload data e.g. for UDP
and it also breaks nDPId json consistency "flow_first_seen" > 0, but "flow_last_seen" == 0.
* JSON schema: set minimum timestamp value for Epoch timestamps to 24710 for flow_*_seen and
1 for pcap packet ts. Those values are dependant on some manipulated pcap's in libnDPI/tests/pcap.
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
---
schema/flow_event_schema.json | 6 ++++--
schema/packet_event_schema.json | 3 ++-
2 files changed, 6 insertions(+), 3 deletions(-)
(limited to 'schema')
diff --git a/schema/flow_event_schema.json b/schema/flow_event_schema.json
index 7fff85e8e..11c105879 100644
--- a/schema/flow_event_schema.json
+++ b/schema/flow_event_schema.json
@@ -68,10 +68,12 @@
"type": "number"
},
"flow_first_seen": {
- "type": "number"
+ "type": "number",
+ "minimum": 24710
},
"flow_last_seen": {
- "type": "number"
+ "type": "number",
+ "minimum": 24710
},
"flow_max_packets": {
"type": "number"
diff --git a/schema/packet_event_schema.json b/schema/packet_event_schema.json
index 6f722bf6f..abdeb7721 100644
--- a/schema/packet_event_schema.json
+++ b/schema/packet_event_schema.json
@@ -79,7 +79,8 @@
"type": "number"
},
"pkt_ts_sec": {
- "type": "number"
+ "type": "number",
+ "minimum": 1
},
"pkt": {
"type": "string"
--
cgit v1.2.3