Actions
Bug #6864
closedDetect: ipopts keyword misfires
Affected Versions:
Effort:
Difficulty:
Label:
Description
The ipopts keyword may be misfiring.
https://forum.suricata.io/t/suricata-cant-define-ip-options/4494/7 describes a situation where the OP requested an alert when strict source route occurs but found that the rule was creating an alert with a packet having the stream id IP option.
The rule used by the OP:
alert ip any any -> any any (ipopts: ssrr; msg: "issue"; rev: 1; sid:1;)
Files
Actions