<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Hi,</div><div id="AppleMailSignature"><br></div><div><br>On 25 Jun 2017, at 15:31, Kevin Geil <<a href="mailto:info@friendandfamilytech.com">info@friendandfamilytech.com</a>> wrote:<br><br></div><blockquote type="cite"><div><div dir="ltr"><div><div><div><div>Hi, I'm trying to get suricata to detect credit card
numbers transmitted in cleartext, and am having some trouble. I am
using the rules referenced here: <a href="http://doc.emergingthreats.net/2001375" target="_blank">doc.emergingthreats.net/<wbr>2001375</a>
Through 2001383. I have tested the regexes against my test data, and
have confirmed that they match. I'm trying to test using <a href="http://dlptest.com" target="_blank">dlptest.com</a>
(and other similar sites), and can't get the rules to fire, using
either http or FTP. I have tested Suricata by using suspicious user
agent strings, and have confirmed that it's working.<br></div></div></div></div></div></div></blockquote><div><br></div><div><br></div><div>How exactly do you do your test exactly ?</div><div>If it is simply via visiting via a browser - browser cache may come into play so I suggest using wget instead.</div><br><blockquote type="cite"><div><div dir="ltr"><div><div><div><div><br></div>I
haven't found anything in documentation regarding this, but I'm thinking
my suricata instance (the one built in to Alienvault's OSSIM) is
somehow configured to only look at http and ftp headers. Perhaps that's
not my problem at all.<br><br></div>In any case, if someone could point me in the right direction on how to get these rules to fire, I'd greatly appreciate it.<br><br></div></div></div></div></blockquote><div><br></div><div>If it is a live test make sure NIC offloading is disabled and the traffic is seen by Suri. You can try to capture a pcap and run against to reproduce if needed.</div><div>By the way a plain ip rule with only a pcre inside will decimate your performance on live traffic.</div><div><br></div><div>Thanks</div><div><br></div><div><br></div><br><blockquote type="cite"><div><div dir="ltr"><div>Thank you.<br><br></div>Kevin<br></div>
</div></blockquote><blockquote type="cite"><div><span>_______________________________________________</span><br><span>Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a></span><br><span>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a></span><br><span>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a></span><br></div></blockquote></body></html>