Project

General

Profile

Actions
Copy link

Bug #2257

open
RU OD

rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter

Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter

Added by Ruslan Usmanov over 8 years ago. Updated 9 months ago.

Status:
Feedback
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
Effort:
Difficulty:
Label:

Description

When rate_filter set with "timeout" longer than "seconds" (which is common configuration, see example in http://suricata.readthedocs.io/en/latest/configuration/global-thresholds.html ), program restarts counting of detections when "seconds" expire after last detection, not when "timeout" expires.
In function ThresholdTimeoutCheck(), tv_timeout not taken into consideration, causing program to ignore this parameter and allowing the entry to expire.

AH Updated by Andreas Herz over 8 years ago Actions
Copy link
 #1

  • Assignee set to OISF Dev
  • Target version set to TBD

VJ Updated by Victor Julien about 7 years ago Actions
Copy link
 #2

Hi Ruslan, did you submit a fix for this ticket as well? I don't see the ticket number referenced in the commits you have in the tree.

RU Updated by Ruslan Usmanov about 7 years ago Actions
Copy link
 #3

Victor Julien wrote:

Hi Ruslan, did you submit a fix for this ticket as well? I don't see the ticket number referenced in the commits you have in the tree.

Hi Julien, sorry for delay in the answer, I don't think I fixed this issue, created the ticket in order to address it later.

AH Updated by Andreas Herz over 6 years ago Actions
Copy link
 #4

  • Status changed from New to Feedback

Are you willing to submit a PR for that?

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #5

  • Status changed from Feedback to New

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #6

  • Status changed from New to Feedback

Is this still a problem in Suricata 8 ?
How can we reproduce ?

Actions
Copy link

Also available in: PDF Atom