Bug #6733: tcp: tcp flow flags changing incorrectly when ruleset contains content matching - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #6733

closed

tcp: tcp flow flags changing incorrectly when ruleset contains content matching

Added by Lukas Sismis 3 months ago. Updated 2 months ago.

Status:

Closed

Priority:

Normal

Assignee:

Lukas Sismis

Target version:

8.0.0-beta1

Affected Versions:

7.0.2

Effort:

Difficulty:

Label:

Description

When content-matching rules are used in Suricata 7, the flow flags change from SYN to SYN-ACK.
This doesn't happen when the ruleset does not contain content-matching rules and it neither happens in Suricata 6 (never).

Files

Download all files

tcp-syn.pcap (106 Bytes) tcp-syn.pcap		Lukas Sismis, 02/04/2024 07:59 PM
content-matching.rules (118 Bytes) content-matching.rules		Lukas Sismis, 02/04/2024 08:02 PM
non-content-matching.rules (99 Bytes) non-content-matching.rules		Lukas Sismis, 02/04/2024 08:02 PM