Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

cybersecurityidsintrusion-detection-systemintrusion-prevention-systemipsnetwork-monitornetwork-monitoringnsmsecuritysuricatathreat-hunting

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Victor Julien 6b0ff0193d stream: detect and filter out bad window updates ... Reported in bug 1238 is an issue where stream reassembly can be disrupted. A packet that was in-window, but otherwise unexpected set the window to a really low value, causing the next *expected* packet to be considered out of window. This lead to missing data in the stream reassembly. The packet was unexpected in various ways: - it would ack unseen traffic - it's sequence number would not match the expected next_seq - set a really low window, while not being a proper window update Detection however, it greatly hampered by the fact that in case of packet loss, quite similar packets come in. Alerting in this case is unwanted. Ignoring/skipping packets in this case as well. The logic used in this patch is as follows. If: - the packet is not a window update AND - packet seq > next_seq AND - packet acq > next_seq (packet acks unseen data) AND - packet shrinks window more than it's own data size THEN set event and skip the packet in the stream engine. So in case of a segment with no data, any window shrinking is rejected. Bug #1238.		12 years ago
benches	Initial add of the files.	17 years ago
contrib	Add option on Tile-Gx for logging for fast.log alerts over PCIe	13 years ago
doc	Update docs from wiki	14 years ago
m4	Prelude plugin: add detection in configure script	17 years ago
qa	prscript: update URL	12 years ago
rules	stream: detect and filter out bad window updates	12 years ago
scripts	fix regression in 'make distclean' due to commit cd305c3a	12 years ago
src	stream: detect and filter out bad window updates	12 years ago
.gitignore	unittest: make check use a qa/log dir for logging	13 years ago
.travis.yml	travis-ci: use make check	12 years ago
COPYING	Initial add of the files.	17 years ago
ChangeLog	Update Changelog for 2.0.2 release	12 years ago
LICENSE	import of gplv2 LICENSE	17 years ago
Makefile.am	make install-full: get correct version of ET	13 years ago
Makefile.cvs	Initial add of the files.	17 years ago
acsite.m4	Added C99 defs/macros to acsite.m4 for CentOS	17 years ago
autogen.sh	OpenBSD 5.2 build fixes, Unit test fix.	14 years ago
classification.config	Import of classification.config	17 years ago
config.rpath	Add file needed for some autotools version.	13 years ago
configure.ac	autotools: enable silent mode	12 years ago
doxygen.cfg	doxygen: add source browser	13 years ago
reference.config	Add md5 to reference.config.	15 years ago
suricata.yaml.in	pcap-log: yaml comment update	12 years ago
threshold.config	threshold: improve comments of shipped threshold.config, add links to wiki.	14 years ago