<div dir="ltr">With that settled I'm running into another issue. <div><br></div><div>Take these rules for example:</div><div>#rules</div><div><br><div><div>alert tcp any any -> any any (msg:"It's Alive!!! 1"; byte_extract:1,0,size; content:"123"; isdataat:!size; sid:1102014; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 2"; byte_extract:1,0,size; content:"123"; isdataat:size; sid:1102015; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 3"; byte_extract:1,0,size; content:"123"; isdataat:!size,relative; sid:1102016; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 4"; byte_extract:1,0,size; content:"123"; isdataat:size,relative; sid:1102017; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 5"; content:"123"; isdataat:!8; sid:1102018; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 6"; content:"123"; isdataat:8; sid:1102019; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 7"; content:"123"; isdataat:!8,relative; sid:1102020; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!! 8"; content:"123"; isdataat:8,relative; sid:1102021; rev:1;)</div></div><div><br></div><div>In Snort, the following hit:</div><div>1102014<br></div><div>1102016<br></div><div>1102018<br></div><div>1102020<br></div><div><br></div><div>In Suricata:</div><div>1102015<br></div><div>1102017<br></div><div>1102018<br></div><div>1102020<br></div><div><br></div><div>Is this an expected discrepancy? Seems like it has something to do with the byte_extract.</div><div><br></div><div><br></div><div>The packet data is:<br></div><div>"\x0812334567"</div><div><br></div><div>PCAP: <a href="https://packettotal.com/cgi-bin/view-analysis.cgi?id=dafb74032ed3c43806d5eea0a1e7d6c0">https://packettotal.com/cgi-bin/view-analysis.cgi?id=dafb74032ed3c43806d5eea0a1e7d6c0</a></div></div><div><br></div><div>-Harley</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 20, 2017 at 12:48 PM, Jason Williams <span dir="ltr"><<a href="mailto:jwilliams@emergingthreats.net" target="_blank">jwilliams@emergingthreats.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I ran your rules on my test rig and received the expected results:<div><br></div><div>I believe it's the spaces in your "isdataat" portion causing the rules to fire unexpectedly in suricata. We (ET) never separate fields with spaces such as in the rules provided.<br><div><br></div><div><div>#rules</div><span class=""><div><br></div><div>alert tcp any any -> any any (msg:"It's Alive!!!"; content:"Here"; isdataat:!114; sid:1102010; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!!"; content:"Here"; isdataat:114; sid:1102011; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!!"; content:"Here"; isdataat:!113; sid:1102012; rev:1;)</div><div>alert tcp any any -> any any (msg:"It's Alive!!!"; content:"Here"; isdataat:113; sid:1102013; rev:1;)</div></span></div><div><br></div><div>#results</div><div><br></div><div><div>02/23/2017-15:48:51.024811 [**] [1:1102010:1] It's Alive!!! [**] [Classification: (null)] [Priority: 3] {TCP} <a href="http://10.211.55.3:49800" target="_blank">10.211.55.3:49800</a> -> <a href="http://10.211.55.2:80" target="_blank">10.211.55.2:80</a></div><div>02/23/2017-15:48:51.024811 [**] [1:1102013:1] It's Alive!!! [**] [Classification: (null)] [Priority: 3] {TCP} <a href="http://10.211.55.3:49800" target="_blank">10.211.55.3:49800</a> -> <a href="http://10.211.55.2:80" target="_blank">10.211.55.2:80</a></div></div></div><div><br></div><div>Thanks,</div><div><br></div><div>Jason</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">On Thu, Apr 20, 2017 at 10:25 AM, Harley H <span dir="ltr"><<a href="mailto:bobb.harley@gmail.com" target="_blank">bobb.harley@gmail.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hello,<div> I'm noticing a potential issue with a negated isdataat check. I'm testing the following four rules against the pcap linked below:</div><div><div>alert tcp any any -> any any (msg: "It's Alive!!!"; content: "Here"; isdataat: !114; sid: 1102010; rev: 1;)</div><div>alert tcp any any -> any any (msg: "It's Alive!!!"; content: "Here"; isdataat: 114; sid: 1102011; rev: 1;)</div><div>alert tcp any any -> any any (msg: "It's Alive!!!"; content: "Here"; isdataat: !113; sid: 1102012; rev: 1;)</div><div>alert tcp any any -> any any (msg: "It's Alive!!!"; content: "Here"; isdataat: 113; sid: 1102013; rev: 1;)</div></div><div><br></div><div>The packet simply contains the following 114 byte string:</div><div>"Here is a 114 byte packet to test how a negated isdataat checks works in Suricata. Seems something may be amiss..."</div><div><br></div><div>I'd expect rules 1102010 and 1102013 to alert, and that is what happens in Snort. In Suricata, only 1102012 and 1102013 cause an alert. I'm using Suricata 3.2.1.</div><div><br></div><div>PCAP: <a href="https://packettotal.com/cgi-bin/view-analysis.cgi?id=438c8f1a3041b5908a20bf3e7e8e3063" target="_blank">https://packettotal.com/<wbr>cgi-bin/view-analysis.cgi?id=4<wbr>38c8f1a3041b5908a20bf3e7e8e306<wbr>3</a></div><div><br></div><div>Has anyone else noticed this or am I misunderstanding something?</div><span class="m_8092068674108884959HOEnZb"><font color="#888888"><div><br></div><div>-Harley</div></font></span></div>
<br></div></div>______________________________<wbr>_________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundati<wbr>on.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/suppor<wbr>t/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfound<wbr>ation.org/mailman/listinfo/<wbr>oisf-users</a><br>
<br></blockquote></div><br></div>
</blockquote></div><br></div>