conn.py: handle checking binetflow icmp flows for telnet traffic

stratosphereips · Dec 11, 2024 · be788bd · be788bd
1 parent e529c70
commit be788bd
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/modules/flowalerts/conn.py b/modules/flowalerts/conn.py
@@ -201,8 +201,14 @@ def check_unknown_port(self, profileid, twid, flow):
             return True
 
     def is_telnet(self, flow) -> bool:
+        try:
+            dport = int(flow.dport)
+        except ValueError:
+            # binetflow icmp ports are hex strings
+            return False
+
         telnet_ports = (23, 2323)
-        return int(flow.dport) in telnet_ports and flow.proto.lower() == "tcp"
+        return dport in telnet_ports and flow.proto.lower() == "tcp"
 
     def check_multiple_telnet_reconnection_attempts(
         self, profileid, twid, flow