Project

General

Profile

Actions
Copy link

Bug #5332

closed

Smb2 can not store files!

Added by yida zhang over 2 years ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
yida zhang
Target version:
TBD
Affected Versions:
Effort:
high
Difficulty:
Label:
Protocol, Rust

Description

There is a pcap that cannot trigger filestore.

Note: turn on midstream when retesting.

I think the ASYN responses header is what is causing the problem.
https://docs.microsoft.com/zh-cn/openspecs/windows_protocols/ms-smb2/ea4560b7-90da-4803-82b5-344754b92a79

Files

Download all files
smb_store_error.pcap (42.6 KB) smb_store_error.pcap file can not be stored yida zhang, 05/07/2022 09:15 AM
smb_store_ok.pcap (16.1 MB) smb_store_ok.pcap file can be stored yida zhang, 05/07/2022 09:16 AM
clipboard-202205071721-sbyqa.png (65 KB) clipboard-202205071721-sbyqa.png yida zhang, 05/07/2022 09:21 AM
Actions
Copy link
 #1

Updated by yida zhang over 2 years ago

  • Description updated (diff)
Actions
Copy link
 #2

Updated by yida zhang over 2 years ago

  • Description updated (diff)
Actions
Copy link
 #3

Updated by Victor Julien over 2 years ago

  • Status changed from New to Assigned
  • Assignee changed from Victor Julien to Philippe Antoine
  • Priority changed from High to Normal
  • Target version changed from TBD to 7.0.0-beta1

Philippe could you have a look at what is going on here?

Actions
Copy link
 #4

Updated by Philippe Antoine over 2 years ago

I do not reproduce the problem on latest master :

./src/suricata -l log -k none -r /Users/catena/Downloads/smb_store_error.pcap -c suricata.yaml --set stream.midstream=true --set vlan.use-for-tracking=false --set outputs.0.file-store.enabled=yes -S smb.rules

with smb.rules being alert smb any any -> any any (msg:"test filestore required"; filestore; sid:10; rev:1;)

Then
find log/filestore/ -type f gives me log/filestore//d5/d50ea1b6b3e8ed084afc47537dd3dc0a5397d7f57595a9268c56c80e88095eee

Did you --set vlan.use-for-tracking=false and enable filestore output ?

Actions
Copy link
 #5

Updated by Philippe Antoine over 2 years ago

  • Status changed from Assigned to Feedback
Actions
Copy link
 #6

Updated by Philippe Antoine over 2 years ago

  • Assignee changed from Philippe Antoine to yida zhang
Actions
Copy link
 #7

Updated by Victor Julien about 2 years ago

  • Target version changed from 7.0.0-beta1 to TBD
Actions
Copy link
 #8

Updated by Philippe Antoine about 1 year ago

  • Status changed from Feedback to Closed

Working as expected with --set vlan.use-for-tracking=false

Actions
Copy link

Also available in: Atom PDF