Hi, Can you confirm NTOP_CONTENT_MPEG flow is working ok in the pcap I send? Thanks in advance! Agustin
On Thu, Jul 31, 2014 at 1:20 PM, Spider s <[email protected]> wrote: > Hello Agustin, i cant confirm. :(. > > > Do what he said > > Regards. > > > > > On Thu, Jul 31, 2014 at 1:33 AM, Agustín Bertamoni < > [email protected]> wrote: > >> Dear All >> Someone could see this? >> Regards >> Agustin >> >> >> On Mon, Jul 28, 2014 at 12:29 PM, Agustín Bertamoni < >> [email protected]> wrote: >> >>> Lucas >>> Thanks for the reply! >>> Analyzing the detection of HTTP (src/lib/protocols/http.c), I saw that >>> when the first packet of the flow is identified as HTTP, the analysis of >>> the sub-protocol based on http "Host" field works fine (eg >>> NDPI_SERVICE_GOOGLE detection according to src/lib /ndpi_content_match.c >>> service definition). >>> The failure occurs when the analysis should be done in step two (server >>> reply stage) such as the analysis of the "Content-Type" in the response, >>> this never happens because flow is flagged as identified . >>> Attached is a pcap in which the html contains "Content-Type: audio / >>> mpeg". If I do not confuse this should be identified as NDPI_CONTENT_MPEG >>> according to src/lib /ndpi_content_match.c but is identified as >>> NDPI_PROTOCOL_HTTP. >>> Thanks in advance! I hope my contribution be useful. >>> Regards >>> Agustin >>> >>> On Mon, Jul 28, 2014 at 10:57 AM, Luca Deri <[email protected]> wrote: >>> >>>> Augustin, >>>> please provide a patch an a pcap file that can be used to reproduce the >>>> bug and to verify the fix >>>> >>>> thanks Luca >>>> >>>> >>>> On 07/27/2014 06:31 PM, Agustín Bertamoni wrote: >>>> >>>> Dears >>>> NDPI HTTP's subprotocols (based on analysis of the Content-Type) seem >>>> to be not working (MPEG, FLASH, OGG, WEBM, etc). >>>> The Content-Type must be parsed in the second stage of analysis of HTTP >>>> and apparently when the flow is detected and tagged, it not be analyzed >>>> again (for second stage http analysis). >>>> The ndpiReader.c seems to has the same bug. >>>> Is my analysis correct? >>>> Thank you! >>>> >>>> -- >>>> Ing. Agustin Bertamoni >>>> +549 116218 3226 >>>> Stechs SRL <http://www.stechs.com.ar> >>>> >>>> >>>> _______________________________________________ >>>> Ntop-dev mailing >>>> [email protected]http://listgateway.unipi.it/mailman/listinfo/ntop-dev >>>> >>>> >>>> >>>> _______________________________________________ >>>> Ntop-dev mailing list >>>> [email protected] >>>> http://listgateway.unipi.it/mailman/listinfo/ntop-dev >>>> >>>> >>> >>> >>> -- >>> Ing. Agustin Bertamoni >>> +549 116218 3226 >>> Stechs SRL <http://www.stechs.com.ar> >>> >> >> >> >> -- >> Ing. Agustin Bertamoni >> +549 116218 3226 >> Stechs SRL <http://www.stechs.com.ar> >> >> _______________________________________________ >> Ntop mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop >> > > > _______________________________________________ > Ntop mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop > -- Ing. Agustin Bertamoni +549 116218 3226 Stechs SRL <http://www.stechs.com.ar>
_______________________________________________ Ntop mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop
