Skip to content

Commit be788bd

Browse files
committed
conn.py: handle checking binetflow icmp flows for telnet traffic
1 parent e529c70 commit be788bd

File tree

1 file changed

+7
-1
lines changed

1 file changed

+7
-1
lines changed

modules/flowalerts/conn.py

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -201,8 +201,14 @@ def check_unknown_port(self, profileid, twid, flow):
201201
return True
202202

203203
def is_telnet(self, flow) -> bool:
204+
try:
205+
dport = int(flow.dport)
206+
except ValueError:
207+
# binetflow icmp ports are hex strings
208+
return False
209+
204210
telnet_ports = (23, 2323)
205-
return int(flow.dport) in telnet_ports and flow.proto.lower() == "tcp"
211+
return dport in telnet_ports and flow.proto.lower() == "tcp"
206212

207213
def check_multiple_telnet_reconnection_attempts(
208214
self, profileid, twid, flow

0 commit comments

Comments
 (0)