Actions
Bug #5756
closed
VJ
EL
datasets: ipv4.src/dst, ip.src/dst check rules match on pseudo packets
Bug #5756:
datasets: ipv4.src/dst, ip.src/dst check rules match on pseudo packets
Affected Versions:
Effort:
Difficulty:
Label:
Description
Rules like these (from datasets-09-load):
alert http any any -> any any (ip.dst; dataset:isset,ipv4-list,type ipv4,load datasets-ipv4.csv; flow:established,to_server; sid:1;) alert http any any -> any any (ip.src; dataset:isset,ipv4-list,type ipv4,load datasets-ipv4.csv; flow:established,to_server; sid:2;) alert http any any -> any any (ip.dst; dataset:isset,ip-list,type ip,load datasets-ip.csv; flow:established,to_server; sid:3;)
Will trigger as well on flow timeout packets.
AH Updated by Andreas Herz over 3 years ago
@Victor Julien do you have an example for that so I can try to reproduce and debug it?
PA Updated by Philippe Antoine about 1 year ago
- Status changed from Assigned to Feedback
Well, SV test datasets-09-load show that these rules only trigger on real packets on Suricata 8
jq 'select(.alert.signature_id==1) | .pcap_cnt' output/eve.json . shows 7, 8, 10
PA Updated by Philippe Antoine 1 day ago
- Related to Bug #7318: flow: flow timeout pseudo packet triggers unexpected alert added
PA Updated by Philippe Antoine 1 day ago
- Status changed from Feedback to Closed
This was fixed by 0e4faba79ae7e9fbe36815956cfd44af6d7f9378
To reproduce, I needed to change the pcap for datasets-09-load removing the last 3 packets
Before 0e4faba79ae7e9fbe36815956cfd44af6d7f9378
jq 'select(.alert.signature_id==3) | .pkt_src' output/eve.json "wire/pcap" "stream (flow timeout)"
After
jq 'select(.alert.signature_id==3) | .pkt_src' output/eve.json "wire/pcap"
Actions