From d47ae571c010d5f2d7cb83fad87b194036fda297 Mon Sep 17 00:00:00 2001
From: david <david@e0a8ed71-7df4-0310-8962-fdc924857419>
Date: Tue, 17 Jan 2012 20:33:21 +0000
Subject: [PATCH] Move FP_NOVELTY_THRESHOLD to FPEngine.h.

---
 FPEngine.cc | 6 ++----
 FPEngine.h  | 4 ++++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/FPEngine.cc b/FPEngine.cc
index 3f34f8fc2..e320a631d 100644
--- a/FPEngine.cc
+++ b/FPEngine.cc
@@ -925,8 +925,6 @@ int label_prob_cmp(const void *a, const void *b) {
     return 0;
 }
 
-#define NOVELTY_THRESHOLD 10.0
-
 static double novelty_of(const struct feature_node *features, int label) {
   const double *means, *variances;
   int i, nr_feature;
@@ -998,12 +996,12 @@ static void classify(FingerPrintResultsIPv6 *FPR) {
     if (o.debugging > 1)
       log_write(LOG_PLAIN, "Novelty of closest match is %.3f.\n", novelty);
 
-    if (novelty < NOVELTY_THRESHOLD) {
+    if (novelty < FP_NOVELTY_THRESHOLD) {
       FPR->overall_results = OSSCAN_SUCCESS;
     } else {
       if (o.debugging > 0) {
         log_write(LOG_PLAIN, "Novelty of closest match is %.3f > %.3f; ignoring.\n",
-          novelty, NOVELTY_THRESHOLD);
+          novelty, FP_NOVELTY_THRESHOLD);
       }
       FPR->overall_results = OSSCAN_NOMATCHES;
       FPR->num_perfect_matches = 0;
diff --git a/FPEngine.h b/FPEngine.h
index 02761aa54..c46a89e57 100644
--- a/FPEngine.h
+++ b/FPEngine.h
@@ -122,6 +122,10 @@ class FingerPrintResultsIPv6;
 /* Total number of IPv6 OS detection probes. */
 #define NUM_FP_PROBES_IPv6 (NUM_FP_PROBES_IPv6_TCP+NUM_FP_PROBES_IPv6_ICMPv6+NUM_FP_PROBES_IPv6_UDP)
 
+/* Even with a successful classification, we may not consider a match good if it
+   is too different from other members of the class. */
+#define FP_NOVELTY_THRESHOLD 10.0
+
 const unsigned int OSDETECT_FLOW_LABEL = 0x12345;