Project

General

Profile

Actions

Bug #6086

closed

Decode-events of IPv6 packets are not triggered

Added by Cole Dishington about 1 year ago. Updated about 1 year ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
low
Difficulty:
low
Label:

Description

Detection of decode-events of IPv6 packets are not triggered. I have attached a pcap, that I used for the suricata-verify test, containing IPv4 and IPv6 packets that specify proto UDP and TCP but with no payload. The following rules will be triggered for IPv4 but not for IPv6.

alert tcp any any -> any any (msg:"TCP packet too small"; decode-event:tcp.pkt_too_small; sid:1;)
alert udp any any -> any any (msg:"UDP packet too small"; decode-event:udp.hlen_too_small; sid:2;)


Files

test.pcap (264 Bytes) test.pcap Cole Dishington, 05/25/2023 12:39 AM

Subtasks 1 (0 open1 closed)

Bug #6138: Decode-events of IPv6 packets are not triggered (6.0.x backport)ClosedShivani BhardwajActions
Actions #1

Updated by Philippe Antoine about 1 year ago

  • Status changed from In Progress to In Review
Actions #2

Updated by Philippe Antoine about 1 year ago

  • Label Needs backport added
  • Label deleted (Needs Suricata-Verify test)
Actions #3

Updated by Victor Julien about 1 year ago

  • Priority changed from Normal to Low
Actions #4

Updated by Victor Julien about 1 year ago

  • Status changed from In Review to Resolved
  • Label Needs backport to 6.0 added
  • Label deleted (Needs backport)
Actions #5

Updated by Shivani Bhardwaj about 1 year ago

  • Label deleted (C)
Actions #6

Updated by Shivani Bhardwaj about 1 year ago

  • Status changed from Resolved to Assigned
Actions #7

Updated by Shivani Bhardwaj about 1 year ago

  • Status changed from Assigned to Resolved
Actions #8

Updated by Philippe Antoine about 1 year ago

Waiting for ticketbot to create the backport ticket...

Actions #9

Updated by OISF Ticketbot about 1 year ago

  • Subtask #6138 added
Actions #10

Updated by OISF Ticketbot about 1 year ago

  • Label deleted (Needs backport to 6.0)
Actions #11

Updated by Philippe Antoine about 1 year ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF