[PATCH] BitTorrent detection not working properly

[GoogleCodeExporter]

Hi,

The attached patch fixes a problem with BitTorrent detection. The 1.0.1
code will enter detection stage 1 after the first packet analyzed in the
flow. However, the first packet in the flow generally corresponds to the
TCP handshake, without a payload. Even then, the code enters stage 1 and so
stage 0 analysis is never performed for that flow anymore.

The attached patch corrects this behavior by not entering stage 0 analysis
or bumping the detection stage to stage 1 unless there is a payload.

Running the vanilla OpenDPI demo on a pcap file created by downloading 5%
of a Ubuntu ISO with rTorrent shows 4054 unknown packets. After patching
and recompiling, there are only 154 unknown packets and 3907 packets were
recognized as BitTorrent traffic.

I unfortunately can't provide the pcap file because it contains sensitive
data. However, if you can't reproduce it, I might be able to filter out
that sensitive stuff out of the pcap and hand it to you guys.

The attached patch is in unified diff format and should apply cleanly
against bittorrent.c from the 1.0.1 release.

Original issue reported on code.google.com by fernando...@gmail.com on 9 Oct 2009 at 7:54

Attachments:

• bittorrent.c.patch

[GoogleCodeExporter]

I've been thinking, perhaps it would be better to modify the OpenDPI demo so 
that
only packets with a payload are processed? I don't think any of the protocols
actually do anything unless there is a payload, please correct me if I'm wrong.

Original comment by fernando...@gmail.com on 13 Oct 2009 at 12:27

[GoogleCodeExporter]

Original comment by martin.w...@ipoque.com on 5 Nov 2009 at 3:53

• Changed state: Started

[GoogleCodeExporter]

Original comment by martin.w...@ipoque.com on 1 Dec 2009 at 8:01

• Changed state: Fixed