local payload=APP.data --APP.data local payload_len=string.len(payload) if (payload_len < 80) then return false end if (APP.context.packet_sum == nil) then APP.context.packet_sum = 1 else APP.context.packet_sum = APP.context.packet_sum + 1 end if (APP.context.packet_sum > 50) then APP.detach_me() return false end if(APP.context.heartbeat_candidates == nil) then APP.context.heartbeat_candidates = {} end if(APP.context.possible_heartbeat_C2S_flag == nil) then APP.context.possible_heartbeat_C2S_flag=0 end if(APP.context.possible_heartbeat_C2S_payload_size == nil) then APP.context.possible_heartbeat_C2S_payload_size=0 end if (APP.get_payload_direction() == 1 and payload_len < 400 and payload_len > 150 and APP.context.possible_heartbeat_C2S_flag == 0) then APP.context.possible_heartbeat_C2S_payload_size = payload_len APP.context.possible_heartbeat_C2S_flag = 1 end if (APP.get_payload_direction() == 1 and payload_len < 400 and payload_len > 150 and APP.context.possible_heartbeat_C2S_flag == 1) then APP.context.possible_heartbeat_C2S_payload_size = payload_len end if (APP.get_payload_direction() == 2 and payload_len < 400 and payload_len > 80 and APP.context.possible_heartbeat_C2S_flag == 1) then local possible_heartbeat = '+' .. APP.context.possible_heartbeat_C2S_payload_size .. '-' .. payload_len local count = APP.context.heartbeat_candidates[possible_heartbeat] or 0 if count > 3 then APP.log_info("heartbeat find:", possible_heartbeat) APP.append_extra_info("heartbeat find:", possible_heartbeat) APP.detach_me() return true else APP.context.heartbeat_candidates[possible_heartbeat] = count + 1 APP.context.possible_heartbeat_C2S_flag = 0 APP.context.possible_heartbeat_C2S_payload_size = 0 end end return false