diff --git a/nDPId.c b/nDPId.c index 9e433495..7bb4dcc8 100644 --- a/nDPId.c +++ b/nDPId.c @@ -172,7 +172,8 @@ struct nDPId_flow_basic uint8_t l4_protocol; uint8_t tcp_fin_rst_seen : 1; uint8_t tcp_is_midstream_flow : 1; - uint8_t reserved_00 : 6; + uint8_t end_or_idle : 1; + uint8_t reserved_00 : 5; uint8_t reserved_01[2]; uint16_t src_port; uint16_t dst_port; @@ -1676,24 +1677,22 @@ static void ndpi_idle_scan_walker(void const * const A, ndpi_VISIT which, int de if (which == ndpi_preorder || which == ndpi_leaf) { - if (is_l4_protocol_timed_out(workflow, flow_basic) != 0) + if (is_l4_protocol_timed_out(workflow, flow_basic) != 0 && + is_tcp_post_end(workflow, flow_basic) != 0) { - if (is_tcp_post_end(workflow, flow_basic) != 0) + workflow->ndpi_flows_idle[workflow->cur_idle_flows++] = flow_basic; + switch (flow_basic->state) { - workflow->ndpi_flows_idle[workflow->cur_idle_flows++] = flow_basic; - switch (flow_basic->state) - { - case FS_UNKNOWN: - case FS_COUNT: + case FS_UNKNOWN: + case FS_COUNT: - case FS_SKIPPED: - break; + case FS_SKIPPED: + break; - case FS_FINISHED: - case FS_INFO: - workflow->total_idle_flows++; - break; - } + case FS_FINISHED: + case FS_INFO: + workflow->total_idle_flows++; + break; } } } @@ -1747,13 +1746,17 @@ static void process_idle_flow(struct nDPId_reader_thread * const reader_thread, { struct nDPId_flow * const flow = (struct nDPId_flow *)flow_basic; - if (flow->flow_extended.flow_basic.tcp_fin_rst_seen != 0) + if (flow_basic->end_or_idle == 0) { - jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_END); - } - else - { - jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_IDLE); + if (flow->flow_extended.flow_basic.tcp_fin_rst_seen != 0) + { + jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_END); + } + else + { + jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_IDLE); + } + flow_basic->end_or_idle = 1; } break; } @@ -1802,15 +1805,20 @@ static void process_idle_flow(struct nDPId_reader_thread * const reader_thread, jsonize_flow_detection_event(reader_thread, flow, FLOW_EVENT_NOT_DETECTED); } } - if (flow->flow_extended.flow_basic.tcp_fin_rst_seen != 0) - { - jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_END); - } - else + + if (flow_basic->end_or_idle == 0) { - jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_IDLE); + if (flow->flow_extended.flow_basic.tcp_fin_rst_seen != 0) + { + jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_END); + } + else + { + jsonize_flow_event(reader_thread, &flow->flow_extended, FLOW_EVENT_IDLE); + } + flow_basic->end_or_idle = 1; + break; } - break; } }