<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>Today I was trying to create a rule to detect some HTTP activity using a PCAP. I've done this without issue before but anytime I tried to use HTTP_URI, or any HTTP_ buffer the signature would fail. I also create a quick luajit script to print out the payload and it would contain the entire URI, HEADERS and BODY. If I used http.request_body it wouldn't contain anything. The only thing different from this pcap to some of the others I've used is that it's a partial pcap in that it doesn't contain the 3-way handshake to the server. Is there a command line option or config change to ignore the 3-way handshake and parse everything into the proper buffers or is there another issue?</div>
<div> </div>
<div>> /opt/suricata/bin/suricata -V<br/>
This is Suricata version 3.2beta1 RELEASE<br/>
</div>
<div>alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"Spark v1.1"; content:"loading.php"; http_uri; content:"Spark v1.1"; http_header; luajit:myscript.lua; sid:11223344; rev:1;)</div>
<div> </div>
<div>myscript.lua</div>
<div>
<div>function init (args)<br/>
local needs = {}<br/>
needs["payload"] = tostring(true)<br/>
return needs<br/>
end</div>
<div>function match(args)<br/>
a = tostring(args["payload"])<br/>
if #a > 0 then<br/>
if a:find("Spark v1.1") then<br/>
print(a)<br/>
return 1<br/>
end<br/>
end</div>
<div> return 0<br/>
end</div>
<div>return 0</div>
</div></div></body></html>