ssh: do not enforce pcap_cnt

[catenacyber]

Ticket

Redmine ticket: None

Prerequisite for OISF/suricata#10307 and next

[jufajardini]

Looks good to me, thanks for adding an explanation in the commit message!

[jasonish]

Should we then be checking that pcap_cnt doesn't exist on the event? Not sure if S-V handles this case, but its probably worth doing than just removing the check.

[catenacyber]

I think the important test is that we get the alert.
Getting it on packet 7, or pseudo packet timing out the flow is less important.

If we really want to test this, are we sure we want to consider packet 7 as invalid and not run tx detection on it ?

[jasonish]

If we really want to test this, are we sure we want to consider packet 7 as invalid and not run tx detection on it ?

I don't know specifically. But S-V is about detecting changes in behaviour as well. If it used to be 7, and some fix made the field go away, I think that should be encoded in the test, to detect if it ever comes back unintentionally.

[catenacyber]

Continued in #1640

[catenacyber]

If we really want to test this, are we sure we want to consider packet 7 as invalid and not run tx detection on it ?

I don't know specifically. But S-V is about detecting changes in behaviour as well. If it used to be 7, and some fix made the field go away, I think that should be encoded in the test, to detect if it ever comes back unintentionally.

Did something in next version of the PR