RDPUDP dissector: cookie hash is present in SYN packet instead of SYN/ACK
@@ -289,14 +289,16 @@ function dissectV1(tvbuf, pktinfo, tree)
local versionVal = tvbuf:range(startAt, 2):uint()
startAt = startAt + 2
- if haveAck and versionVal == 0x101 then
+ if versionVal == 0x101 then
+ if not haveAck then
synexItem:add(pf_udp_synex_cookiehash, tvbuf:range(startAt, 32))
startAt = startAt + 32
-
+ else
-- switch to UDP2
tableRecord.switchToUdp2 = pktinfo.number
end
end
+ end
local mask = RDPUDP_SYN + RDPUDP_ACK
if bit32.band(flags, mask) == mask then
