nDPI icon indicating copy to clipboard operation
nDPI copied to clipboard

H323: avoid false positives

Open IvanNardi opened this issue 1 year ago • 4 comments

The simplest solution is to analyze all the UDP patterns only when there is a port matching

IvanNardi avatar May 09 '24 18:05 IvanNardi

Hi, I was just reworking this dissector :) Here is my solution if you want to take a look

h323_patch.zip

0xA50C1A1 avatar May 10 '24 07:05 0xA50C1A1

Hi, I was just reworking this dissector :) Here is my solution if you want to take a look

h323_patch.zip

Welcome back!! I'll look into that later, thanks!

IvanNardi avatar May 10 '24 07:05 IvanNardi

Hi, I was just reworking this dissector :) Here is my solution if you want to take a look h323_patch.zip

Welcome back!! I'll look into that later, thanks!

Yeah, finally the support figured out what was wrong and removed the restrictions from me.

0xA50C1A1 avatar May 10 '24 07:05 0xA50C1A1

Hi, I was just reworking this dissector :) Here is my solution if you want to take a look h323_patch.zip

Welcome back!! I'll look into that later, thanks!

I integrated your changes, but I kept the check on the udp ports

IvanNardi avatar May 11 '24 19:05 IvanNardi