Conversation
| @@ -0,0 +1,11 @@ | |||
| alert sip any any -> any any (flow:to_server; frame:pdu; content:"REGISTER"; startswith; sid:2;) | |||
| alert sip any any -> any any (flow:to_client; frame:pdu; content:"SIP/2.0 200 OK|0D 0A|"; startswith; sid:11;) | |||
There was a problem hiding this comment.
🤔 maybe we should automate the run of S-V with simulated TCP fragmentation
There was a problem hiding this comment.
TCP data (pkt 4 and 6) in sip-tcp-method/sip-tcp.pcap is already fragmented.
There was a problem hiding this comment.
Why does not a PDU frame get created with only packet 4 ?
There was a problem hiding this comment.
So, a frame gets created on packet 4 with size 400 (which is wrong)
But no tx gets created.
Then, the right frame gets created on packet 6...
There was a problem hiding this comment.
A PDU frame is created only when a packet is parsed correctly, so the behavior described above does not happen anymore.
There was a problem hiding this comment.
I think there was a bug in Suricata PR cf OISF/suricata#10037 (comment)
Discussion continues now in OISF/suricata#10058 (comment)
|
Merged in #1672, thanks! |
3 participants
Ticket
If your pull request is related to a Suricata ticket, please provide
the full URL to the ticket here so this pull request can monitor
changes to the ticket status:
Redmine ticket:
https://redmine.openinfosecfoundation.org/issues/3351