Bug #4715: pcre keyword cause more alert! - Suricata - Open Information Security Foundation

Actions

Bug #4715

open

Status:

Feedback

Priority:

Normal

Assignee:

Target version:

Affected Versions:

Effort:

Difficulty:

Label:

Description

When I use the pcre keyword to detect pcap. It alerted 156 times.
alert smb any any -> any any (msg:"smb test";pcre:"/test/";sid:26;)

But, Change pcre keyword to content keyword, it alerted 5 times.
alert smb any any -> any any (msg:"smb test";content:"test";sid:27;)

What caused this?
Does PCRE change the detection mode ?
If this is the reason, What keyword can make pcre keyword like content keyword work?

Actions

Would you have a pcap to reproduce this ?

Also, please note that using pcre on stream without any fixed content will lead to very poor performance

Actions

Actions

Actions

Also available in: Atom PDF