<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Eric,<div class=""> Good catch. That solved my issue. </div><div class=""><br class=""></div><div class="">Any idea how I let someone know to update the wiki?</div><div class=""><br class=""></div><div class="">Thanks</div><div class="">Jeff</div><div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""></div>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Feb 22, 2017, at 2:46 PM, Eric Leblond <<a href="mailto:eric@regit.org" class="">eric@regit.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi,<br class=""><br class="">On Wed, 2017-02-22 at 19:39 +0000, Collyer, Jeffrey W. (jwc3f) wrote:<br class=""><blockquote type="cite" class="">I believe this rule was running under 3.2.0 but after upgrading to<br class="">3.2.1, suricata is throwing errors on startup. Not sure if the<br class="">upgrade is just coincidence or not.<br class=""><br class="">The rule is from the web page - <a href="https://redmine.openinfosecfoundation" class="">https://redmine.openinfosecfoundation</a><br class="">.org/projects/suricata/wiki/Protocol_Anomalies_Detection<br class=""><br class="">alert http any any -> any 443 (msg:"SURICATA HTTP clear text on port<br class="">443"; flow:to_server; app-layer-protocol:http; sid:2271019; rev:1;)<br class=""></blockquote><br class="">This does not look correct.<br class=""><br class=""><blockquote type="cite" class="">and the errors are<br class="">21/2/2017 -- 10:33:11 - <Info> - Running suricata under test mode<br class="">21/2/2017 -- 10:33:11 - <Notice> - This is Suricata version 3.2.1<br class="">RELEASE<br class="">21/2/2017 -- 10:33:11 - <Error> - [ERRCODE:<br class="">SC_ERR_CONFLICTING_RULE_KEYWORDS(141)] - Either we already have the<br class="">rule match on an app layer protocol set through other keywords that<br class="">match on this protocol, or have already seen a non-negated app-layer-<br class="">protocol.<br class=""></blockquote><br class="">Error make sense as the rule asks twice for http. Use instead:<br class=""><br class="">alert tcp any any -> any 443 (msg:"SURICATA HTTP clear text on port 443"; flow:to_server; app-layer-protocol:http; sid:2271019; rev:1;)<br class=""><br class="">++<br class="">-- <br class="">Eric Leblond <<a href="mailto:eric@regit.org" class="">eric@regit.org</a>><br class=""></div></div></blockquote></div><br class=""></body></html>