Odd problem with EXTERNAL_NET

This is a bit of a head scratcher with 6.0.x. Below are the 2 variables defined for address-groups:

HOME_NET: "[,,,,]"

I have created a silly rule as:
alert tcp any any -> $EXTERNAL_NET any (msg:"My silly signature"; classtype:misc-activity; sid:3450000; rev:1;)
The goal is just to make sure things trigger the right way.

While the very same set of address-groups works fine in 4.x, I cannot figure out why EXTERNAL_NET definition does not trigger, but if I restrict it to:
then everything works as expected.

( I have tried different orders, different bracketting, … nothing helped).

Does this look like “user error”? did I skip a chapter in the book? any other idea?



Adding extra details, the above definition for EXTERNAL_NET using leads to “insufficient memory” when processing rules (per suricata.log)
Using instead:


matches the described behavior (i.e., no detection).

What version are you using?

(Silly me forgettting about the basics :slight_smile: )

Trying to move from 4.x to 6.0.12…

Hi Chris,

Have you tried removing the space between the comma and the entry?