Bug #976
closedip_rep supplying different no of alerts for 2 different but semantically similar rules
Description
src,>,0
src,<,127
When tested on etpro's ip_rep data, gives different no of alerts, while they should be the same.
Updated by Victor Julien over 10 years ago
Found a bug, not sure if it is the issue, but definitely something.
Updated by Anoop Saldanha over 10 years ago
Rule-Set 1:
alert ip any any -> any any (iprep:src,[category],>,0; sid:1;)
Rule-Set 2:
alert ip any any -> any any (iprep:src,[category],<,127; sid:1;)
Fill category with all the available categories. Should give you 31 rules for each of the above sets.
Let me know if you need the exact ruleset I tested with.
Updated by Anoop Saldanha over 10 years ago
Looks like it has not solved the issue.
Sharing the rules privately.
Updated by Anoop Saldanha over 10 years ago
Looks like the rules specified by me were < 127, but there were ips whose value was set at 127, which essentially meant we were not matching on these ips.
Also, < 127 would mean match the entire range, which we can specify using > 0(which is the alternate ruleset against which I was testing < 127 against).
Closing bug, since this is a non-issue.
Updated by Anoop Saldanha over 10 years ago
- Status changed from Assigned to Closed