<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p style="margin-top:0;margin-bottom:0"><br>
</p>
<div style="color: rgb(0, 0, 0);">
<meta content="text/html; charset=iso-8859-1">
<div dir="ltr">
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif" dir="ltr">
<p style="margin-top:0; margin-bottom:0">Hi,</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">sorry for the basic question, but what exactly is rule 2200037 triggering on?</p>
<p style="margin-top:0; margin-bottom:0">The definition of the rule is:</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"></p>
<div>alert pkthdr any any -> any any (msg:"SURICATA TCP duplicated option"; decode-event:tcp.opt_duplicate; sid:2200037; rev:1;)<br>
</div>
<p></p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">I went on to read the source code and it seems it triggers if it detects the use of the SACK option in a packet, which is actually not bad unless you don't want to use the SACK option:</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><span class="x_keywordflow">switch</span><a class="x_code x_OWAAutoLink" id="LPlnk750900" href="https://doxygen.openinfosecfoundation.org/app-layer-dns-common_8h.html#acb5cfd209ba75c853d03f701e7f91679" previewremoved="true">type</a></p>
<div class="x_line"><a name="x_l00090" class="x_OWAAutoLink" id="LPlnk816059" previewremoved="true"></a><span class="x_lineno">90</span>
<span class="x_keywordflow">case</span> <a class="x_code x_OWAAutoLink" id="LPlnk874183" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a0917daaa1f4a3047c14cbbbf69e141a6" previewremoved="true">
TCP_OPT_WS</a>:</div>
<div class="x_line"><a name="x_l00091" class="x_OWAAutoLink" id="LPlnk408397" previewremoved="true"></a><span class="x_lineno">91</span>
<span class="x_keywordflow">if</span> (tcp_opts[tcp_opt_cnt].len != <a class="x_code x_OWAAutoLink" id="LPlnk752617" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a9fd61daadb74d49b60f89c994009e4e8" previewremoved="true">
TCP_OPT_WS_LEN</a>) {</div>
<div class="x_line"><a name="x_l00092" class="x_OWAAutoLink" id="LPlnk660974" previewremoved="true"></a><span class="x_lineno">92</span>
<a class="x_code x_OWAAutoLink" id="LPlnk850517" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code x_OWAAutoLink" id="LPlnk699824" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a34b7a336382798762b1b252ddda5d8f7" previewremoved="true">TCP_OPT_INVALID_LEN</a>);</div>
<div class="x_line"><a name="x_l00093" class="x_OWAAutoLink" id="LPlnk642365" previewremoved="true"></a><span class="x_lineno">93</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00094" class="x_OWAAutoLink" id="LPlnk835316" previewremoved="true"></a><span class="x_lineno">94</span>
<span class="x_keywordflow">if</span> (p-><a class="x_code x_OWAAutoLink" id="LPlnk235280" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code x_OWAAutoLink" id="LPlnk905092" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#a9c0cae0905a677d60ee604ce3b2c20c1" previewremoved="true">ws</a>.<a class="x_code x_OWAAutoLink" id="LPlnk761996" href="https://doxygen.openinfosecfoundation.org/structTCPOpt__.html#ac78dbf57e2dccb39ca85c44ab466f6f6" previewremoved="true">type</a>
!= 0) {</div>
<div class="x_line"><a name="x_l00095" class="x_OWAAutoLink" id="LPlnk769712" previewremoved="true"></a><span class="x_lineno">95</span>
<a class="x_code x_OWAAutoLink" id="LPlnk162710" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code x_OWAAutoLink" id="LPlnk872764" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a826a328ed2752be108de28ef71ab1867" previewremoved="true">TCP_OPT_DUPLICATE</a>);</div>
<div class="x_line"><a name="x_l00096" class="OWAAutoLink" id="LPlnk996609" previewremoved="true"></a><span class="x_lineno">96</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00097" class="OWAAutoLink" id="LPlnk607179" previewremoved="true"></a><span class="x_lineno">97</span>
<a class="x_code OWAAutoLink" id="LPlnk71098" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8c.html#af2b3fb7fd310a00638a16c14c1c85555" previewremoved="true">
SET_OPTS</a>(p-><a class="x_code OWAAutoLink" id="LPlnk990678" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk197848" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#a9c0cae0905a677d60ee604ce3b2c20c1" previewremoved="true">ws</a>,
tcp_opts[tcp_opt_cnt]);</div>
