Project

General

Profile

Actions
Copy link

Bug #5379

closed

detect/udp: different detection from rules when UDP/TCP header is broken

Added by Juliana Fajardini Reichow over 2 years ago. Updated almost 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
7.0.0-rc1
Affected Versions:
6.0.5
Effort:
Difficulty:
Label:

Description

As reported in the forum: https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527

The rule 

alert udp $EXTERNAL_NET :1024 <> $HOME_NET 0 (msg:"UDP Port 0"; sid:1;)

Generates alert with broken UDP packets (pcap attached):

05/30/2022-12:34:15.240177  [**] [1:1:0] UDP Port 0 [**] [Classification: (null)] [Priority: 3] {UDP} 192.168.100.102:0 -> 192.0.2.1:0

Files

udpport0.pcap (160 Bytes) udpport0.pcap Juliana Fajardini Reichow, 06/01/2022 09:30 PM

Subtasks 1 (0 open — 1 closed)

Bug #5795: detect/udp: different detection from rules when UDP/TCP header is broken (6.0.x backport)ClosedShivani BhardwajActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #5693: decode: Padded packet to minimal Ethernet length marked with invalid length eventClosedLukas SismisActions
Actions
Copy link

Also available in: Atom PDF