Open Information Security Foundation

12/05/2023

09:13 PM Suricata Bug #6588: DPDK 'ips' mode doesn't pass TCP traffic

Lukas Sismis wrote in #note-3:
> Hi @ftrudeau,
>
> have you tested the functionality with other capture modes as ... Francis Trudeau

11/29/2023

11:48 PM Suricata Bug #6588: DPDK 'ips' mode doesn't pass TCP traffic

related: https://redmine.openinfosecfoundation.org/issues/6587
As mentioned in the other bug, I am finding the sa... Francis Trudeau

08:17 PM Suricata Bug #6588: DPDK 'ips' mode doesn't pass TCP traffic

IPS did not pass traffic with or without pass rules:
pass ip any any <> any any (msg:"IP pass"; sid:3031; rev:1;)
... Francis Trudeau

08:13 PM Suricata Bug #6588 (New): DPDK 'ips' mode doesn't pass TCP traffic

Tested using:
Suricata version 8.0.0-dev (d005fff7b 2023-11-24)
Suricata version 7.0.3-dev (aae6beaa5 2023-11-22)... Francis Trudeau

11:25 PM Suricata Bug #6587: DPDK 'tap' mode doesn't alert on TCP protocol rules

Jason Ish wrote in #note-1:
> Perhaps related, https://redmine.openinfosecfoundation.org/issues/5871. I've had nothin... Francis Trudeau

08:03 PM Suricata Bug #6587 (New): DPDK 'tap' mode doesn't alert on TCP protocol rules

Tested using:
Suricata version 8.0.0-dev (d005fff7b 2023-11-24)
Suricata version 7.0.3-dev (aae6beaa5 2023-11-22)... Francis Trudeau

06/24/2020

05:12 PM Suricata Bug #3780 (Rejected): Negated content with distance FP

The following signature:
alert udp any any -> any any (msg:"Negated content with distance test"; content:"|C0 0C 0... Francis Trudeau

05/04/2020

06:36 PM Suricata Bug #3691 (Closed): strip_whitespace doesn't strip_whitespace

strip_whitespace appears to do nothing. Given the following rule:... Francis Trudeau

04/16/2020

08:31 PM Suricata Bug #3616: strip_whitespace causes FN

After Peter and I mucking with this we found that _strip_whitespace_ rules work, if no other rule has _file_data_ wit... Francis Trudeau

04/07/2020

03:22 PM Suricata Bug #3616: strip_whitespace causes FN

Peter Manev wrote in #note-3:
> Yes, was thinking if it would make a diff - however - either way it alerts on my lo... Francis Trudeau