<div class="x_line"><a name="x_l00098" class="OWAAutoLink" id="LPlnk221804" previewremoved="true"></a><span class="x_lineno">98</span> }</div>
<div class="x_line"><a name="x_l00099" class="OWAAutoLink" id="LPlnk803584" previewremoved="true"></a><span class="x_lineno">99</span> }</div>
<div class="x_line"><a name="x_l00100" class="OWAAutoLink" id="LPlnk763122" previewremoved="true"></a><span class="x_lineno">100</span>
<span class="x_keywordflow">break</span>;</div>
<div class="x_line"><a name="x_l00101" class="OWAAutoLink" id="LPlnk195700" previewremoved="true"></a><span class="x_lineno">101</span>
<span class="x_keywordflow">case</span> <a class="x_code OWAAutoLink" id="LPlnk501733" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a691688604655ea8943d15f14c60027d8" previewremoved="true">
TCP_OPT_MSS</a>:</div>
<div class="x_line"><a name="x_l00102" class="OWAAutoLink" id="LPlnk35324" previewremoved="true"></a><span class="x_lineno">102</span>
<span class="x_keywordflow">if</span> (tcp_opts[tcp_opt_cnt].len != <a class="x_code OWAAutoLink" id="LPlnk94812" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a12f3bf821224b8e7b48a57ed3cea15cf" previewremoved="true">
TCP_OPT_MSS_LEN</a>) {</div>
<div class="x_line"><a name="x_l00103" class="OWAAutoLink" id="LPlnk384912" previewremoved="true"></a><span class="x_lineno">103</span>
<a class="x_code OWAAutoLink" id="LPlnk576627" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code OWAAutoLink" id="LPlnk769213" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a34b7a336382798762b1b252ddda5d8f7" previewremoved="true">TCP_OPT_INVALID_LEN</a>);</div>
<div class="x_line"><a name="x_l00104" class="OWAAutoLink" id="LPlnk884865" previewremoved="true"></a><span class="x_lineno">104</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00105" class="OWAAutoLink" id="LPlnk526629" previewremoved="true"></a><span class="x_lineno">105</span>
<span class="x_keywordflow">if</span> (p-><a class="x_code OWAAutoLink" id="LPlnk234417" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk544783" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#a12b9bc061984016142eacaee0e410b32" previewremoved="true">mss</a>.<a class="x_code OWAAutoLink" id="LPlnk505796" href="https://doxygen.openinfosecfoundation.org/structTCPOpt__.html#ac78dbf57e2dccb39ca85c44ab466f6f6" previewremoved="true">type</a>
!= 0) {</div>
<div class="x_line"><a name="x_l00106" class="OWAAutoLink" id="LPlnk117482" previewremoved="true"></a><span class="x_lineno">106</span>
<a class="x_code OWAAutoLink" id="LPlnk383445" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code OWAAutoLink" id="LPlnk764657" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a826a328ed2752be108de28ef71ab1867" previewremoved="true">TCP_OPT_DUPLICATE</a>);</div>
<div class="x_line"><a name="x_l00107" class="OWAAutoLink" id="LPlnk652194" previewremoved="true"></a><span class="x_lineno">107</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00108" class="OWAAutoLink" id="LPlnk725831" previewremoved="true"></a><span class="x_lineno">108</span>
<a class="x_code OWAAutoLink" id="LPlnk865291" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8c.html#af2b3fb7fd310a00638a16c14c1c85555" previewremoved="true">
SET_OPTS</a>(p-><a class="x_code OWAAutoLink" id="LPlnk977500" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk114375" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#a12b9bc061984016142eacaee0e410b32" previewremoved="true">mss</a>,
tcp_opts[tcp_opt_cnt]);</div>
<div class="x_line"><a name="x_l00109" class="OWAAutoLink" id="LPlnk896758" previewremoved="true"></a><span class="x_lineno">109</span> }</div>
<div class="x_line"><a name="x_l00110" class="OWAAutoLink" id="LPlnk321089" previewremoved="true"></a><span class="x_lineno">110</span> }</div>
<div class="x_line"><a name="x_l00111" class="OWAAutoLink" id="LPlnk120009" previewremoved="true"></a><span class="x_lineno">111</span>
<span class="x_keywordflow">break</span>;</div>
<div class="x_line"><a name="x_l00112" class="OWAAutoLink" id="LPlnk945010" previewremoved="true"></a><span class="x_lineno">112</span>
<span class="x_keywordflow">case</span> <a class="x_code OWAAutoLink" id="LPlnk848204" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#aefb4805eacbb5ac70a0f593856d1e3a3" previewremoved="true">
TCP_OPT_SACKOK</a>:</div>
