Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

packet_analysis: Do not run DetectProtocol() on disabled analyzers

Browse source 
This came up when disabling the TEREDO analyzer but still seeing its
DetectProtocol() method prominently in flame graphs.
This commit is contained in:
Arne Welzel 2023-11-01 10:11:55 +01:00
parent 9bebd93c06
commit ec4ad2e80d
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/packet_analysis/Analyzer.cc
View file

@ -82,7 +82,7 @@ const AnalyzerPtr& Analyzer::FindInnerAnalyzer(size_t len, const uint8_t* data,
// Return an analyzer found via DetectProtocol() for the given data, else nil. // Return an analyzer found via DetectProtocol() for the given data, else nil.
const AnalyzerPtr& Analyzer::DetectInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet) const { const AnalyzerPtr& Analyzer::DetectInnerAnalyzer(size_t len, const uint8_t* data, Packet* packet) const {
for ( const auto& child : analyzers_to_detect ) { for ( const auto& child : analyzers_to_detect ) {
if ( child->DetectProtocol(len, data, packet) ) { if ( child->IsEnabled() && child->DetectProtocol(len, data, packet) ) {
DBG_LOG(DBG_PACKET_ANALYSIS, "Protocol detection in %s succeeded, next layer analyzer is %s", DBG_LOG(DBG_PACKET_ANALYSIS, "Protocol detection in %s succeeded, next layer analyzer is %s",
GetAnalyzerName(), child->GetAnalyzerName()); GetAnalyzerName(), child->GetAnalyzerName());
return child; return child;