vrr/ntopng
2
0
Fork 0
mirror of https://github.com/ntop/ntopng.git synced 2026-05-05 19:15:03 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Fixed suricata README

Browse source 
Tiny flow change to avoid false positives when the application protocol is not NULL
This commit is contained in:
Luca Deri 2019-04-10 11:46:27 +02:00
parent faf8819a9d
commit dcbd42ae1f
2 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
doc/README.suricata
View file

@ -22,7 +22,7 @@ specifying the IP and port where ntopng will listen for connections. This
can be configured by creating a new under /etc/rsyslog.d. Example:
cat /etc/rsyslog.d/99-remote.conf
*.* action(type="omfwd" target="192.168.2.222" port="9999" protocol="tcp" action.resumeRetryCount="100" queue.type="linkedList" queue.size="10000”)
*.* action(type="omfwd" target="127.0.0.1" port="9999" protocol="tcp" action.resumeRetryCount="100" queue.type="linkedList" queue.size="10000")
Please restart the rsyslog service in order to apply the configuration:
@ -31,7 +31,7 @@ Please restart the rsyslog service in order to apply the configuration:
3. ntopng needs to be configured using '-i syslog://<ip>:<port>' as interface name
to listen for connections on the specified <ip> and <port>. Example:
ntopng -i syslog://192.168.2.222:9999
ntopng -i syslog://127.0.0.1:9999
Note: multiple simultaneous clients (rsyslog) are supported.

4
include/Flow.h
View file

@ -192,7 +192,9 @@ class Flow : public GenericHashEntry {
(srv_host->getDeviceAllowedProtocolStatus(ndpiDetectedProtocol, false) == device_proto_allowed)));
}
char* printTCPflags(u_int8_t flags, char * const buf, u_int buf_len) const;
inline bool isProto(u_int16_t p ) const { return((ndpi_get_lower_proto(ndpiDetectedProtocol) == p) ? true : false); }
inline bool isProto(u_int16_t p) const { return(((ndpiDetectedProtocol.master_protocol == p)
|| (ndpiDetectedProtocol.app_protocol == p))
? true : false); }
#ifdef NTOPNG_PRO
void update_pools_stats(const struct timeval *tv,
u_int64_t diff_sent_packets, u_int64_t diff_sent_bytes,