diff --git a/include/Flow.h b/include/Flow.h index 3eab8f0cf2..f5595f4f1b 100644 --- a/include/Flow.h +++ b/include/Flow.h @@ -214,7 +214,7 @@ class Flow : public GenericHashEntry { bool checkTor(char *hostname); void setBittorrentHash(char *hash); bool isLowGoodput(); - static void updatePacketStats(InterarrivalStats *stats, const struct timeval *when); + static void updatePacketStats(InterarrivalStats *stats, const struct timeval *when, bool update_iat); void dumpPacketStats(lua_State* vm, bool cli2srv_direction); bool isReadyToBeMarkedAsIdle(); bool isBlacklistedFlow() const; @@ -331,7 +331,7 @@ class Flow : public GenericHashEntry { void incStats(bool cli2srv_direction, u_int pkt_len, u_int8_t *payload, u_int payload_len, u_int8_t l4_proto, u_int8_t is_fragment, - const struct timeval *when); + u_int16_t tcp_flags, const struct timeval *when); void addFlowStats(bool cli2srv_direction, u_int in_pkts, u_int in_bytes, u_int in_goodput_bytes, u_int out_pkts, u_int out_bytes, u_int out_goodput_bytes, u_int in_fragments, u_int out_fragments, time_t last_seen); diff --git a/include/InterarrivalStats.h b/include/InterarrivalStats.h index ea0555ca8e..815df5e1b8 100644 --- a/include/InterarrivalStats.h +++ b/include/InterarrivalStats.h @@ -32,7 +32,7 @@ private: public: InterarrivalStats(); - void updatePacketStats(struct timeval *when); + void updatePacketStats(struct timeval *when, bool update_iat); inline u_int32_t getMin() { return(ndpi_data_min(&delta_ms)); } inline u_int32_t getMax() { return(ndpi_data_max(&delta_ms)); } diff --git a/src/Flow.cpp b/src/Flow.cpp index ec8f14d2db..0338f79417 100644 --- a/src/Flow.cpp +++ b/src/Flow.cpp @@ -2627,9 +2627,10 @@ bool Flow::update_partial_traffic_stats_db_dump() { /* *************************************** */ -void Flow::updatePacketStats(InterarrivalStats *stats, const struct timeval *when) { +void Flow::updatePacketStats(InterarrivalStats *stats, + const struct timeval *when, bool update_iat) { if(stats) - stats->updatePacketStats((struct timeval*)when); + stats->updatePacketStats((struct timeval*)when, update_iat); } /* *************************************** */ @@ -2690,11 +2691,20 @@ bool Flow::isSSLProto() { void Flow::incStats(bool cli2srv_direction, u_int pkt_len, u_int8_t *payload, u_int payload_len, u_int8_t l4_proto, u_int8_t is_fragment, - const struct timeval *when) { + u_int16_t tcp_flags, const struct timeval *when) { + bool update_iat = true; + payload_len *= iface->getScalingFactor(); - updateSeen(); - updatePacketStats(cli2srv_direction ? getCli2SrvIATStats() : getSrv2CliIATStats(), when); + + /* + Do not update IAT during initial or final 3WH as we want to compute + it only on the main traffic flow and not on connection or tear-down + */ + if((l4_proto == IPPROTO_TCP) && (tcp_flags & (TH_SYN|TH_FIN|TH_RST))) + update_iat = false; + + updatePacketStats(cli2srv_direction ? getCli2SrvIATStats() : getSrv2CliIATStats(), when, update_iat); if(cli2srv_direction) { stats.cli2srv_packets++, stats.cli2srv_bytes += pkt_len, stats.cli2srv_goodput_bytes += payload_len, ip_stats_s2d.pktFrag += is_fragment; diff --git a/src/InterarrivalStats.cpp b/src/InterarrivalStats.cpp index 83bdbe59ba..5b38216a3b 100644 --- a/src/InterarrivalStats.cpp +++ b/src/InterarrivalStats.cpp @@ -28,10 +28,11 @@ InterarrivalStats::InterarrivalStats() { /* ******************************************** */ -void InterarrivalStats::updatePacketStats(struct timeval* when) { - if(lastTime.tv_sec) { +void InterarrivalStats::updatePacketStats(struct timeval* when, + bool update_iat) { + if(update_iat && lastTime.tv_sec) { float deltaMS = Utils::msTimevalDiff(when, &lastTime); - + if(deltaMS > 0) ndpi_data_add_value(&delta_ms, (u_int32_t)deltaMS); } diff --git a/src/NetworkInterface.cpp b/src/NetworkInterface.cpp index 7b3ea448e7..abaeb5bdbb 100644 --- a/src/NetworkInterface.cpp +++ b/src/NetworkInterface.cpp @@ -1448,7 +1448,6 @@ bool NetworkInterface::processPacket(u_int32_t bridge_iface_idx, *hostFlow = NULL; if(!isDynamicInterface()) { - #ifdef NTOPNG_PRO #ifndef HAVE_NEDGE /* Custom disaggregation */ @@ -1753,11 +1752,17 @@ bool NetworkInterface::processPacket(u_int32_t bridge_iface_idx, #ifndef HAVE_NEDGE #ifdef __OpenBSD__ struct timeval tv_ts; + tv_ts.tv_sec = h->ts.tv_sec; tv_ts.tv_usec = h->ts.tv_usec; - flow->incStats(src2dst_direction, len_on_wire, payload, trusted_payload_len, l4_proto, is_fragment, &tv_ts); + + flow->incStats(src2dst_direction, len_on_wire, payload, + trusted_payload_len, l4_proto, is_fragment, + tcp_flags, &tv_ts); #else - flow->incStats(src2dst_direction, len_on_wire, payload, trusted_payload_len, l4_proto, is_fragment, &h->ts); + flow->incStats(src2dst_direction, len_on_wire, payload, + trusted_payload_len, l4_proto, is_fragment, + tcp_flags, &h->ts); #endif #endif }