Project

General

Profile

Actions

Bug #2263

closed

content matches disregarded when using dns_query on udp traffic

Added by Travis Green almost 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using Suricata-4.0.x, content matches before dns_query; sticky buffer are disregarded

  • FP:
    alert dns $HOME_NET any -> any any (msg:"test (fp)"; content:"|01|"; depth:1; offset:2; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|10|"; distance:1; within:1; content:"|06|"; distance:16; within:1; content:"|03|top|00|"; distance:6; within:5; dns_query; content:".top"; classtype:trojan-activity; sid:1; rev:1;)
  • no FP:
    alert dns $HOME_NET any -> any any (msg:"test (no fp)"; content:"|01|"; depth:1; offset:2; content:"|00 01 00 00 00 00 00|"; distance:1; within:7; content:"|10|"; distance:1; within:1; content:"|06|"; distance:16; within:1; content:"|03|top|00|"; distance:6; within:5; classtype:trojan-activity; sid:2; rev:1;)

Previous versions unaffected


Files

merged.pcap (8.68 KB) merged.pcap test pcap Travis Green, 11/07/2017 12:14 PM
suri_dns_bug_info.md (5.1 KB) suri_dns_bug_info.md Travis Green, 11/07/2017 12:15 PM
Actions #1

Updated by Victor Julien almost 5 years ago

  • Status changed from New to Assigned
  • Assignee set to Victor Julien
  • Target version changed from TBD to 4.0.2/4.0.3
Actions #2

Updated by Victor Julien almost 5 years ago

  • Status changed from Assigned to Closed
Actions #3

Updated by Victor Julien almost 5 years ago

  • Subject changed from content matches disregarded when using dns_query to content matches disregarded when using dns_query on udp traffic
Actions

Also available in: Atom PDF