fix bug: correctly check a packet is first seen if option length is 12 and only have 1 node ID

simple-IDS/ids.ml

@@ -28,13 +28,8 @@ let detect_and_output_private packet header frame inter_num output_private outpu
             true
       in
       let options = ipv4_hdr.options in
-      (* match Ipaddr.V4.compare ipv4_hdr.src default_ignored_ip != 0 with *)
-      (* | false -> *)
-      (* Custom_option.read_custom_opt ipv4_hdr.src options (!node_id, inter_num); *)
-      (* output_private frame *)
-      (* | true -> ( *)
       let decision_list = Custom_option.get_decision_list ipv4_hdr.dst !attacker_ip_lst in
-      match (decision_list <> [], is_attack, Cstruct.length options = 12) with
+      match (decision_list <> [], is_attack, (Cstruct.length options = 12 && Cstruct.get_uint8 options 11 = 0)) with
       | false, false, _ ->
           (* If the packet is NOT in the path of attacks, just look for registration request *)
           Custom_option.read_custom_opt ipv4_hdr.src options;