Project

General

Profile

Actions

Bug #5379

open

detect/udp: different detection from rules when UDP/TCP header is broken

Added by Juliana Fajardini Reichow 4 months ago. Updated 3 months ago.

Status:
New
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

As reported in the forum: https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527

The rule

alert udp $EXTERNAL_NET :1024 <> $HOME_NET 0 (msg:"UDP Port 0"; sid:1;)

Generates alert with broken UDP packets (pcap attached):

05/30/2022-12:34:15.240177  [**] [1:1:0] UDP Port 0 [**] [Classification: (null)] [Priority: 3] {UDP} 192.168.100.102:0 -> 192.0.2.1:0


Files

udpport0.pcap (160 Bytes) udpport0.pcap Juliana Fajardini Reichow, 06/01/2022 09:30 PM
Actions #1

Updated by Juliana Fajardini Reichow 3 months ago

The user who reported the issue said that a similar error also occurred with TCP traffic.

Actions #2

Updated by Juliana Fajardini Reichow 3 months ago

  • Subject changed from detect/udp: different detection from rules when UDP header is broken to detect/udp: different detection from rules when UDP/TCP header is broken
Actions

Also available in: Atom PDF