Raknet/RTP: avoid Raknet false positives and harden RTP heuristic (#2427)

Browse source

There is some overlap between RTP and Raknet detection: give precedence
to RTP logic.
Consequences:
* Raknet might require a little bit more packets for some flows (not a
big issue)
* some very small (1-2 pkts) Raknet flows are not classified (not sure
what do do about that..)

...

This commit is contained in:

Ivan Nardi 2024-05-09 21:18:18 +02:00 • committed by GitHub

parent e4fd6e47a3

commit d4650f0f81

No known key found for this signature in database

GPG key ID: B5690EEEBB952194

8 changed files with 65 additions and 35 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

BIN

tests/cfgs/default/pcap/false_positives.pcapng

View file

Binary file not shown.