Ivan Nardi 2a596c79e6

HTTP: fix classification (#1692) ...

If we have a valid HTTP sessions, we should ignore
`flow->guessed_protocol_id` field (i.e. classification "by-port")
altogheter.

The attached trace was classified as "SIP/HTTP" only because the *client*
port was 5060...
As a general rule, having a classification such as "XXXX/HTTP" is
*extremely* suspicious.

2022-07-30 22:57:20 +02:00

2 KiB

Raw History

View raw