Raknet/RTP: avoid Raknet false positives and harden RTP heuristic

ntop / nDPI

Open Source Deep Packet Inspection Software Toolkit

http://www.ntop.org

GNU Lesser General Public License v3.0

3.86k stars 902 forks source link

Closed IvanNardi closed 6 months ago

IvanNardi commented 6 months ago

There is some overlap between RTP and Raknet detection: give precedence to RTP logic. Consequences:

Raknet might require a little bit more packets for some flows (not a big issue)
some very small (1-2 pkts) Raknet flows are not classified (not sure what do do about that..)

IvanNardi commented 6 months ago

Without this patch, the 2 flows in the new trace are classified as Protobuf, which seems wrong

sonarcloud[bot] commented 6 months ago