Project

General

Profile

Actions

Bug #1991

closed

Suricata cannot parse ports: "![1234, 1235]"

Added by ajaxtpm ajaxtpm almost 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Have found small inconsistency when suricata parse ports list in signature

alert tcp any any -> any ![1234,1235] (msg:"Test rule 1"; flow:to_server; sid:1; rev:1;)
alert tcp any any -> any [!1234, !1235] (msg:"Test rule 2"; flow:to_server; sid:2; rev:1;)
alert tcp any any -> any ![1234, 1235] (msg:"Test rule 3"; flow:to_server; sid:3; rev:1;)

suricata cannot parse the 3rd signature: error parsing signature "alert tcp any any -> any ![1234, 1235]

Actions #1

Updated by Andreas Herz almost 5 years ago

  • Assignee set to Andreas Herz
  • Target version set to TBD
Actions #2

Updated by Andreas Herz almost 5 years ago

  • Status changed from New to Closed
Actions #3

Updated by ajaxtpm ajaxtpm almost 5 years ago

Thank you guys!

Actions #4

Updated by Victor Julien almost 5 years ago

  • Target version changed from TBD to 3.2.1
Actions

Also available in: Atom PDF