From d80ea84d2ebebe29761f3727fbc5295ba3cb81b8 Mon Sep 17 00:00:00 2001 From: Toni Uhlig Date: Wed, 8 Nov 2023 01:27:42 +0100 Subject: Reset `Unidirectional Traffc` risk if packets from both directions processed. * Fixed risk hash value calculation, which was only done lower 32 bits. * Reduced default reader threads count to two if cross compiling. Signed-off-by: Toni Uhlig --- .../flow-info/default/ndpi_match_string_subprotocol__error.pcapng.out | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'test/results/flow-info/default/ndpi_match_string_subprotocol__error.pcapng.out') diff --git a/test/results/flow-info/default/ndpi_match_string_subprotocol__error.pcapng.out b/test/results/flow-info/default/ndpi_match_string_subprotocol__error.pcapng.out index 21e90f0ca..080276827 100644 --- a/test/results/flow-info/default/ndpi_match_string_subprotocol__error.pcapng.out +++ b/test/results/flow-info/default/ndpi_match_string_subprotocol__error.pcapng.out @@ -4,8 +4,10 @@ new: [.....1] [ip4][..tcp] [......10.3.9.19][40632] -> [..10.68.137.118][.8091] detected: [.....1] [ip4][..tcp] [......10.3.9.19][40632] -> [..10.68.137.118][.8091] [HTTP.SOAP][Unknown][RPC][Acceptable][10.68.137.118] RISK: Known Proto on Non Std Port, HTTP/TLS/QUIC Numeric Hostname/SNI, Unidirectional Traffic + detection-update: [.....1] [ip4][..tcp] [......10.3.9.19][40632] -> [..10.68.137.118][.8091] [HTTP.SOAP][Unknown][RPC][Acceptable][10.68.137.118] + RISK: Known Proto on Non Std Port, HTTP/TLS/QUIC Numeric Hostname/SNI DAEMON-EVENT: [Processed: 7 pkts][ZLib][compressions: 0|diff: 0 / 0] - DAEMON-EVENT: [Flows][active: 1 / 1|skipped: 0|!detected: 0|guessed: 0|detection-updates: 0|updates: 0] + DAEMON-EVENT: [Flows][active: 1 / 1|skipped: 0|!detected: 0|guessed: 0|detection-updates: 1|updates: 0] end: [.....1] [ip4][..tcp] [......10.3.9.19][40632] -> [..10.68.137.118][.8091] [HTTP.SOAP][Unknown][RPC][Acceptable] RISK: Known Proto on Non Std Port, HTTP/TLS/QUIC Numeric Hostname/SNI DAEMON-EVENT: shutdown -- cgit v1.2.3