<div>The pcap is attach to this email with the following tests :</div><div>- 41 Destination Option Extension Header</div><div>- 41 Atomic Fragmentation Extension Header</div><div> </div><div>Michel<br><br></div><div class="gmail_quote">
Le 10 avril 2012 12:09, Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>></span> a écrit :<br><blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote">
<div class="im">On 04/10/2012 12:07 PM, Michel SABORDE wrote:<br>
> Hi again,<br>
><br>
> I just noticed that if you stack 42 extensions headers, for example 42<br>
> destination option, the rule is not triggered.<br>
<br>
</div>Can share a pcap?<br>
<div class="im"><br>
> Is it a config problem ?<br>
<br>
</div>No, there are no options affecting that.<br>
<br>
Cheers,<br>
Victor<br>
<div class="im"><br>
> Michel<br>
> Le 4 avril 2012 11:49, Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a><br>
</div>> <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>>> a écrit :<br>
<div><div class="h5">><br>
> On 04/03/2012 08:21 PM, Victor Julien wrote:<br>
> > On 04/03/2012 03:06 PM, Victor Julien wrote:<br>
> >> On 04/03/2012 11:28 AM, Michel SABORDE wrote:<br>
> >>> The pcap is attach to this mail.<br>
> >>> I tried with the same rule as before and no alert is trigerred.<br>
> >>> I already tried reading the pcap with suricata so this pcap should<br>
> >>> reproduce the issue.<br>
> >>> I may also have found something weird in fragmented ICMPv6 Echo<br>
> Request<br>
> >>> / Reply.<br>
> >><br>
> >> I think I found the issue. For some reason the reassembled packet<br>
> >> contains the ethernet header as well, while the decoder doesn't<br>
> expect<br>
> >> that. Working on a fix.<br>
> ><br>
> > Partial fix pushed. Alert now fires. Http.log doesn't show the request<br>
> > though, will look at that tomorrow.<br>
><br>
> Fixed that as well. Please resync with the current git master.<br>
><br>
> Thanks for the reports!<br>
><br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
><br>
> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
</div></div>> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<div class="HOEnZb"><div class="h5">><br>
><br>
<br>
<br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
</div></div></blockquote></div><br>