hi all: I meet a problem about mqtt detection.Key words are mqtt.reason_code and unsubscribe topic.Added some debug log and found reason_code detection can not capture packet contains reason code field. detect-mqtt-reason-code show suricata register to_server direction to detect reason_code,but i …

Question about mqtt detection

Philippe_Antoine (Philippe Antoine) October 13, 2024, 7:17pm 3

@satta this looks a bug indeed cf SV test mqtt-sub-rules not testing sid 16

1 Like

Topic		Replies	Views
mqtt.type:PUBLISH does not work as expected Rules suricata	5	567	November 7, 2022
Can't detect AMQ message Help	3	671	March 11, 2021
Some match bypass? Rules rules	27	2011	September 17, 2021
Suricata not detecting some packets in a pcap Help rules , suricata , pcaps	4	801	August 10, 2023
Decoder Events Rule - SID 2200067 Rules	3	87	February 11, 2025