Skip to content

Commit

Permalink
ndpiReader: explicitly remove non ipv4/6 packets (#2601)
Browse files Browse the repository at this point in the history
  • Loading branch information
@IvanNardi
IvanNardi authored Oct 19, 2024
1 parent 5155611 commit 9021e08
Show file tree
Hide file tree
Showing 5 changed files with 358 additions and 355 deletions.
25 changes: 23 additions & 2 deletions example/reader_util.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2209,6 +2209,7 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
u_int16_t ip_offset = 0, ip_len;
u_int16_t frag_off = 0, vlan_id = 0;
u_int8_t proto = 0, recheck_type;
u_int8_t ip_ver, ppp_type;
/*u_int32_t label;*/

/* counters */
Expand Down Expand Up @@ -2277,7 +2278,13 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
type = ntohs(chdlc->proto_code);
} else {
ip_offset = eth_offset + 2;
type = ntohs(*((u_int16_t*)&packet[eth_offset]));
ppp_type = ntohs(*((u_int16_t*)&packet[eth_offset]));
if(ppp_type == 0x0021)
type = ETH_P_IP;
else if(ppp_type == 0x0057)
type = ETH_P_IPV6;
else
return(nproto);
}
break;

Expand Down Expand Up @@ -2371,6 +2378,15 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,

case DLT_RAW:
ip_offset = eth_offset;
/* Heuristic: no explicit field with next protocol */
ip_ver = (packet[ip_offset] & 0xF0) >> 4;
if(ip_ver == 4)
type = ETH_P_IP;
else if(ip_ver == 6)
type = ETH_P_IPV6;
else
return(nproto);

break;

case DLT_PPI:
Expand Down Expand Up @@ -2437,8 +2453,13 @@ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow,
recheck_type = 1;
break;

default:
case ETH_P_IP:
case ETH_P_IPV6:
/* Good let's keep decoding */
break;

default:
return(nproto);
}

if(recheck_type)
Expand Down
15 changes: 3 additions & 12 deletions tests/cfgs/default/result/ajp.pcap.out
View file
Original file line number Diff line number Diff line change
@@ -1,13 +1,11 @@
DPI Packets (TCP): 8 (4.00 pkts/flow)
DPI Packets (other): 6 (3.00 pkts/flow)
Confidence Unknown : 2 (flows)
Confidence DPI : 2 (flows)
Num dissector calls: 2 (0.50 diss/flow)
Num dissector calls: 2 (1.00 diss/flow)
LRU cache ookla: 0/0/0 (insert/search/found)
LRU cache bittorrent: 0/6/0 (insert/search/found)
LRU cache bittorrent: 0/0/0 (insert/search/found)
LRU cache stun: 0/0/0 (insert/search/found)
LRU cache tls_cert: 0/0/0 (insert/search/found)
LRU cache mining: 0/2/0 (insert/search/found)
LRU cache mining: 0/0/0 (insert/search/found)
LRU cache msteams: 0/0/0 (insert/search/found)
LRU cache fpc_dns: 0/2/0 (insert/search/found)
Automa host: 0/0 (search/found)
Expand All @@ -22,16 +20,9 @@ Patricia risk IPv6: 0/0 (search/found)
Patricia protocols: 4/0 (search/found)
Patricia protocols IPv6: 0/0 (search/found)

Unknown 6 2200 2
AJP 26 4446 2

Acceptable 26 4446 2
Unrated 6 2200 2

1 TCP 172.29.9.146:38856 <-> 172.29.9.147:8009 [VLAN: 7][proto: 139/AJP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][7 pkts/1554 bytes <-> 6 pkts/669 bytes][Goodput ratio: 68/36][0.17 sec][bytes ratio: 0.398 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 222/112 896/300 286/84][TCP Fingerprint: 40962_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (HTTP/1.1)][Plen Bins: 50,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 TCP 172.29.9.146:38856 <-> 172.29.9.147:8010 [VLAN: 7][proto: 139/AJP][IP: 0/Unknown][ClearText][Confidence: DPI][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][cat: Web/5][7 pkts/1554 bytes <-> 6 pkts/669 bytes][Goodput ratio: 68/36][< 1 sec][bytes ratio: 0.398 (Upload)][IAT c2s/s2c min/avg/max/stddev: 0/0 0/0 0/0 0/0][Pkt Len c2s/s2c min/avg/max/stddev: 70/70 222/112 896/300 286/84][TCP Fingerprint: 40962_64_14600_2e3cee914fc1/Unknown][PLAIN TEXT (HTTP/1.1)][Plen Bins: 50,0,0,0,0,0,0,33,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]


Undetected flows:
1 80 93.88.129.0:0 -> 0.7.8.0:0 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 4][4 pkts/2012 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][0.17 sec][PLAIN TEXT (HTTP/1.1)][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
2 80 142.243.129.0:0 -> 0.7.8.0:0 [proto: 0/Unknown][IP: 0/Unknown][ClearText][Confidence: Unknown][FPC: 0/Unknown, Confidence: Unknown][DPI packets: 2][2 pkts/188 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][0.17 sec][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]
Loading

0 comments on commit 9021e08

Please sign in to comment.