Project

General

Profile

Actions
Copy link

Support #2180

closed

HTTP matching does partially not work for 3.2.2 and 4.0.0rc1 under CentOS 7

Added by Anonymous almost 7 years ago. Updated almost 7 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Affected Versions:
Label:

Description

Hi,

we use Suricata during a lecture to let the students work with an IDS. During this we discovered a bug in the HTTP detection logic.

Version 3.1 works fine, but both 3.2.2 and 4.0.0rc1 do not report alerts for any of the traffic we used in the lecture.
To test if this is a general problem with the http matching or related to our pcaps, I verified with the `http.cap` sample from wireshark (https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=http.cap). In this pcap I do see alerts for http rules.

I looked at the self-help flowchart (https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Self_Help_Diagrams) without any luck.
I also couldn't find any related bug reports, except maybe https://redmine.openinfosecfoundation.org/issues/1580, which contains no further information and is already quite old.

I uploaded all seemingly relevant files. The second rules is just to verify that Suricata is able to alert at all.

Files

Download all files
http2.pcap (1.08 KB) http2.pcap Minimal non-working example. Anonymous, 07/12/2017 05:14 PM
install_suricata.sh (580 Bytes) install_suricata.sh Automatic install script Anonymous, 07/12/2017 05:14 PM
fast.log (276 Bytes) fast.log Anonymous, 07/12/2017 05:20 PM
http.rules (149 Bytes) http.rules Anonymous, 07/12/2017 05:20 PM
stats.log (1.51 KB) stats.log Anonymous, 07/12/2017 05:20 PM
eve.json (3.11 KB) eve.json Anonymous, 07/12/2017 05:20 PM
stdout (1.4 KB) stdout Anonymous, 07/12/2017 05:20 PM
Actions
Copy link
 #1

Updated by Peter Manev almost 7 years ago

With the examples provided 3.2.2 alerts (for the http rule as well) like so -

suricata -v -r 2180.pcap.pcap -S 2180.rules -v -l log/ -k none --set "stream.midstream=true"

Actions
Copy link
 #2

Updated by Anonymous almost 7 years ago

Thanks for the help. This works for us.
You can close the bugreport.

Actions
Copy link
 #3

Updated by Victor Julien almost 7 years ago

  • Tracker changed from Bug to Support
  • Status changed from New to Closed
Actions
Copy link

Also available in: Atom PDF