SB Shivani Bhardwaj
- Login: unixia
- Registered on: 09/29/2018
- Last sign in: 07/14/2026
Issues
| open | closed | Total | |
|---|---|---|---|
| Assigned issues | 36 | 431 | 467 |
| Reported issues | 73 | 296 | 369 |
Projects
| Project | Roles | Registered on |
|---|---|---|
| Suricata | Developer, OISF Team, OISF Manager | 08/17/2023 |
| Suricata-Update | Developer, OISF Team, OISF Manager | 08/17/2023 |
Activity
Today
- SB 11:31 AM Suricata Feature #8762 (Assigned): dcerpc: record unhandled PDU types
- DCERPC parser only handles and logs 3 types of request/response pairs:
1. REQUEST/RESPONSE
2. BIND/BIND_ACK
3. ALTER_CONTEXT/ALTER_CONTEXT_RESP
All the other unhandled types that are parsed from the header are not even logged/avail... - SB 06:54 AM Suricata Bug #8759 (Assigned): dcerpc: default PDU type always set to request/response
- While creating a new transaction in the DCERPC parser, the default constructor unconditionally sets the tx PDU to request/response. There are several different types of PDU available in DCERPC. Moreover, the PDU type information must be ...
- SB 05:05 AM Suricata Task #8692: tracking: detect: DCERPC keywords coverage
- Hi @stu4rt ! Could you please tell your expectations regarding "dcerpc.flags" being a sticky keyword? I was going to implement it as an integer like "tcp.flags" but checked this description before to get an idea of what's needed. Stringi...
07/20/2026
- SB 01:52 PM Suricata Bug #8752 (Assigned): defrag: memuse reported incorrectly
- SB 01:51 PM Suricata Feature #8749 (Triaged): smb: add rule keyword support for status matches
07/17/2026
- SB 07:11 AM Suricata Feature #8748 (Triaged): detect: rule keyword to match on unregistered ip protocol payload
- Thanks, Stuart!
Some complications I can think of are:
1. Fragmented IP
2. Different acceptable exceptional conditions specific to different IP protocols
We'll discuss this internally and get back. Please note that with most folk...
07/14/2026
- SB 01:32 PM Suricata Bug #8742 (Feedback): base64: SCBase64Decode creates an out-of-bounds slice when callers allocate only the decoded size
- Could you please tell what's the effect of the bigger output array?
Please share a testcase if you have. Thank you. - SB 11:59 AM Suricata Bug #8741 (Assigned): smtp: complete BDAT transactions at LAST
07/10/2026
- SB 12:01 PM Suricata Feature #8736 (Assigned): detect: rule keyword for dcerpc.is_fragmented
- Standalone bool keyword to tell if the current PDU is fragmented.
- SB 12:00 PM Suricata Task #8692: tracking: detect: DCERPC keywords coverage
- JFYI, DCERPC header is already available through the frame support using the syntax: @frame:dcerpc.hdr@. I'll also add a regular sticky buffer though. Added a ticket for that. :)