mirai: check if TTL is 64

ilyaglow · Jul 28, 2019 · d4f653a · d4f653a
1 parent 58bdf48
commit d4f653a
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/mirai.go b/mirai.go
@@ -15,6 +15,10 @@ func MiraiIdentifier(p gopacket.Packet) []string {
 		return nil
 	}
 
+	if ip4.TTL != 64 {
+		return nil
+	}
+
 	tcp := unpackTCP(p)
 	if tcp == nil {
 		return nil