From 6e6e12e42be52f623b69e396281b97379799e089 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Thu, 19 Feb 2026 11:31:48 +0100
Subject: [PATCH] ndpi: minor optimization

Check protocol before doing more expensive work.

(cherry picked from commit 28ba93e60c3ef9c593d72e58945603d8a715bc92)
---
 plugins/ndpi/ndpi.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/plugins/ndpi/ndpi.c b/plugins/ndpi/ndpi.c
index ad6cd78b7d..814661c1e5 100644
--- a/plugins/ndpi/ndpi.c
+++ b/plugins/ndpi/ndpi.c
@@ -92,21 +92,21 @@ static void OnFlowInit(ThreadVars *tv, Flow *f, const Packet *p, void *_data)
 
 static void OnFlowUpdate(ThreadVars *tv, Flow *f, Packet *p, void *_data)
 {
-    struct NdpiThreadContext *threadctx = ThreadGetStorageById(tv, thread_storage_id);
-    struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
+    /* Ignore packets that have a different protocol than the
+     * flow. This can happen with ICMP unreachable packets. */
+    if (p->proto != f->proto) {
+        return;
+    }
+
     uint16_t ip_len = 0;
     void *ip_ptr = NULL;
+    struct NdpiThreadContext *threadctx = ThreadGetStorageById(tv, thread_storage_id);
+    struct NdpiFlowContext *flowctx = FlowGetStorageById(f, flow_storage_id);
 
     if (!threadctx->ndpi || !flowctx->ndpi_flow) {
         return;
     }
 
-    /* Ignore packets that have a different protocol than the
-     * flow. This can happen with ICMP unreachable packets. */
-    if (p->proto != f->proto) {
-        return;
-    }
-
     if (PacketIsIPv4(p)) {
         const IPV4Hdr *ip4h = PacketGetIPv4(p);
         ip_len = IPV4_GET_RAW_IPLEN(ip4h);