Actions
Bug #6942
closeddecode/ppp: decoder.event.ppp.wrong_type on valid packet
Affected Versions:
Effort:
Difficulty:
Label:
Description
packet = PPP()/IP(src='1.1.1.1', dst='2.2.2.2')/TCP(dport=8080,sport=12345,flags='S',seq=1,options=[('WScale', 14)])
Results in a packet with a single byte PPP header. However, Suricata expects the header to be at least 4 bytes and the protocol field to be at least 2.
Wireshark accepts the packet w/o issues.
Actions