Project

General

Profile

Actions

Bug #5110

open

Bug #5076: keyword content does not work over reassembled TCP

keyword content does not work over reassembled TCP (6.0.x backport)

Added by Jeff Lucovsky 10 months ago. Updated about 2 months ago.

Status:
Assigned
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using rule
alert ip any any -> any any (content:"HTTP/2.loc"; sid:11;)

on attached pcap

with stream.reassembly.toserver-chunk-size=25

does not trigger an alert

It does trigger the alert without the setting.

I fear we might have an evasion if I split the packets over the default value of 2560...

Actions

Also available in: Atom PDF