<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body>Anyone interested please? <div><br></div><div>Regards </div><div>@Rmkml </div><div><br></div><br><br>-------- Message d'origine --------<br>De : rmkml <rmkml@yahoo.fr> <br>Date : 18/01/2015 01:27 (GMT+01:00) <br>À : oisf-devel@openinfosecfoundation.org <br>Cc : rmkml@yahoo.fr <br>Objet : sctp fp on suricata engine <br><br>Hello,<br><br>First, Happy New Year all and Thx for Suricata developpment!<br><br>I'm continue Suricata testing and 1) found a fp with this (simplified) sig on joigned sctp pcap file:<br><br>alert ip any any -> any any (msg:"SCTP Suricata test 1"; ip_proto:132; content:"|00 07 02 10|"; offset:0; depth:4; classtype:attempted-admin; sid:1; rev:1; )<br><br>-> Suricata v2.0.6 fire or v2.1beta2 fire but NOT snort2.<br><br>02/18/2005-09:49:58.694007 [**] [1:1:1] SCTP Suricata test 1 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {SCTP} 192.168.170.56:7 -> 192.168.170.8:7<br><br>tcpdump dump with joigned sctp pcap file:<br><br>09:49:58.694007 IP (tos 0x0, ttl 128, id 45300, offset 0, flags [none], proto SCTP (132), length560)<br> 192.168.170.56.7 > 192.168.170.8.7: sctp<br> 1) [DATA] (U)(B)(E) [TSN: 13852] [SID: 8] [SSEQ 0] [PPID 0x0] [Payload]<br> 0x0000: 4500 0230 b0f4 0000 8084 b1c3 c0a8 aa38 E..0...........8<br> 0x0010: c0a8 aa08 0007 0007 4323 2544 3ade fb02 ........C#%D:...<br> 0x0020: 0007 0210 0000 361c 0008 0000 0000 0000 ......6.........<br> ---------<br> ...<br><br><br>2) or suricata fp (but not snort2) with this similar sig without ip_proto:132 :<br><br>alert ip any any -> any any (msg:"SCTP Suricata test 2"; content:"|00 07 02 10|"; offset:0; depth:4; classtype:attempted-admin; sid:2; rev:1; )<br><br>02/18/2005-09:49:58.694007 [**] [1:2:1] SCTP Suricata test 3 [**] [Classification: Attempted Administrator Privilege Gain] [Priority: 1] {SCTP} 192.168.170.56:7 -> 192.168.170.8:7<br><br><br>3) for information, post a true sig sctp fire:<br><br>alert sctp any any -> any any (msg:"SCTP Suricata test 3"; content:"|00 07 02 10|"; offset:0; depth:4; classtype:attempted-admin; sid:3; rev:1; )<br><br><br>If you confirm 1) and 2), I'm open a new redmine ticket.<br><br>Regards<br>@Rmkml</body></html>