Project

General

Profile

Actions
Copy link

Bug #5140

open

nfs: NFS3/NFS2 procedure conflict

Added by Sam Mohammad over 3 years ago. Updated 8 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
8.0.0
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Needs Suricata-Verify test, Protocol, Rust

Description

an NFS2 procedure "STATFS" is being logged as an NFS3 "READDIRPLUS"
since both have the same proc_num: 17 but no distinguished proc_name for NFS2

{"flow_id":397357320141328,"pcap_cnt":12,"event_type":"nfs","src_ip":"139.25.22.102","src_port":2049,"dest_ip":"139.25.22.2","dest_port":1023,"proto":"UDP","rpc":{"xid":1578961813,"status":"ACCEPTED","auth_type":"UNIX","creds":{"machine_name":"werrmsche","uid":0,"gid":0}},"nfs":{"version":2,"procedure":"READDIRPLUS","filename":"","id":2,"file_tx":false,"type":"response","status":"OK"}}

Pcap file: nfsv2.pcap | https://redmine.openinfosecfoundation.org/issues/3277

Files

Download all files
Screenshot from 2022-02-21 17-08-48.png (59.6 KB) Screenshot from 2022-02-21 17-08-48.png wireshark - original nfs2 pcap STATFS record Sam Mohammad, 02/21/2022 03:09 PM
nfsv2.pcap (25.1 KB) nfsv2.pcap Sam Mohammad, 07/18/2025 10:03 AM
nfs3-READDIRPLUS.pcap (816 Bytes) nfs3-READDIRPLUS.pcap Sam Mohammad, 07/18/2025 10:04 AM
Actions
Copy link
 #1

Updated by Philippe Antoine 9 days ago

  • Status changed from New to Feedback
  • Label Needs Suricata-Verify test added

Could you share the pcap to reproduce please ?

Actions
Copy link Download all files
 #2

Updated by Sam Mohammad 9 days ago

AFAIR the conflict was logging { proc_num: 17 } for nfsv2 with the same name of nfs3 { proc_num: 17 } which is READDIRPLUS .
while nfsv2 { proc_num: 17 } is actually STATFS .

Actions
Copy link
 #3

Updated by Philippe Antoine 9 days ago

  • Affected Versions 8.0.0 added

Looks to be still a problem from the code not handling diff between v2 and v3

    let proc_string = if state.nfs_version < 4 {
        nfs3_procedure_string(tx.procedure)

Actions
Copy link
 #4

Updated by Philippe Antoine 9 days ago

  • Status changed from Feedback to New
Actions
Copy link
 #5

Updated by Philippe Antoine 8 days ago

  • Label Beginner, Good First Issue, Protocol, Rust added
Actions
Copy link

Also available in: Atom PDF