<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'>Looks like a potential bug. If you run in IDS mode, with -i em0 without the -d 8000, and remove the ipfw rule, does it still produce the error?<br/><br/>Nick<br/><br/><br/><p>Sent from my BlackBerry Smartphone provided by Alltel</p><hr/><div><b>From: </b> Shant Kassardjian <shant@skylab.ca>
</div><div><b>Sender: </b> <pookme@hotmail.com>
</div><div><b>Date: </b>Mon, 2 Aug 2010 02:27:56 +0000</div><div><b>To: </b><oisf@rogness.net>; <oisf-users-bounces@openinfosecfoundation.org>; <william.metcalf@gmail.com></div><div><b>Cc: </b><oisf-users@openinfosecfoundation.org></div><div><b>Subject: </b>RE: [Oisf-users] Suricata - test rule ignored/not dropping.</div><div><br/></div>
<div><br></div><div>Hi Nick,</div><div><br></div><div>Yes, I have interfaces (em1, em2, em3,em4, em5) configured under bridge0, plus an em0 interface which is not part of the bridge0 and provides routing for internet connectivity.</div><div><br></div><div>here's how the flow occurs:</div><div><br></div><div>pc -> birdge0 -> em0 -> internet</div><div><br></div><div>My ipfw script is very basic</div><div><div>#!/bin/sh</div><div><br></div><div>ipfw -q -f flush</div><div>ipfw -q zero</div><div>ipfw -q resetlog</div><div><br></div><div>ipfw add 010 divert 8000 ip from any to any via em0</div></div><div><br></div><div>Configuring the suricata.yml to enable console output to yes, now provides additional details to the error message:</div><div><br></div><div><br></div><div><div><b>[100185] 1/8/2010 -- 22:11:18 - (app-layer-htp.c:391) <Error> (HTPHandleRequestData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in parsing HTTP client request: [1] [htp_request_generic.c] [150] Request field invalid: colon missing</b></div><div><br></div><div>[100185] 1/8/2010 -- 22:11:18 - (app-layer-parser.c:931) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 172.25.1.10, destination IP address 24.200.238.163, src port 51098 and dst port 80</div><div><br></div><div><b>[100185] 1/8/2010 -- 22:11:18 - (app-layer-htp.c:479) <Error> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error in parsing HTTP server response: [1] [htp_response.c] [671] Unable to match response to request</b></div><div><br></div><div>[100185] 1/8/2010 -- 22:11:18 - (app-layer-parser.c:931) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 172.25.1.10, destination IP address 24.200.238.163, src port 51100 and dst port 80</div><div><br></div><div>[100185] 1/8/2010 -- 22:11:26 - (app-layer-parser.c:931) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(59)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 172.25.1.10, destination IP address 24.200.238.163, src port 51104 and dst port 80</div></div><div><br></div><div><br></div>hope this helps!<div>Shant K<br><br>> To: shant@skylab.ca; oisf-users-bounces@openinfosecfoundation.org; william.metcalf@gmail.com<br>> CC: oisf-users@openinfosecfoundation.org<br>> Subject: Re: [Oisf-users] Suricata - test rule ignored/not dropping.<br>> From: oisf@rogness.net<br>> Date: Sun, 1 Aug 2010 20:09:25 +0000<br>> <br>> <br>> Are you bridging between interfaces? Does this happen when you are routing versus bridging?<br>> <br>> Nick<br>> <br>> Sent from my BlackBerry Smartphone provided by Alltel<br>> <br>> -----Original Message-----<br>> From: Shant Kassardjian <shant@skylab.ca><br>> Sender: oisf-users-bounces@openinfosecfoundation.org<br>> Date: Sun, 1 Aug 2010 18:24:32 <br>> To: <william.metcalf@gmail.com><br>> Cc: <oisf-users@openinfosecfoundation.org><br>> Subject: Re: [Oisf-users] Suricata - test rule ignored/not dropping.<br>> <br>>_______________________________________________<br>> Oisf-users mailing list<br>> Oisf-users@openinfosecfoundation.org<br>> http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> <br>> <br></div> </body>
</html>