From d4f653a5e3f2b9ddcf1587f44558f3c1edb0ec82 Mon Sep 17 00:00:00 2001
From: Ilya Glotov <contact@ilyaglotov.com>
Date: Sun, 28 Jul 2019 14:45:21 +0300
Subject: [PATCH] mirai: check if TTL is 64

---
 mirai.go | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/mirai.go b/mirai.go
index 7f8ed1c..7be1d1f 100644
--- a/mirai.go
+++ b/mirai.go
@@ -15,6 +15,10 @@ func MiraiIdentifier(p gopacket.Packet) []string {
 		return nil
 	}
 
+	if ip4.TTL != 64 {
+		return nil
+	}
+
 	tcp := unpackTCP(p)
 	if tcp == nil {
 		return nil