Bug #453 » 0002-fix-detection-filter.-Had-one-extra-alert-than-norma.patch
| src/detect-engine-threshold.c | ||
|---|---|---|
|
/* within timeout */
|
||
|
lookup_tsh->current_count++;
|
||
|
if (lookup_tsh->current_count >= td->count) {
|
||
|
if (lookup_tsh->current_count > td->count) {
|
||
|
ret = 1;
|
||
|
}
|
||
|
} else {
|
||
| ... | ... | |
|
lookup_tsh->tv_sec1 = p->ts.tv_sec;
|
||
|
lookup_tsh->current_count = 1;
|
||
|
if (td->count == 1) {
|
||
|
ret = 1;
|
||
|
}
|
||
|
}
|
||
|
} else {
|
||
|
if (td->count == 1) {
|
||
|
ret = 1;
|
||
|
}
|
||
|
DetectThresholdEntry *e = DetectThresholdEntryAlloc(td, p, sid, gid);
|
||
|
if (e == NULL) {
|
||
|
break;
|
||