Hi, I am trying to detect some byte in my pcap CVE-2015-5254_ActiveMQ_Deserialization.pcapng (7.7 KB) ,but suricata can’t detect keyword(1a) in my pcap, [Screenshot 2021-03-10 150150] even use such loose rules: alert ip any any <> any any (msg:"111"; content:"|1a|";sid:10082; rev:1;) alert tc…

It seems the pcap is recorded with offloads enabled, and Suricata can’t figure it out. If you run it you will see this stat: [Screenshot from 2021-03-10 16-16-17] Also, I you enable the decode option in your eve.anomaly section you will get { "timestamp": "2021-03-09T09:05:35.778232+0100", "…

Can't detect AMQ message

Help

han0x7300 (han0x7300) March 11, 2021, 7:31am 4

https://blog.73007300.xyz/?p=468

Topic		Replies	Views
Some match bypass? Rules rules	27	2021	September 17, 2021
Suricata not detecting some packets in a pcap Help rules , suricata , pcaps	4	821	August 10, 2023
Suricata not trigger Alert via file Pcap record from Wireshark Help	5	1080	June 8, 2023
mqtt.type:PUBLISH does not work as expected Rules suricata	5	572	November 7, 2022
Suricata can't parse http packet Help	2	715	January 23, 2022

Can't detect AMQ message

Related topics