Skip to content

Commit

Permalink
reclassify flow status after FLOW_TIMEOUT
Browse files Browse the repository at this point in the history
A flow which is marked as timeout and restarted again gets the status
STS_UNSET. This results in the output path "others/". This can often happen
with UDP packets like DHCP because they aren't send very frequenty. The
"others"/STS_UNSET classification is wrong in this case because it is known
that this flow is UDP. This is especially important when the "others" output
type is not enabled.

The flow should be reclassified instead to calculate the correct output folder.
  • Loading branch information
ecsv committed May 12, 2014
1 parent 60e0bc0 commit fb4dea0
Showing 1 changed file with 15 additions and 0 deletions.
15 changes: 15 additions & 0 deletions pkt2flow.c
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,21 @@ static void process_trace(void)
fname = new_file_name(af_6tuple, hdr.ts.tv_sec);
pair->pdf.file_name = fname;
pair->pdf.start_time = hdr.ts.tv_sec;

switch (af_6tuple.protocol) {
case IPPROTO_TCP:
if (syn_detected)
pair->pdf.status = STS_TCP_SYN;
else
pair->pdf.status = STS_TCP_NOSYN;
break;
case IPPROTO_UDP:
pair->pdf.status = STS_UDP;
break;
default:
pair->pdf.status = STS_UNSET;
break;
}
}
}

Expand Down

0 comments on commit fb4dea0

Please sign in to comment.