ntop / nDPI

Open Source Deep Packet Inspection Software Toolkit
http://www.ntop.org
GNU Lesser General Public License v3.0
3.85k stars 895 forks source link

Skype dissector gives false positive response on Omron FINS traffic #2158

Closed 0xA50C1A1 closed 11 months ago

0xA50C1A1 commented 12 months ago

Describe the bug

I'm trying to write an Omron FINS protocol dissector and for a while I couldn't figure out why it wasn't working as intended. This protocol can use either TCP or UDP, but incorrect detection only occurs when using UDP as a transport. At first I thought it was some kind of logical error in my code (I check almost all header fields to make sure there are no false positives), but then I looked into the skype dissector and saw a lot of kludges.

Expected behavior

Detection as OmronFINS if compiled with my dissector, or as Unknown if compiled without.

Omron FINS packet

Obtained behavior

Invalid detection caused by this

nDPI Environment (please complete the following information):

config.log

How to reproduce the reported bug

Reproducible using ndpiReader?

If applicable, the used ndpiReader options:

ndpiReader -i ~/omron.pcap

If your bug is reproducible using a pcap, please attach a pcap file (or a valid link to download it)

omron.zip

Steps to reproduce the behavior:

  1. Run 'ndpiReader -i omron.pcap'
  2. See false-positive detection as SkypeTeams_Call
IvanNardi commented 11 months ago

There are some issues with the Skype code... Since it seems that Omron protocol usually uses 9600 as port, you can add a quick workaround adding a new exception around line 52 of skype.c