<div class="x_line"><a name="x_l00113" class="OWAAutoLink" id="LPlnk726795" previewremoved="true"></a><span class="x_lineno">113</span>
<span class="x_keywordflow">if</span> (tcp_opts[tcp_opt_cnt].len != <a class="x_code OWAAutoLink" id="LPlnk405084" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a13cda29de3920cf0cdb7507778079183" previewremoved="true">
TCP_OPT_SACKOK_LEN</a>) {</div>
<div class="x_line"><a name="x_l00114" class="OWAAutoLink" id="LPlnk385154" previewremoved="true"></a><span class="x_lineno">114</span>
<a class="x_code OWAAutoLink" id="LPlnk521137" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code OWAAutoLink" id="LPlnk818394" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a34b7a336382798762b1b252ddda5d8f7" previewremoved="true">TCP_OPT_INVALID_LEN</a>);</div>
<div class="x_line"><a name="x_l00115" class="OWAAutoLink" id="LPlnk959797" previewremoved="true"></a><span class="x_lineno">115</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00116" class="OWAAutoLink" id="LPlnk999847" previewremoved="true"></a><span class="x_lineno">116</span>
<span class="x_keywordflow">if</span> (p-><a class="x_code OWAAutoLink" id="LPlnk993607" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk402280" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#ac165518d9d082f25f48fda84f97469d7" previewremoved="true">sackok</a>.<a class="x_code OWAAutoLink" id="LPlnk84274" href="https://doxygen.openinfosecfoundation.org/structTCPOpt__.html#ac78dbf57e2dccb39ca85c44ab466f6f6" previewremoved="true">type</a>
!= 0) {</div>
<div class="x_line"><a name="x_l00117" class="OWAAutoLink" id="LPlnk651480" previewremoved="true"></a><span class="x_lineno">117</span>
<a class="x_code OWAAutoLink" id="LPlnk435341" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code OWAAutoLink" id="LPlnk723258" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a826a328ed2752be108de28ef71ab1867" previewremoved="true">TCP_OPT_DUPLICATE</a>);</div>
<div class="x_line"><a name="x_l00118" class="OWAAutoLink" id="LPlnk186005" previewremoved="true"></a><span class="x_lineno">118</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00119" class="OWAAutoLink" id="LPlnk539726" previewremoved="true"></a><span class="x_lineno">119</span>
<a class="x_code OWAAutoLink" id="LPlnk850175" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8c.html#af2b3fb7fd310a00638a16c14c1c85555" previewremoved="true">
SET_OPTS</a>(p-><a class="x_code OWAAutoLink" id="LPlnk561568" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk99896" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#ac165518d9d082f25f48fda84f97469d7" previewremoved="true">sackok</a>,
tcp_opts[tcp_opt_cnt]);</div>
<div class="x_line"><a name="x_l00120" class="OWAAutoLink" id="LPlnk940285" previewremoved="true"></a><span class="x_lineno">120</span> }</div>
<div class="x_line"><a name="x_l00121" class="OWAAutoLink" id="LPlnk408906" previewremoved="true"></a><span class="x_lineno">121</span> }</div>
<div class="x_line"><a name="x_l00122" class="OWAAutoLink" id="LPlnk870208" previewremoved="true"></a><span class="x_lineno">122</span>
<span class="x_keywordflow">break</span>;</div>
<div class="x_line"><a name="x_l00123" class="OWAAutoLink" id="LPlnk826920" previewremoved="true"></a><span class="x_lineno">123</span>
<span class="x_keywordflow">case</span> <a class="x_code OWAAutoLink" id="LPlnk819613" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a01343751539d3b88a2c24a85148c84b1" previewremoved="true">
TCP_OPT_TS</a>:</div>
<div class="x_line"><a name="x_l00124" class="OWAAutoLink" id="LPlnk303404" previewremoved="true"></a><span class="x_lineno">124</span>
<span class="x_keywordflow">if</span> (tcp_opts[tcp_opt_cnt].len != <a class="x_code OWAAutoLink" id="LPlnk33531" href="https://doxygen.openinfosecfoundation.org/decode-tcp_8h.html#a205e00af098d2d9ea5bc06d1e33d0c53" previewremoved="true">
TCP_OPT_TS_LEN</a>) {</div>
<div class="x_line"><a name="x_l00125" class="OWAAutoLink" id="LPlnk225940" previewremoved="true"></a><span class="x_lineno">125</span>
<a class="x_code OWAAutoLink" id="LPlnk108450" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code OWAAutoLink" id="LPlnk535745" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a34b7a336382798762b1b252ddda5d8f7" previewremoved="true">TCP_OPT_INVALID_LEN</a>);</div>
