Project

General

Profile

Actions

Bug #3463

closed

Faulty signature with two threshold keywords does not generate an error and never match

Added by Odin Jenseg almost 3 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport

Description

alert http any any -> any any (msg:"CURL1"; flow:established,to_server; content:"GET"; http_method;  content:"curl"; http_user_agent; threshold: type limit, track by_src, count 1 , seconds 60; sid:1;)
alert http any any -> any any (msg:"CURL2"; flow:established,to_server; content:"GET"; http_method;  content:"curl"; http_user_agent; threshold: type limit, track by_src, count 1 , seconds 60; threshold: type limit, track by_src, count 1 , seconds 60; sid:2;)

The first rule will trigger an alert, but the second one will not trigger an alert. The second one is faulty and contains two threshold fields. Rules that contains error is often listed in suricata.log and not loaded. It would be good if similar validation is performed on these cases.


Related issues 2 (0 open2 closed)

Copied to Bug #3579: Faulty signature with two threshold keywords does not generate an error and never matchClosedShivani BhardwajActions
Copied to Bug #3580: Faulty signature with two threshold keywords does not generate an error and never matchClosedJeff LucovskyActions
Actions

Also available in: Atom PDF