Project

General

Profile

Actions

Support #1588

closed

drop event on bittorrent is not working.

Added by Jeevan Nailwal over 8 years ago. Updated almost 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Hi All,
while testing latest code of suricata, I compiled and executed the suricata with a small change in rule for bitorrent( basically changed the alert to drop and added my name in all messages )

I can see the message from the rules files. like:

11/03/2015-16:24:57.101776 [wDrop] [**] [1:2008581:3] Jeevan: ET P2P BitTorrent DHT ping request [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {UDP} 172.16.1.82:6881 -> 115.201.76.134:16001

11/03/2015-16:23:12.435275 [wDrop] [**] [1:2011699:4] Jeevan: ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x) [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 172.16.1.82:37340 -> 91.216.110.47:80

As you can see, I am getting the drop messages for ping and other messages, but on other hand, my torrent file is also getting downloaded(log file attached). I tried different torrent client, but result was same. As per me, these packets should drop and no further packets should be allowed to downloaded from my client. Can you please suggest me what am I missing here? or is it suricata's bug, to unable to detect certain torrent packets?

Attaching the fast.log.


Files

fast.log (35.9 KB) fast.log log file which contains wdrop messages Jeevan Nailwal, 11/04/2015 12:39 AM
Actions

Also available in: Atom PDF