a bug in CheckPIA_FirstPacket()?

Zeek
1

Hi,
    In function TCP_Analyzer::CheckPIA_FirstPacket(), I assume the
testbit of first_packet_seen should be set when the first packet for
that direction is met. However, currently, one direction clears the
testbit of the other direction. If my guess is correct, the code should
be changed from:
    first_packet_seen = ORIG;
    ...
    first_packet_seen = RESP;
to
    first_packet_seen |= ORIG;
    ...
    first_packet_seen |= RESP;

cheers,

Guohan Lu

2

That's right. Thanks a lot for catching this!

Robin