<div>Well actually you don't.</div><div>I made a mistake, Snort does not reassamble the datagrams.</div><div>But Bro, if you set up a rule on IP protocol (not UDP) does reassamble.</div><div>I don't have time to investigate why Bro has choosen this behaviour, but i'm sure there is a good reason.</div>
<div>Nevertheless, if Suricata does not receive the datagrams or if it receives it in a bad order, my guess is that their are many chances that the final destination won't receive it either, or will receive it in a bad order too.</div>
<div> </div><div>I don't know what should be the correct behaviour here but maybe it is worth to investigate a little.</div><div>Maybe Suricata can reassamble datagrams from the same quadruplet i talked about before based on a timeout that you can configure ?</div>
<div> </div><div>Michel<br></div><div class="gmail_quote">2012/6/20 Victor Julien <span dir="ltr"><<a href="mailto:victor@inliniac.net" target="_blank">victor@inliniac.net</a>></span><br><blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid" class="gmail_quote">
I see. Seems wrong to me though. How do you know 2 datagrams are in<br>
order? How do you know the data is even meant to be "reassembled"?<br>
<div class="im"><br>
On 06/20/2012 09:54 AM, Michel SABORDE wrote:<br>
> I'll share a pcap later in the day.<br>
> But to clarify my request, i'm not talking about IP fragments, i'm<br>
> talking about UDP datagrams not being reassamble.<br>
> If you receive consecutively 2 UDP datagrams from the same quadruplet<br>
> (ip dest / ip source / port dest / port source ), you can usually<br>
> consider them part of the same UDP "session" (even though it's weird to<br>
> talk about "session" with UDP), it is what happen when you put an UDP<br>
> socket in connected mode.<br>
><br>
> I hope it makes more sense now :)<br>
><br>
> Michel<br>
</div>> 2012/6/20 Victor Julien <<a href="mailto:victor@inliniac.net">victor@inliniac.net</a> <mailto:<a href="mailto:victor@inliniac.net">victor@inliniac.net</a>>><br>
<div class="im">><br>
> On 06/18/2012 11:14 AM, Michel SABORDE wrote:<br>
> > Hi everyone,<br>
> ><br>
> > I set up an alert on UDP to match content:"bad.html"; as i did before<br>
> > with TCP and i discovered a strange behaviour that may be normal ...<br>
> > I send all my datagrams from the same ip dest/ip source/port dest/port<br>
> > source.<br>
> > If one datagram contains the payload "bad.html" the alert will be<br>
> > triggered but if you send two datagrams in a row which contains "bad."<br>
> > and "html", no alert will be triggered because i think, correct me if<br>
> > i'm wrong, that Suricata does not reassemble UDP datagrams.<br>
> > I know that UDP datagrams may not be received, or may be received in a<br>
> > different order but i think that it would be a nice feature anyway.<br>
> > I tried Snort and it does that kind of datagrams reassambly.<br>
><br>
> Our IP defragmentation is done on the IP packet level, so irregardless<br>
> of what protocol is used. Can you share a pcap?<br>
><br>
> --<br>
> ---------------------------------------------<br>
> Victor Julien<br>
> <a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
> PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
> ---------------------------------------------<br>
><br>
> _______________________________________________<br>
> Oisf-users mailing list<br>
> <a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a><br>
</div>> <mailto:<a href="mailto:Oisf-users@openinfosecfoundation.org">Oisf-users@openinfosecfoundation.org</a>><br>
> <a href="http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" target="_blank">http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<div class="HOEnZb"><div class="h5">><br>
><br>
<br>
<br>
--<br>
---------------------------------------------<br>
Victor Julien<br>
<a href="http://www.inliniac.net/" target="_blank">http://www.inliniac.net/</a><br>
PGP: <a href="http://www.inliniac.net/victorjulien.asc" target="_blank">http://www.inliniac.net/victorjulien.asc</a><br>
---------------------------------------------<br>
<br>
</div></div></blockquote></div><br>