Project

General

Profile

Bug #4399

use keyword ‘offset’ that cause more alert

Added by albert wang 27 days ago. Updated 21 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

The rules are as follows
alert tcp any any -> any [445,135,139] (msg:"test";flow:from_client,established;content:"|FF||53||4d||42||A0|";sid:10001;rev:1;)
that just Alerted 1 times,but change ruler to
alert tcp any any -> any [445,135,139] (msg:"test";flow:from_client,established;content:"|FF||53||4d||42||A0|";offset:4;depth:5;sid:10001;rev:1;)
that Alerted 7 times


Files

test.pcap (5.21 KB) test.pcap albert wang, 03/16/2021 07:14 AM
#1

Updated by Jeff Lucovsky 21 days ago

This is working as designed. If the depth option is used with TCP, we assume that the rule writer meant to inspect a record/pdu, and so we inspect individual packets but also the reassembled stream. If there is no depth we just inspect the stream

Also available in: Atom PDF