Coder Social home page Coder Social logo

Comments (9)

0xA50C1A1 avatar 0xA50C1A1 commented on August 23, 2024 2

Lol, I just noticed that nDPI has a RESP protocol dissector, but it's just called "Redis" for some reason. Ofc it doesn't work, so this question is still relevant.

from ndpi.

0xA50C1A1 avatar 0xA50C1A1 commented on August 23, 2024 2

RESP = Redis serialization protocol

Yeah, I know. RESP sounds more correct than just Redis.

from ndpi.

IvanNardi avatar IvanNardi commented on August 23, 2024 1

Something like (in pseudo code)?

if(payload[0] == '*' &&
    (from offeset 1, one or more bytes are a number in ascii format) &&
    (after the ascii characters there is "\r\n") {
        FOUND
        return;
}
EXCLUDE

It should be enough...

from ndpi.

utoni avatar utoni commented on August 23, 2024

Is it possible to use the field length for a successful detection?

// EDIT: Did not read the protocol specs yet. 😄

from ndpi.

0xA50C1A1 avatar 0xA50C1A1 commented on August 23, 2024

Is it possible to use the field length for a successful detection?

// EDIT: Did not read the protocol specs yet. 😄

Well, I'm not sure about that. Btw, here are some pcap samples resp.zip

from ndpi.

0xA50C1A1 avatar 0xA50C1A1 commented on August 23, 2024

Something like (in pseudo code)?

if(payload[0] == '*' &&
    (from offeset 1, one or more bytes are a number in ascii format) &&
    (after the ascii characters there is "\r\n") {
        FOUND
        return;
}
EXCLUDE

It should be enough...

So, you mean something like this?

if (packet->payload[0] == '*' && isascii(packet->payload[1]) && memcmp(&packet->payload[2], "\r\n", 2) == 0)
{
  FOUND;
  return;
}

from ndpi.

IvanNardi avatar IvanNardi commented on August 23, 2024

We can have a number bigger than 9... Just the idea (without all the necessary checks on payload length)

if (packet->payload[0] == '*') {
  num_digit = 0;
  while(isascii(packet->payload[1 + num_digit]) && num_digit++ < 3) { /* A reasonable upper bound ?*/
    ;
  if(num_digit > 0 && memcmp(&packet->payload[1+num_digit], "\r\n", 2)
    FOUND
}


```

from ndpi.

0xA50C1A1 avatar 0xA50C1A1 commented on August 23, 2024

@IvanNardi Thanks for your help, now I have figured out how to solve this issue.

from ndpi.

IvanNardi avatar IvanNardi commented on August 23, 2024

RESP = Redis serialization protocol

from ndpi.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.