Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add an heuristic to detect/ignore some anomalous TCP ACK packets #1948

Merged
merged 1 commit into from
Apr 25, 2023
Merged

Add an heuristic to detect/ignore some anomalous TCP ACK packets #1948

merged 1 commit into from
Apr 25, 2023

Commits on Apr 21, 2023

  1. Add an heuristic to detect/ignore some anomalous TCP ACK packets 

    In some networks, there are some anomalous TCP flows where the smallest
ACK packets have some kind of zero padding.
It looks like the IP and TCP headers in those frames wrongly consider the
0x00 Ethernet padding bytes as part of the TCP payload.
While this kind of packets is perfectly valid per-se, in some conditions
they might be treated by the TCP reassembler logic as (partial) overlaps,
deceiving the classification engine.
Add an heuristic to detect these packets and to ignore them, allowing
correct detection/classification.

This heuristic is configurable. Default value:
* in the library, it is disabled
* in `ndpiReader` and in the fuzzers, it is enabled (to ease testing)

Credit to @vel21ripn for the initial patch.

Close ntop#1946
    @IvanNardi
    IvanNardi committed Apr 21, 2023
    Configuration menu
    Copy the full SHA
    5e51b16 View commit details
    Browse the repository at this point in the history