Actions
Bug #6191
closed
IX
SB
if protocol dcerpc first packet type is Alter_context, it will not parse dcerpc
Bug #6191:
if protocol dcerpc first packet type is Alter_context, it will not parse dcerpc
Affected Versions:
Effort:
medium
Difficulty:
Label:
Description
When i use a dcerpc pcap, the first packet type is Alter_context, and next packet is Alter_context_resp. In this case, Suricata will not parse this pcap file.Because engine thought first packet is a response, and error is occurred.
file location is rust/src/dcerpc/dcerpc.rs:1337,
let is_request = hdr.hdrtype 0x00;
modify it as:
let is_request = hdr.hdrtype 0x00 || hdr.hdrtype == 0x0e;
it fix.
Files
Actions