Project

General

Profile

Actions
Copy link

Bug #5379

closed

detect/udp: different detection from rules when UDP/TCP header is broken

Added by Juliana Fajardini Reichow over 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
7.0.0-rc1
Affected Versions:
6.0.5
Effort:
Difficulty:
Label:

Description

As reported in the forum: https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527

The rule 

alert udp $EXTERNAL_NET :1024 <> $HOME_NET 0 (msg:"UDP Port 0"; sid:1;)

Generates alert with broken UDP packets (pcap attached):

05/30/2022-12:34:15.240177  [**] [1:1:0] UDP Port 0 [**] [Classification: (null)] [Priority: 3] {UDP} 192.168.100.102:0 -> 192.0.2.1:0

Files

udpport0.pcap (160 Bytes) udpport0.pcap Juliana Fajardini Reichow, 06/01/2022 09:30 PM

Subtasks 1 (0 open — 1 closed)

Bug #5795: detect/udp: different detection from rules when UDP/TCP header is broken (6.0.x backport)ClosedShivani BhardwajActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #5693: decode: Padded packet to minimal Ethernet length marked with invalid length eventClosedLukas SismisActions
Actions
Copy link
 #1

Updated by Juliana Fajardini Reichow over 2 years ago

The user who reported the issue said that a similar error also occurred with TCP traffic.

Actions
Copy link
 #2

Updated by Juliana Fajardini Reichow over 2 years ago

  • Subject changed from detect/udp: different detection from rules when UDP header is broken to detect/udp: different detection from rules when UDP/TCP header is broken
Actions
Copy link
 #3

Updated by Victor Julien about 2 years ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions
Copy link
 #4

Updated by Victor Julien about 2 years ago

  • Assignee changed from Juliana Fajardini Reichow to OISF Dev
Actions
Copy link
 #5

Updated by Shivani Bhardwaj about 2 years ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
Actions
Copy link
 #6

Updated by Shivani Bhardwaj almost 2 years ago

  • Related to Bug #5693: decode: Padded packet to minimal Ethernet length marked with invalid length event added
Actions
Copy link
 #7

Updated by Shivani Bhardwaj almost 2 years ago

  • Status changed from Assigned to In Review
Actions
Copy link
 #8

Updated by Shivani Bhardwaj almost 2 years ago

  • Label Needs backport to 6.0 added
Actions
Copy link
 #10

Updated by Shivani Bhardwaj almost 2 years ago

  • Subtask #5795 added
Actions
Copy link
 #11

Updated by Shivani Bhardwaj almost 2 years ago

  • Label deleted (Needs backport to 6.0)
Actions
Copy link
 #12

Updated by Shivani Bhardwaj almost 2 years ago

  • Status changed from In Review to Resolved
Actions
Copy link
 #13

Updated by Victor Julien almost 2 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF