Rule has unknown dest port var and will be disabled

Hi all,

Rule question here: I am making the following adjustment (Suricata 6.0.3):

2036303 "\\$HOME_NET any -> \\$EXTERNAL_NET 80" "[$HOME_NET,![]] any -> $EXTERNAL_NET 80"

I get the following warning message:

25/5/2022 -- 09:38:21 - <Warning> -- Rule has unknown dest port var and will be disabled: EXTERNAL_NET: [1:2036303] ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check

Thanks for the insight!

Hi, I think you would be good if did [$HOME_NET, !] any → $EXTERNAL_NET 80?

1 Like

Thanks @jmtaylor90, that works, but now I got another popping up:

2025703 "any any -> \\$HOME_NET 445" "[any,![,]] any -> $HOME_NET 445"

Drives met nutz!

Did you get this one figured out? If not, can you provide the error suricata is returning? Thanks!


Hi @jmtaylor90, No I haven’t. What I did was deleting the line and re-do the adjustment.
This seems to have helped. May a misplaced [space]. Who knowns.

1 Like