<div class="x_line"><a name="x_l00126" class="OWAAutoLink" id="LPlnk707934" previewremoved="true"></a><span class="x_lineno">126</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00127" class="OWAAutoLink" id="LPlnk411243" previewremoved="true"></a><span class="x_lineno">127</span>
<span class="x_keywordflow">if</span> (p-><a class="x_code OWAAutoLink" id="LPlnk809806" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk600233" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#ab8bcc6d9e82e28ab16fa45db6f0a30a0" previewremoved="true">ts_set</a>)
{</div>
<div class="x_line"><a name="x_l00128" class="OWAAutoLink" id="LPlnk603481" previewremoved="true"></a><span class="x_lineno">128</span>
<a class="x_code OWAAutoLink" id="LPlnk529437" href="https://doxygen.openinfosecfoundation.org/decode_8h.html#ae582a247ff75a01700387306b68b4c02" previewremoved="true">
ENGINE_SET_EVENT</a>(p,<a class="x_code OWAAutoLink" id="LPlnk516255" href="https://doxygen.openinfosecfoundation.org/decode-events_8h.html#ab48899087cc647f0f791ed0c459adc53a826a328ed2752be108de28ef71ab1867" previewremoved="true">TCP_OPT_DUPLICATE</a>);</div>
<div class="x_line"><a name="x_l00129" class="OWAAutoLink" id="LPlnk509509" previewremoved="true"></a><span class="x_lineno">129</span> }
<span class="x_keywordflow">else</span> {</div>
<div class="x_line"><a name="x_l00130" class="OWAAutoLink" id="LPlnk398466" previewremoved="true"></a><span class="x_lineno">130</span> uint32_t values[2];</div>
<div class="x_line"><a name="x_l00131" class="OWAAutoLink" id="LPlnk695105" previewremoved="true"></a><span class="x_lineno">131</span> memcpy(&values, tcp_opts[tcp_opt_cnt].data,
<span class="x_keyword">sizeof</span>(values));</div>
<div class="x_line"><a name="x_l00132" class="OWAAutoLink" id="LPlnk795836" previewremoved="true"></a><span class="x_lineno">132</span> p-><a class="x_code OWAAutoLink" id="LPlnk312836" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk723760" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#a2f915ee3e94d19bb4b37d8824a3044f1" previewremoved="true">ts_val</a>
= <a class="x_code OWAAutoLink" id="LPlnk655435" href="https://doxygen.openinfosecfoundation.org/suricata-common_8h.html#ada749cfd9b340a39f613d2c4af556537" previewremoved="true">
SCNtohl</a>(values[0]);</div>
<div class="x_line"><a name="x_l00133" class="OWAAutoLink" id="LPlnk478686" previewremoved="true"></a><span class="x_lineno">133</span> p-><a class="x_code OWAAutoLink" id="LPlnk518804" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk49117" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#a97247c92e244706e0dc6db7313d1139c" previewremoved="true">ts_ecr</a>
= <a class="x_code OWAAutoLink" id="LPlnk43130" href="https://doxygen.openinfosecfoundation.org/suricata-common_8h.html#ada749cfd9b340a39f613d2c4af556537" previewremoved="true">
SCNtohl</a>(values[1]);</div>
<div class="x_line"><a name="x_l00134" class="OWAAutoLink" id="LPlnk498040" previewremoved="true"></a><span class="x_lineno">134</span> p-><a class="x_code OWAAutoLink" id="LPlnk837085" href="https://doxygen.openinfosecfoundation.org/structPacket__.html#aad18a5604814aa12c37d24d5fc0cbcfa" previewremoved="true">tcpvars</a>.<a class="x_code OWAAutoLink" id="LPlnk913332" href="https://doxygen.openinfosecfoundation.org/structTCPVars__.html#ab8bcc6d9e82e28ab16fa45db6f0a30a0" previewremoved="true">ts_set</a>
= <a class="x_code OWAAutoLink" id="LPlnk995633" href="https://doxygen.openinfosecfoundation.org/suricata-common_8h.html#aa8cecfc5c5c054d2875c03e77b7be15d" previewremoved="true">
TRUE</a>;</div>
<div class="x_line"><a name="x_l00135" class="OWAAutoLink" id="LPlnk700131" previewremoved="true"></a><span class="x_lineno">135</span> }</div>
<div class="x_line"><a name="x_l00136" class="OWAAutoLink" id="LPlnk647524" previewremoved="true"></a><span class="x_lineno">136</span> }</div>
<div class="x_line"><a name="x_l00137" class="OWAAutoLink" id="LPlnk864684" previewremoved="true"></a><span class="x_lineno">137</span>
<span class="x_keywordflow">break</span>;</div>
<p></p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">But this is my first attempt at trying to understand the alerts I am getting, so any input I can get is appreciated, thanks!!</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0">(btw, this question is unrelated to bug 1858)</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
<p style="margin-top:0; margin-bottom:0"><br>
</p>
</div>
</div>
</div>
</div>
</body>
</html>