Project

General

Profile

Actions
Copy link

Bug #1401

closed

inverted matching on incomplete session

Added by Peter Manev about 9 years ago. Updated about 9 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
2.1beta4
Affected Versions:
Effort:
Difficulty:
Label:

Description

Confirmed on stable 2.0.7, 2.1beta3 and latest dev/git.

It seems that when we have a session but starting with SA/A (imagine the initial S got lost) instead of a proper 3wh (S/SA/A) when we have midstream enabled - there is no alert generated.

pcap set up privately shared.

Actions
Copy link

Also available in: Atom PDF