mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
ba5e850264
SIP and SSDP share method names like NOTIFY and SUBSCRIBE,
causing SSDP traffic to be misidentified as SIP.
Add a probing parser callback that checks for "SIP/" in the
payload before accepting a pattern match.
Example of a misidentified flow before the fix:
{"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250
","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"sip","flow":{"..."}}
After the fix:
{"timestamp":"2014-02-27T19:44:43.164211+0100","flow_id":986757542077835,"event_type":"flow","src_ip":"192.168.1.1","src_port":9489,"dest_ip":"239.255.255.250
","dest_port":1900,"ip_v":4,"proto":"UDP","app_proto":"failed","flow":{"..."}}
Ticket #8355
|
3 months ago | |
|---|---|---|
| .. | ||
| applayertemplate | 4 months ago | |
| asn1 | 4 months ago | |
| bittorrent_dht | 4 months ago | |
| dcerpc | 4 months ago | |
| detect | 4 months ago | |
| dhcp | 3 months ago | |
| dnp3 | 10 months ago | |
| dns | 3 months ago | |
| enip | 4 months ago | |
| ffi | 4 months ago | |
| ftp | 4 months ago | |
| http2 | 3 months ago | |
| ike | 4 months ago | |
| krb | 5 months ago | |
| ldap | 4 months ago | |
| llmnr | 3 months ago | |
| mdns | 9 months ago | |
| mime | 4 months ago | |
| modbus | 4 months ago | |
| mqtt | 4 months ago | |
| nfs | 4 months ago | |
| ntp | 4 months ago | |
| pgsql | 4 months ago | |
| pop3 | 7 months ago | |
| quic | 4 months ago | |
| rdp | 3 months ago | |
| rfb | 4 months ago | |
| sctp | 3 months ago | |
| sdp | 3 months ago | |
| sip | 3 months ago | |
| smb | 3 months ago | |
| snmp | 3 months ago | |
| ssh | 4 months ago | |
| telnet | 3 months ago | |
| tftp | 3 months ago | |
| utils | 4 months ago | |
| websocket | 4 months ago | |
| x509 | 3 months ago | |
| applayer.rs | 4 months ago | |
| common.rs | 4 months ago | |
| conf.rs | 5 months ago | |
| core.rs | 4 months ago | |
| debug.rs | 4 months ago | |
| encryption.rs | 8 months ago | |
| feature.rs | 10 months ago | |
| filecontainer.rs | 10 months ago | |
| filetracker.rs | 3 years ago | |
| flow.rs | 7 months ago | |
| frames.rs | 7 months ago | |
| handshake.rs | 1 year ago | |
| ja4.rs | 1 year ago | |
| jsonbuilder.rs | 4 months ago | |
| kerberos.rs | 1 year ago | |
| lib.rs | 3 months ago | |
| lua.rs | 4 months ago | |
| lzma.rs | 3 years ago | |
| tls_version.rs | 1 year ago | |
| util.rs | 8 months ago | |