Project

General

Profile

Actions

Bug #5624

closed

quic: rule with ja3.hash keyword fails to load

Added by Victor Julien over 1 year ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

28/10/2022 -- 19:18:29 - <Error> - [ERRCODE: SC_ERR_CONFLICTING_RULE_KEYWORDS(141)] - can't set rule app proto to tls: already set to quic
28/10/2022 -- 19:18:29 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert quic any any -> any any (msg:"LOCAL QUIC new JA3"; ja3.hash; dataset:set,quic-ja3-seen, type string, state quic-ja3-seen.csv; sid:8000008;)" from file /etc/suricata/local.rules at line 10

Philippe, this is supposed to work, right?

Actions

Also available in: Atom PDF