Project

General

Profile

Actions

Bug #4220

open

failed to hit a signature with option --simulate-ips

Added by Litmus Shi 9 months ago. Updated 8 months ago.

Status:
Assigned
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,

I have a pcap trace which can hit my signature with the configurations in the attachment in IDS mode.
But the same trace failed to hit the same signature with the same configuration in IPS mode.

Is it by design or a bug?

How to reproduce:
1. uncompress the tar.gz to /home/inline-test, make sure all files are under /home/inline-test
2. cd /home/inline-test
3. ntd-ids -c ./suricata.yaml -r ./1flowB.pcap, and we can see eve logs.
4. ntd-ids -c ./suricata.yaml -r ./1flowB.pcap --simulate-ips, and we can't see any eve logs.


Files

inline-test.tar.gz (581 KB) inline-test.tar.gz Litmus Shi, 12/16/2020 08:55 AM
Actions #1

Updated by Victor Julien 8 months ago

  • Status changed from New to Assigned
  • Assignee changed from Community Ticket to Victor Julien
  • Target version set to 7.0rc1
Actions

Also available in: Atom PDF