Project

General

Profile

Actions
Copy link

Bug #1401

closed
PM VJ

inverted matching on incomplete session

Bug #1401: inverted matching on incomplete session

Added by Peter Manev about 11 years ago. Updated about 11 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
2.1beta4
Affected Versions:
Effort:
Difficulty:
Label:

Description

Confirmed on stable 2.0.7, 2.1beta3 and latest dev/git.

It seems that when we have a session but starting with SA/A (imagine the initial S got lost) instead of a proper 3wh (S/SA/A) when we have midstream enabled - there is no alert generated.

pcap set up privately shared.

EL Updated by Eric Leblond about 11 years ago Actions
Copy link
 #1

Midstream not enable produce the same result.

VJ Updated by Victor Julien about 11 years ago Actions
Copy link
 #2

  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Target version set to 2.1beta4

VJ Updated by Victor Julien about 11 years ago Actions
Copy link
 #3

  • Status changed from Assigned to Closed
  • % Done changed from 0 to 100
Actions
Copy link

Also available in: PDF Atom