# Can't detect AMQ message

**URL:** <https://forum.suricata.io/t/cant-detect-amq-message/1203>\
**Category:** Help\
**Created:** [March 10, 2021, 7:05am UTC](https://forum.suricata.io/t/cant-detect-amq-message/1203 "2021-03-10T07:05:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![han0x7300](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/han0x7300/32/691_2.png) [@han0x7300](https://forum.suricata.io/u/han0x7300)\
**Post date:** [March 10, 2021, 7:05am UTC](https://forum.suricata.io/t/cant-detect-amq-message/1203/1 "2021-03-10T07:05:05Z")

</div>

Hi,  
I am trying to detect some byte in my pcap [CVE-2015-5254\_ActiveMQ\_Deserialization.pcapng](https://forum.suricata.io/uploads/short-url/nnOrFCTfhh0HmBN3nL51kpSOz0M.pcapng) (7.7 KB) ,but suricata can’t detect keyword( **1a** ) in my pcap,

 ![Screenshot 2021-03-10 150150](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/d8e0483921548f0b243c5979d8fc393027e71073.png)  
even use such loose rules:

```
alert ip any any <> any any (msg:"111"; content:"|1a|";sid:10082; rev:1;)
alert tcp any any <> any any (msg:"111"; content:"|1a|";sid:10083; rev:1;)
alert tcp any any -> any any (msg:"111"; content:"|1a|";sid:10084; rev:1;)

```

after run suricata , no alart appear.

```
┌──(hans㉿kali-xps)-[~/suricata-rules]
└─$ rm logs/*
┌──(hans㉿kali-xps)-[~/suricata-rules]
└─$ cat 1.rules 
alert ip any any <> any any (msg:"111"; content:"|1a|";sid:10082; rev:1;)
alert tcp any any <> any any (msg:"111"; content:"|1a|";sid:10083; rev:1;)
alert tcp any any -> any any (msg:"111"; content:"|1a|";sid:10084; rev:1;)┌──(hans㉿kali-xps)-[~/suricata-rules]
└─$ pwd
/home/hans/suricata-rules
┌──(hans㉿kali-xps)-[~/suricata-rules]
└─$ suricata -r pcap/CVE-2015-5254_ActiveMQ_Deserialization.pcapng -S ~/suricata-rules/1.rules -l ~/suricata-rules/logs/ -k none
10/3/2021 -- 23:28:14 - <Notice> - This is Suricata version 6.0.1 RELEASE running in USER mode
10/3/2021 -- 23:28:14 - <Notice> - all 5 packet processing threads, 4 management threads initialized, engine started.
10/3/2021 -- 23:28:14 - <Notice> - Signal Received. Stopping engine.
10/3/2021 -- 23:28:14 - <Notice> - Pcap-file module read 1 files, 37 packets, 6147 bytes
┌──(hans㉿kali-xps)-[~/suricata-rules]
└─$ cat logs/fast.log 
┌──(hans㉿kali-xps)-[~/suricata-rules]
└─$ 

```

It’s [CVE-2015-5254 ActiveMQ Deserialization](https://github.com/vulhub/vulhub/tree/master/activemq/CVE-2015-5254)  
Anyone can help me,thanks.

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [March 10, 2021, 3:21pm UTC](https://forum.suricata.io/t/cant-detect-amq-message/1203/2 "2021-03-10T15:21:16Z")

</div>

It seems the pcap is recorded with offloads enabled, and Suricata can’t figure it out. If you run it you will see this stat:

 ![Screenshot from 2021-03-10 16-16-17](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/ee94b88faa927998c108c2ff2fc892358707b003.png)

Also, I you enable the `decode` option in your eve.anomaly section you will get

```json
{
  "timestamp": "2021-03-09T09:05:35.778232+0100",
  "pcap_cnt": 22,
  "event_type": "anomaly",
  "src_ip": "",
  "src_port": 0,
  "dest_ip": "",
  "dest_port": 0,
  "proto": "",
  "anomaly": {
    "type": "decode",
    "event": "decoder.ipv4.iplen_smaller_than_hlen"
  }
}

```

On packet 22, the packet you’re trying to match in.

If we look in wireshark, a “TSO” warning stands out:  
 ![Screenshot from 2021-03-10 16-19-04](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/29d38156906e5f53e2257925d02531f4bcc3d392.png)

So the pcap has an invalid length field in packet 22, probably because of offloads during the packet capture, and therefore Suricata rejects the packet as bad before its content is inspected.

---

<div class="post-metadata">

**Author:** ![han0x7300](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/han0x7300/32/691_2.png) [@han0x7300](https://forum.suricata.io/u/han0x7300)\
**Post date:** [March 11, 2021, 2:35am UTC](https://forum.suricata.io/t/cant-detect-amq-message/1203/3 "2021-03-11T02:35:10Z")

</div>

appreciate!  
after reference this [link](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.networking.doc/GUID-D80AEC2F-E0DA-4172-BFFD-B721BF36C2E8.html) and disable TSO ,recapture pcap, everything works fine.  
learn a lot.🌹

---

<div class="post-metadata">

**Author:** ![han0x7300](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/han0x7300/32/691_2.png) [@han0x7300](https://forum.suricata.io/u/han0x7300)\
**Post date:** [March 11, 2021, 7:31am UTC](https://forum.suricata.io/t/cant-detect-amq-message/1203/4 "2021-03-11T07:31:53Z")

</div>

[https://blog.73007300.xyz/?p=468](https://blog.73007300.xyz/?p=468)