From ddffa62468cbf6a326cd9d77e035d2c83b0a8e63 Mon Sep 17 00:00:00 2001 From: Simon Walton Date: Wed, 29 May 2019 18:10:48 -0700 Subject: [PATCH] Use STUN RFC magic number to filter for such packets --- tools/dissectors/1-hfudt.lua | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/dissectors/1-hfudt.lua b/tools/dissectors/1-hfudt.lua index 8179276dbb..1a2e8beab6 100644 --- a/tools/dissectors/1-hfudt.lua +++ b/tools/dissectors/1-hfudt.lua @@ -163,10 +163,13 @@ local unsourced_packet_types = { local fragments = {} +local RFC_5389_MAGIC_COOKIE = 0x2112A442 + function p_hfudt.dissector(buf, pinfo, tree) -- make sure this isn't a STUN packet - those don't follow HFUDT format - if pinfo.dst == Address.ip("stun.highfidelity.io") then return end + -- if pinfo.dst == Address.ip("stun.highfidelity.io") then return end + if buf(4, 4):uint() == RFC_5389_MAGIC_COOKIE then return end -- validate that the packet length is at least the minimum control packet size if buf:len() < 4 then return end