From ec4ad2e80dc39a17443e09ab38518e6325e6d7c3 Mon Sep 17 00:00:00 2001 From: Arne Welzel Date: Wed, 1 Nov 2023 10:11:55 +0100 Subject: [PATCH] packet_analysis: Do not run DetectProtocol() on disabled analyzers This came up when disabling the TEREDO analyzer but still seeing its DetectProtocol() method prominently in flame graphs. --- src/packet_analysis/Analyzer.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/packet_analysis/Analyzer.cc b/src/packet_analysis/Analyzer.cc index 5aad801b9e..ee067e4513 100644 --- a/src/packet_analysis/Analyzer.cc +++ b/src/packet_analysis/Analyzer.cc @@ -82,7 +82,7 @@ const AnalyzerPtr& Analyzer::FindInnerAnalyzer(size_t len, const uint8_t* data, // Return an analyzer found via DetectProtocol() for the given data, else nil. const AnalyzerPtr& Analyzer::DetectInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet) const { for ( const auto& child : analyzers_to_detect ) { - if ( child->DetectProtocol(len, data, packet) ) { + if ( child->IsEnabled() && child->DetectProtocol(len, data, packet) ) { DBG_LOG(DBG_PACKET_ANALYSIS, "Protocol detection in %s succeeded, next layer analyzer is %s", GetAnalyzerName(), child->GetAnalyzerName()); return child;