vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-03 09:20:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Fixes #4268

Browse source
This commit is contained in:
Luca Deri 2020-08-14 15:07:44 +02:00
parent e04efa250e
commit 9d5192e63c
1 changed files with 18 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

24
scripts/plugins/udp_unidirectional/user_scripts/flow/udp_unidirectional.lua
View file

@ -28,15 +28,27 @@ local script = {
-- #################################################################
local function unidirectionalProtoWhitelist(proto_id)
if((proto_id == 17) -- Syslog
or (proto_id == 18) -- DHCP
or (proto_id == 87) -- RTP
or (proto_id == 103) -- DHCPV6
or (proto_id == 128) -- NetFlow
or (proto_id == 129) -- sFlow
) then
return(true)
end
return(false) -- Not whitelisted
end
-- #################################################################
function script.hooks.all(now)
if((flow.getPacketsRcvd() == 0) and (flow.getPacketsSent() > 0)) then
-- Now check if the recipient isn't a broadcast/multicast address
if(flow.isServerUnicast()) then
-- TODO some UDP protocols are inherently unidirectional (e.g. Netflow/sflow)
-- they should be excluded
flow.setStatus(flow_consts.status_types.status_udp_unidirectional,
5--[[ flow score]], 5--[[ cli score ]], 1--[[ srv score ]])
if(flow.isServerUnicast() and not(unidirectionalProtoWhitelist(flow.getnDPIAppProtoId()))) then
flow.setStatus(flow_consts.status_types.status_udp_unidirectional, 5--[[ flow score]], 5--[[ cli score ]], 1--[[ srv score ]])
end
else
flow.clearStatus(flow_consts.status_types.status_udp_unidirectional)