Project

General

Profile

Actions

Bug #4647

closed

rules: Unable to find the sm in any of the sm lists

Added by Jeff Lucovsky 2 months ago. Updated 18 days ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

I want to detect dns.flags.response==0 and dns.query is "test" or "abc" or "sdf".

alert dns any any -> any any (msg:"DNS_解析请求";byte_test:1,<,0x80,2;dns.query;pcre:"/test|abc|sdf/";sid:1;)

but this alerted "Unable to find the sm in any of the sm lists".

If modify the rule to:
alert dns any any -> any any (msg:"DNS_解析请求";dns.query;pcre:"/test|abc|sdf/";sid:1;)
or
alert dns any any -> any any (msg:"DNS_解析请求";byte_test:1,<,0x80,2;sid:1;)

These are ok. So,Why is this error reported.


Related issues

Copied from Bug #4548: rules: Unable to find the sm in any of the sm listsIn ReviewShivani BhardwajActions
Actions #1

Updated by Jeff Lucovsky 2 months ago

  • Copied from Bug #4548: rules: Unable to find the sm in any of the sm lists added
Actions #2

Updated by Jeff Lucovsky 20 days ago

  • Status changed from Assigned to In Progress

Cherry-pick commit(s):
- 9dd1444f4431731bf4917488e0abec0d9a46fdcc

Actions #3

Updated by Jeff Lucovsky 20 days ago

  • Status changed from In Progress to In Review
Actions #4

Updated by Jeff Lucovsky 18 days ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF