Open Information Security Foundation

10/26/2020

01:34 PM Suricata Bug #3684: Specific rule is not firing against pcap if other rule is enabled

I also can't reproduce anymore with 4.1.9 and 5.0.4, neither with 6.0. I think we can close this ticket. Konstantin Klinger

04/30/2020

03:06 PM Suricata Bug #3684: Specific rule is not firing against pcap if other rule is enabled

Wireshark tells the checksum for the packet is correct. Konstantin Klinger

01:42 PM Suricata Bug #3684: Specific rule is not firing against pcap if other rule is enabled

I've tried a few other options and found out this:
1) suricata -vvv -c suricata.yaml -r miss.pcap -l . -k none
... Konstantin Klinger

09:15 AM Suricata Bug #3684: Specific rule is not firing against pcap if other rule is enabled

Running Suricata with the following command: suricata -vvv -c suricata.yaml -r miss.pcap -l . Konstantin Klinger

09:09 AM Suricata Bug #3684 (Closed): Specific rule is not firing against pcap if other rule is enabled

Hi all,
I've observed a pretty weird behaviour while investigating a rule miss against a pcap where this rule shou... Konstantin Klinger

04/23/2020

07:14 AM Suricata Feature #3663 (Closed): DNS: Parse and extract DNS NULL records

At the moment the DNS parser gives you "NULL" as rrtype, but the related metadata of those NULL records/DNS packets i... Konstantin Klinger

01/14/2020

12:28 PM Suricata Feature #1767: Support DTLS protocol

Is there any current update on this ticket? Would be great to have support, should be working with an adaption of the... Konstantin Klinger

10/04/2019

01:56 PM Suricata Bug #3216: MSN protocol detection/parser is not working

https://github.com/OISF/suricata/pull/4274 Konstantin Klinger

01:51 PM Suricata Bug #3216 (Closed): MSN protocol detection/parser is not working

From mailing list:
Hi colleagues,
I try to get an alert for the MSN parser/protocol with the following rule:
... Konstantin Klinger

05/07/2019

11:31 AM Suricata Feature #2970 (Closed): DNS: Parse and extract SOA app layer data from DNS packets

At the moment the DNS parser gives you "SOA" as rrtype, but the related metadata of those SOA records/DNS packets are... Konstantin Klinger