Toni
Do you use a custom memory wrapper? What nDPI version / commit are you using?
I think there is already such check in `src/lib/protocols/http.c`. But it may be useful to check the HTTP body for PE32/PE32+. What do you think?
> > I think there is already such check in `src/lib/protocols/http.c`. > > Yes, it's there, but I meant something else: to classify flows with that content-type as `Portable_Executable`. Yea,...
> I'll do a proper review later, but I have an initial question: is there any specific reasons why this PE stuff is treated as a new protocol instead of...
@IvanNardi Again, I forgot a PR. Need some kind of stale PR alert or so..
Closing for inactivity. Please re-open if you still want to get this patch into `dev`.
I think that having packet/tunnel dissection in the core library would be useful, at least for me. It's sad that this valuable dissection code is only part of `ndpiReader`. So...
I would prefer having a generic TCP reassembler which does also work for other TCP protocols and cares about fragmentated and out-of-order packets. What do you think? I tried it...
> I thought as much, but all pointers in the ndpi_packet_struct are null and all uints are 0. Can you please share some code with us?
Please note that this project is maintained by English speaking folks. Sorry.