Bug #4571: Unable to trigger rule by content in case of IPv4 in IPv4 incapsulation - Suricata - Open Information Security Foundation

Actions

Bug #4571

open

Status:

Assigned

Priority:

Low

Assignee:

Target version:

Affected Versions:

Effort:

Difficulty:

Label:

Description

Suricata do able detect packets by conent in case of incapsulation. Detection by content works in following cases:

But it doesn't work with tunnels IPv4 over IPv4 and it seems for me like a bug.

I have used following rule:

alert tcp any any -> any any (msg:"found"; content: "hello"; sid:1;)

With set of pcap files.

Files

Download all files

ipv6.pcap (126 Bytes) ipv6.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv6_over_ipv6.pcap (166 Bytes) ipv6_over_ipv6.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv6_over_ipv4.pcap (146 Bytes) ipv6_over_ipv4.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv4.pcap (106 Bytes) ipv4.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv4_over_ipv6.pcap (146 Bytes) ipv4_over_ipv6.pcap		Kirill Krotov, 08/02/2021 02:17 PM
ipv4_over_ipv4.pcap (166 Bytes) ipv4_over_ipv4.pcap	this doesn't work	Kirill Krotov, 08/02/2021 02:17 PM