Project

General

Profile

Actions
Copy link

Bug #4941

closed
VJ JF

alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit

Bug #4941: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit

Added by Victor Julien about 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Juliana Fajardini Reichow
Target version:
7.0.0-beta1
Affected Versions:
5.0.8, 6.0.4
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Changes in alerting in 5.0.8/6.0.4 store noalert sigs in the packet alert array before removing them when finalizing the alerts. This solved several issues (#4663, #4670), however it introduces a new issue.

When many noalert rules are used, for example for flowbit "setter" logic, these rules now consume space in the alert array, leaving less space for "real" alerts that should be outputted. Since there is a built-in limit of 15 (see #4207) its not hard to reach this limit.

Subtasks 4 (0 open — 4 closed)

Optimization #4207: Use configurable or more dynamic @ PACKET_ALERT_MAX@ClosedJuliana Fajardini ReichowActions
Optimization #5178: detect/alert: improve packet alert queue handlingRejectedJuliana Fajardini ReichowActions
Task #4942: alerts: SV test for noalert issueClosedShivani BhardwajActions
Optimization #4943: alerts: use alert queing in DetectEngineThreadCtxClosedJuliana Fajardini ReichowActions

Related issues 4 (0 open — 4 closed)

Related to Suricata - Bug #4663: rules: drop rules with noalert not fully droppingClosedVictor JulienActions
Related to Suricata - Bug #4670: rules: mix of drop and pass rules issuesClosedVictor JulienActions
Copied to Suricata - Bug #5120: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport)ClosedJuliana Fajardini ReichowActions
Copied to Suricata - Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport)ClosedJuliana Fajardini ReichowActions

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #1

  • Affected Versions 5.0.8, 6.0.4 added

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #2

  • Related to Bug #4663: rules: drop rules with noalert not fully dropping added

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #3

  • Related to Bug #4670: rules: mix of drop and pass rules issues added

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #4

  • Assignee set to OISF Dev

JL Updated by Jeff Lucovsky about 4 years ago Actions
Copy link
 #5

  • Copied to Bug #5120: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (6.0.x backport) added

JL Updated by Jeff Lucovsky about 4 years ago Actions
Copy link
 #6

  • Copied to Bug #5124: alerts: 5.0.8/6.0.4 count noalert sigs towards built-in alert limit (5.0.x backport) added

JF Updated by Juliana Fajardini Reichow almost 4 years ago Actions
Copy link
 #7

  • Assignee changed from OISF Dev to Juliana Fajardini Reichow

JF Updated by Juliana Fajardini Reichow almost 4 years ago Actions
Copy link
 #8

I think https://github.com/OISF/suricata/pull/7347 would solve this, right?

JF Updated by Juliana Fajardini Reichow almost 4 years ago Actions
Copy link
 #9

  • Status changed from New to Resolved

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #10

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom