Bug #5111: keyword content does not work over reassembled TCP (5.0.x backport) - Suricata - Open Information Security Foundation

Actions

Bug #5111

closed

Bug #5076: keyword content does not work over reassembled TCP

Status:

Rejected

Priority:

Normal

Assignee:

Target version:

Affected Versions:

Effort:

Difficulty:

Label:

Description

Using rule
alert ip any any -> any any (content:"HTTP/2.loc"; sid:11;)

on attached pcap

with stream.reassembly.toserver-chunk-size=25

does not trigger an alert

It does trigger the alert without the setting.

I fear we might have an evasion if I split the packets over the default value of 2560...

Actions

Also available in: Atom PDF