Dear All Someone could see this? Regards Agustin
On Mon, Jul 28, 2014 at 12:29 PM, Agustín Bertamoni < [email protected]> wrote: > Lucas > Thanks for the reply! > Analyzing the detection of HTTP (src/lib/protocols/http.c), I saw that > when the first packet of the flow is identified as HTTP, the analysis of > the sub-protocol based on http "Host" field works fine (eg > NDPI_SERVICE_GOOGLE detection according to src/lib /ndpi_content_match.c > service definition). > The failure occurs when the analysis should be done in step two (server > reply stage) such as the analysis of the "Content-Type" in the response, > this never happens because flow is flagged as identified . > Attached is a pcap in which the html contains "Content-Type: audio / > mpeg". If I do not confuse this should be identified as NDPI_CONTENT_MPEG > according to src/lib /ndpi_content_match.c but is identified as > NDPI_PROTOCOL_HTTP. > Thanks in advance! I hope my contribution be useful. > Regards > Agustin > > On Mon, Jul 28, 2014 at 10:57 AM, Luca Deri <[email protected]> wrote: > >> Augustin, >> please provide a patch an a pcap file that can be used to reproduce the >> bug and to verify the fix >> >> thanks Luca >> >> On 07/27/2014 06:31 PM, Agustín Bertamoni wrote: >> >> Dears >> NDPI HTTP's subprotocols (based on analysis of the Content-Type) seem to >> be not working (MPEG, FLASH, OGG, WEBM, etc). >> The Content-Type must be parsed in the second stage of analysis of HTTP >> and apparently when the flow is detected and tagged, it not be analyzed >> again (for second stage http analysis). >> The ndpiReader.c seems to has the same bug. >> Is my analysis correct? >> Thank you! >> >> -- >> Ing. Agustin Bertamoni >> +549 116218 3226 >> Stechs SRL <http://www.stechs.com.ar> >> >> >> _______________________________________________ >> Ntop-dev mailing >> [email protected]http://listgateway.unipi.it/mailman/listinfo/ntop-dev >> >> >> >> _______________________________________________ >> Ntop-dev mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-dev >> >> > > > -- > Ing. Agustin Bertamoni > +549 116218 3226 > Stechs SRL <http://www.stechs.com.ar> > -- Ing. Agustin Bertamoni +549 116218 3226 Stechs SRL <http://www.stechs.com.ar>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
