<div dir="ltr"><div>Hello Ena,</div><div dir="ltr"><br></div><div dir="ltr">I was looking into something similar to what you reported so decided to test your scenario. <div><br></div><div>Both rules triggered an alert in my tests. I did modify the second rule, which is the one that works for you, to use "any" instead of "$HTTP_PORTS" due to my environment. Other than that I left them the same.</div><div><br></div><div>I don't know that it should matter, but I am testing this on 4.1.2. It might be useful for you to provide a packet capture as it is possible there is something else going on.</div><div><br></div><div>- Eric</div><div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 18, 2019 at 10:06 AM GORHAM JOHNSON, OZELINA <<a href="mailto:og1939@att.com">og1939@att.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_816733687427195556WordSection1">
<p class="MsoNormal">Trying to create a signature using http protocol with keywords http_header and http_uri but the signature does not match the packet<u></u><u></u></p>
<p class="MsoNormal">alert http any any -> any any (msg:"Test http headers"; content:"Host|3A| <a href="http://www.test1.url.com" target="_blank">www.test1.url.com</a>"; http_header; content:"page2"; http_uri; fast_pattern; classtype:bad-unknown; rev:10; sid:9902;)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">But if I use protocol tcp the signature matches<u></u><u></u></p>
<p class="MsoNormal">alert tcp any any -> any $HTTP_PORTS (msg:"Test REJECT page2"; content:"Host|3A| <a href="http://www.test1.url.com" target="_blank">www.test1.url.com</a>"; content:"page2"; fast_pattern; classtype:bad-unknown; rev:10; sid:2;)<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Sample Packet<u></u><u></u></p>
<p class="MsoNormal">Raw packet data<u></u><u></u></p>
<p class="MsoNormal">Hypertext Transfer Protocol<u></u><u></u></p>
<p class="MsoNormal"> GET /page2 HTTP/1.1\r\n<u></u><u></u></p>
<p class="MsoNormal"> Host: <a href="http://www.test1.url.com" target="_blank">www.test1.url.com</a>\r\n<u></u><u></u></p>
<p class="MsoNormal"> Connection: close\r\n<u></u><u></u></p>
<p class="MsoNormal"> User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4\r\n<u></u><u></u></p>
<p class="MsoNormal"> Accept: */*\r\n<u></u><u></u></p>
<p class="MsoNormal"> Accept-Language: en-us\r\n<u></u><u></u></p>
<p class="MsoNormal"> Accept-Encoding: gzip, deflate, compress\r\n<u></u><u></u></p>
<p class="MsoNormal"> \r\n<u></u><u></u></p>
<p class="MsoNormal"> [Full request URI: <a href="http://www.test1.url.com/page2" target="_blank">http://www.test1.url.com/page2</a>]<u></u><u></u></p>
<p class="MsoNormal"> [HTTP request 1/1]<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Would someone explain why the signature using the http protocol does not work<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span style="font-family:"Lucida Calligraphy"">Ena </span><u></u><u></u></p>
<p class="MsoNormal"><i><span style="font-size:9pt"><u></u> <u></u></span></i></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
_______________________________________________<br>
Suricata IDS Users mailing list: <a href="mailto:oisf-users@openinfosecfoundation.org" target="_blank">oisf-users@openinfosecfoundation.org</a><br>
Site: <a href="http://suricata-ids.org" rel="noreferrer" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" rel="noreferrer" target="_blank">http://suricata-ids.org/support/</a><br>
List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users" rel="noreferrer" target="_blank">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a><br>
<br>
Conference: <a href="https://suricon.net" rel="noreferrer" target="_blank">https://suricon.net</a><br>
Trainings: <a href="https://suricata-ids.org/training/" rel="noreferrer" target="_blank">https://suricata-ids.org/training/</a></blockquote></div></div>