# Different detection from rules when UDP header is broken

**URL:** <https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527>\
**Category:** Developers\
**Created:** [May 31, 2022, 1:56am UTC](https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527 "2022-05-31T01:56:02Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![toushimi](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/toushimi/32/1455_2.png) [@toushimi](https://forum.suricata.io/u/toushimi)\
**Post date:** [May 31, 2022, 1:56am UTC](https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527/1 "2022-05-31T01:56:02Z")

</div>

Hi, I don’t know where to file a bug report, so I wrote it here.

This rule detects broken UDP packets.

```auto
alert udp $EXTERNAL_NET :1024 <> $HOME_NET 0 (msg:"UDP Port 0"; sid:1;)

```

The broken UDP packet is this.

 ![スクリーンショット 2022-05-31 103118](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/0/04c6e1291b821ae86087d9eb39bf6d65c49df69e.png)

[udpport0.pcap](https://forum.suricata.io/uploads/short-url/1zKctfAcHScbFqdj5b41LBpRRO8.pcap) (160 Bytes)

Here’s the detection result.

```auto
05/30/2022-12:34:15.240177 [**] [1:1:0] UDP Port 0 [**] [Classification: (null)] [Priority: 3] {UDP} 192.168.100.102:0 -> 192.0.2.1:0

```

my environment  
Version: 6.0.5 RELEASE  
Installation: RPM package from copr  
OS: Rocky Linux 8.5

If there is any other information needed, I will provide it.

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [June 1, 2022, 9:32pm UTC](https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527/2 "2022-06-01T21:32:12Z")

</div>

Hello Toushimi,

thanks for your report!  
I’ve created an issue in our project tracker ([Bug #5379: detect/udp: different detection from rules when UDP header is broken - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/5379)) and will investigate it, with time 🙂

We’ll reach out if we need more info, too!

---

<div class="post-metadata">

**Author:** ![toushimi](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/toushimi/32/1455_2.png) [@toushimi](https://forum.suricata.io/u/toushimi)\
**Post date:** [June 6, 2022, 1:22am UTC](https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527/3 "2022-06-06T01:22:38Z")

</div>

A similar error occurred with TCP.  
It appears that it is not limited to UDP.

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [June 14, 2022, 12:33pm UTC](https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527/4 "2022-06-14T12:33:00Z")

</div>

Oh, ok, thanks for pointing that out. (and sorry for the late answer!)

If you have anything from that other error that you could share (if you prefer, you can also share via a private message), that would be appreciated 🙂

In the mean time, I’ve updated the ticket accordingly.

---

<div class="post-metadata">

**Author:** ![sbhardwaj](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/sbhardwaj/32/10_2.png) [@sbhardwaj](https://forum.suricata.io/u/sbhardwaj)\
**Post date:** [January 4, 2023, 7:31am UTC](https://forum.suricata.io/t/different-detection-from-rules-when-udp-header-is-broken/2527/5 "2023-01-04T07:31:14Z")

</div>

Hello!

Thank you for the report! And, thanks Juliana for creating the ticket.

We have a fix for UDP here if you’d like to give it a try: [Pr 8341 and payload len fix/v1 by inashivb · Pull Request #8342 · OISF/suricata · GitHub](https://github.com/OISF/suricata/pull/8342)  
Do you by any chance have a pcap for TCP as well where it fails? It’s to add the tests to our infrastructure.  
Thank you very much!  
Apologies for the delay.