Support #1588
closeddrop event on bittorrent is not working.
Description
Hi All,
while testing latest code of suricata, I compiled and executed the suricata with a small change in rule for bitorrent( basically changed the alert to drop and added my name in all messages )
I can see the message from the rules files. like:
11/03/2015-16:24:57.101776 [wDrop] [**] [1:2008581:3] Jeevan: ET P2P BitTorrent DHT ping request [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {UDP} 172.16.1.82:6881 -> 115.201.76.134:16001
11/03/2015-16:23:12.435275 [wDrop] [**] [1:2011699:4] Jeevan: ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 172.16.1.82:37340 -> 91.216.110.47:80
As you can see, I am getting the drop messages for ping and other messages, but on other hand, my torrent file is also getting downloaded(log file attached). I tried different torrent client, but result was same. As per me, these packets should drop and no further packets should be allowed to downloaded from my client. Can you please suggest me what am I missing here? or is it suricata's bug, to unable to detect certain torrent packets?
Attaching the fast.log.
Files
Updated by Andreas Herz about 9 years ago
- Tracker changed from Bug to Support
- Priority changed from Urgent to Normal
How do you run/start suricata?
This looks like simple monitoring mode with "wDrop" meaning (would drop). So you want to use Suricata in IPS mode?