Project

General

Profile

Actions
Copy link

Bug #4220

closed
LS

detect: signature not hit with --simulate-ips option

Bug #4220: detect: signature not hit with --simulate-ips option

Added by Litmus Shi over 5 years ago. Updated 8 months ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
5.0.3
Effort:
Difficulty:
Label:

Description

Hi,

I have a pcap trace which can hit my signature with the configurations in the attachment in IDS mode.
But the same trace failed to hit the same signature with the same configuration in IPS mode.

Is it by design or a bug?

How to reproduce:
1. uncompress the tar.gz to /home/inline-test, make sure all files are under /home/inline-test
2. cd /home/inline-test
3. ntd-ids -c ./suricata.yaml -r ./1flowB.pcap, and we can see eve logs.
4. ntd-ids -c ./suricata.yaml -r ./1flowB.pcap --simulate-ips, and we can't see any eve logs.

Files

inline-test.tar.gz (581 KB) inline-test.tar.gz Litmus Shi, 12/16/2020 08:55 AM

VJ Updated by Victor Julien over 5 years ago Actions
Copy link
 #1

  • Status changed from New to Assigned
  • Assignee changed from Community Ticket to Victor Julien
  • Target version set to 7.0.0-beta1

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #2

  • Target version changed from 7.0.0-beta1 to 8.0.0-beta1

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #3

  • Target version changed from 8.0.0-beta1 to 8.0.0-rc1

SB Updated by Shivani Bhardwaj over 1 year ago Actions
Copy link
 #4

  • Subject changed from failed to hit a signature with option --simulate-ips to detect: signature not hit with --simulate-ips option
  • Priority changed from High to Normal

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #5

  • Priority changed from Normal to High

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #6

  • Target version changed from 8.0.0-rc1 to 9.0.0-beta1

VJ Updated by Victor Julien 8 months ago Actions
Copy link
 #7

  • Status changed from Assigned to Closed
  • Assignee deleted (Victor Julien)
  • Priority changed from High to Normal
  • Target version deleted (9.0.0-beta1)

I've finally been able to have a look. The problem is that the pcap is showing a broken TCP stream with an improper 3-way handshake. In IDS mode Suricata is more forgiving of this type of issue, but the IPS mode is quite strict.

As I don't think there is anything to fix here, I'm closing the ticket.

VJ Updated by Victor Julien 8 months ago Actions
Copy link
 #8

For reference, I added a test for both IDS and IPS modes in https://github.com/OISF/suricata-verify/pull/2879

Actions
Copy link

Also available in: PDF Atom