Project

General

Profile

Actions
Copy link

Bug #5161

closed

smb: file not tracked on smb2 async

Added by Angelo Mirabella almost 3 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.0-rc1
Affected Versions:
6.0.4
Effort:
Difficulty:
Label:

Description

Suricata fails to alert on a smb signature related to a file extraction.

Investigating a bit the issue the "file_data" keyword does not match (PrefilterTxFiledata) because a file is never seen by Suricata.

Attaching pcap and signature.

Files

Download all files
test.pcap (3.27 MB) test.pcap Angelo Mirabella, 02/24/2022 02:44 PM
test.rule (139 Bytes) test.rule Angelo Mirabella, 02/24/2022 02:44 PM

Subtasks 1 (0 open — 1 closed)

Bug #5715: smb: file not tracked on smb2 async (6.0.x backport)ClosedVictor JulienActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #5508: SMB2 async responses are not matched with its requestClosedPhilippe AntoineActions
Actions
Copy link
 #1

Updated by Victor Julien about 2 years ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Philippe Antoine
  • Target version changed from TBD to 7.0.0-rc1
Actions
Copy link
 #2

Updated by Philippe Antoine about 2 years ago

  • Status changed from Assigned to In Review
Actions
Copy link
 #3

Updated by Philippe Antoine about 2 years ago

  • Status changed from In Review to Closed
Actions
Copy link
 #4

Updated by Victor Julien about 2 years ago

  • Status changed from Closed to Resolved
Actions
Copy link
 #5

Updated by Victor Julien about 2 years ago

  • Subject changed from Suricata fails to see SMB file to smb: file not tracked on smb2 async
Actions
Copy link
 #6

Updated by Victor Julien about 2 years ago

  • Subtask #5715 added
Actions
Copy link
 #7

Updated by Victor Julien about 2 years ago

  • Status changed from Resolved to Closed
Actions
Copy link
 #8

Updated by Victor Julien about 2 years ago

  • Related to Bug #5508: SMB2 async responses are not matched with its request added
Actions
Copy link

Also available in: Atom PDF