Project

General

Profile

Actions
Copy link

Bug #5111

closed

Bug #5076: keyword content does not work over reassembled TCP

keyword content does not work over reassembled TCP (5.0.x backport)

Added by Jeff Lucovsky almost 3 years ago. Updated over 2 years ago.

Status:
Rejected
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
6.0.4
Effort:
Difficulty:
Label:

Description

Using rule
alert ip any any -> any any (content:"HTTP/2.loc"; sid:11;)

on attached pcap

with stream.reassembly.toserver-chunk-size=25

does not trigger an alert

It does trigger the alert without the setting.

I fear we might have an evasion if I split the packets over the default value of 2560...

Actions
Copy link
 #1

Updated by Jeff Lucovsky almost 3 years ago

  • Copied from Bug #5076: keyword content does not work over reassembled TCP added
Actions
Copy link
 #2

Updated by Victor Julien over 2 years ago

  • Target version changed from 5.0.9 to 5.0.10
Actions
Copy link
 #3

Updated by Jeff Lucovsky over 2 years ago

  • Subject changed from keyword content does not work over reassembled TCP to keyword content does not work over reassembled TCP (5.0.x backport)
  • Parent task set to #5076
Actions
Copy link
 #4

Updated by Victor Julien over 2 years ago

  • Target version changed from 5.0.10 to 5.0.11
Actions
Copy link
 #5

Updated by Victor Julien over 2 years ago

  • Status changed from Assigned to Rejected
  • Assignee deleted (Jeff Lucovsky)
  • Target version deleted (5.0.11)

5.0.x is EOL in a few days, issue is unconfirmed too.

Actions
Copy link

Also available in: Atom PDF