hi all: I meet a problem about mqtt detection.Key words are mqtt.reason_code and unsubscribe topic.Added some debug log and found reason_code detection can not capture packet contains reason code field. detect-mqtt-reason-code show suricata register to_server direction to detect reason_code,but i …

Question about mqtt detection

Philippe_Antoine (Philippe Antoine) October 13, 2024, 7:17pm 3

@satta this looks a bug indeed cf SV test mqtt-sub-rules not testing sid 16

1 Like

Topic		Replies	Views
mqtt.type:PUBLISH does not work as expected Rules suricata	5	550	November 7, 2022
Can't detect AMQ message Help	3	666	March 11, 2021
Some match bypass? Rules rules	27	1949	September 17, 2021
Suricata not detecting some packets in a pcap Help rules , suricata , pcaps	4	703	August 10, 2023
Some questions about mqtt Help	9	1144	December 27, 2021