Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

BIT-1854: fix the 'tcp_excessive_data_without_further_acks' option

Browse source 
This previously checked against the amount of out-of-sequence data
being buffered by the reassembler.  It now checks against the total
size of all blocks being buffered in the reassembler, which, by nature
of still being buffered there, means it's not been acked yet.
This commit is contained in:
Jon Siwek 2018-01-31 21:09:12 -06:00
parent 44175e0992
commit c2af3daa9f
3 changed files with 31 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/analyzer/protocol/tcp/TCP_Reassembler.cc
View file

@ -501,7 +501,7 @@ int TCP_Reassembler::DataSent(double t, uint64 seq, int len,
}
if ( tcp_excessive_data_without_further_acks &&
NumUndeliveredBytes() > static_cast<uint64>(tcp_excessive_data_without_further_acks) )
block_list_info.totalSize > static_cast<uint64>(tcp_excessive_data_without_further_acks) )
{
tcp_analyzer->Weird("excessive_data_without_further_acks");
ClearBlocks();