# Some match bypass? **URL:** \ **Category:** Rules\ **Tags:** rules\ **Created:** [July 20, 2021, 9:55am UTC](https://forum.suricata.io/t/some-match-bypass/1536 "2021-07-20T09:55:04Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [July 20, 2021, 9:55am UTC](https://forum.suricata.io/t/some-match-bypass/1536/1 "2021-07-20T09:55:04Z")
Dear Doctor: i had a problem in rule matching. my rule is alert http any any → any any (msg:“test”; flow:to\_client; http.stat\_code; content:“200”; sid:1111111;) my suricata version 6.0.1 RELEASE my suricata.yaml : stream: midstream: yes memcap: 64mb checksum-validation: no inline: auto reassembly: memcap: 256mb depth: 1mb toserver-chunk-size: 1024 toclient-chunk-size: 1024 randomize-chunk-size: yes my command: suricata -r ./landray.pcap -v -c ./suricata.yaml it doesn’t mactch … [landray.pcap](https://forum.suricata.io/uploads/short-url/4PeYk5UtVoLbr5Uhkc31y7Y2o2i.pcap) (379.6 KB) Looking forward to hearing from you ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [July 20, 2021, 4:03pm UTC](https://forum.suricata.io/t/some-match-bypass/1536/2 "2021-07-20T16:03:41Z")
Hi leezp, I could be wrong, but I don’t think there’s an issue with your rule. Rather, it seems to be something with that pcap. I have tried running your rule against that pcap and against live traffic, and I do get alerts from Suricata when it’s inspecting live traffic, but no alerts or even `http` event types show up in my logs when I run Suricata to inspect that provided pcap. Unfortunately, my knowledge is limited, still, so I can’t explain why doesn’t that pcap generate alerts. I would just recommend you to test your rule against other pcap, or with live traffic. If you do, please share the resulting output log from eve.json or fast.log! 🙂 Best regards, Juliana ---
**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\ **Post date:** [July 21, 2021, 12:10pm UTC](https://forum.suricata.io/t/some-match-bypass/1536/3 "2021-07-21T12:10:31Z")
Hi, I tried looking at some of the http streams and I cannot see the SYN packets for most of them. Looks like the pcap has http coming over long running, reused, TCP sessions. I would assume that `midstream: yes` would pick it up but seems like that is not the case. Are you testing on live traffic or packet capture? Is the traffic sent from some other TLS inspection box for instance that might mangle it a bit? There are some streams with SYN packets (for instance `tcp.stream eq 74` in wireshark), but the first packets in the stream do not look like http at all. You might also need to change the http port variables since non-standard ones are in use in the pcap. ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [July 22, 2021, 1:53am UTC](https://forum.suricata.io/t/some-match-bypass/1536/4 "2021-07-22T01:53:10Z")
who can debug with my pcap and config file，i want to know where and why the problem will happen? ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [July 22, 2021, 2:33am UTC](https://forum.suricata.io/t/some-match-bypass/1536/5 "2021-07-22T02:33:03Z")
i tried live mode. my command is ‘suricata -i eth0 -v -c /etc/suricata/suricata.yaml -k none -l ./log’ ‘tcpreplay -i eth0 -M 100 landray.pcap’ my rule is alert http any any → any any (msg:“test”; flow:to\_client; http.stat\_code; content:“200”; sid:1111111;) but there is no alert. [eve.json](https://forum.suricata.io/uploads/short-url/ajrias2Q0CXDCwKYH7JSAh6Yied.json) (24.5 KB) ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [July 22, 2021, 2:48am UTC](https://forum.suricata.io/t/some-match-bypass/1536/7 "2021-07-22T02:48:28Z")
It looks like Suricata isn’t identifying these packets as HTTP. In one flow that I looked at with an HTTP response, there is some data before the start of the HTTP request which could be causing this. Is there any not-normal about your configuration, or the traffic you are monitoring that you may be aware of? ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [July 27, 2021, 1:44am UTC](https://forum.suricata.io/t/some-match-bypass/1536/8 "2021-07-27T01:44:31Z")
how can i fix the pcap file ? ---
**Author:** ![ish](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ish/32/8_2.png) [@ish](https://forum.suricata.io/u/ish)\ **Post date:** [July 27, 2021, 5:36pm UTC](https://forum.suricata.io/t/some-match-bypass/1536/9 "2021-07-27T17:36:20Z")
It probably can’t be fixed, and we don’t know enough about the source of this pcap. As syoc mentioned, could it be from a TLS inspection box that re-generates non-TLS versions of the traffic? ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 2, 2021, 2:54am UTC](https://forum.suricata.io/t/some-match-bypass/1536/10 "2021-08-02T02:54:14Z")
another issue: ‘http.uri’ doesn’t work! alert http any any → any any (msg:“test2”; http.uri; content:"/…/conf/config.properties";sid:80000;) my suricata version 6.0.1 RELEASE my suricata.yaml : stream: midstream: yes memcap: 64mb checksum-validation: no inline: auto reassembly: memcap: 256mb depth: 1mb toserver-chunk-size: 1024 toclient-chunk-size: 1024 randomize-chunk-size: yes my command: suricata -r ./lanproxy-cve-2021-3019-lfi.pcap -v -c ./suricata.yaml but this rule can produce an alert ： [lanproxy-cve-2021-3019-lfi.pcap](https://forum.suricata.io/uploads/short-url/wE42gaaZzRpu4ZdegPMcA7h67aS.pcap) (9.1 KB) alert http any any → any any (msg:“test2”; content:"/…/conf/config.properties";sid:80000;) ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 2, 2021, 8:34am UTC](https://forum.suricata.io/t/some-match-bypass/1536/11 "2021-08-02T08:34:53Z")
Dear Doctor: by the way , can you give me an example of http2 rules like ‘alert http2 any any → any any (…)’ ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [August 2, 2021, 4:03pm UTC](https://forum.suricata.io/t/some-match-bypass/1536/12 "2021-08-02T16:03:28Z")
Hi, jumping in again, thought I could help with some `alert http2 any any -> any any` rules examples from our Suricata-verify tests 🙂 In the `http2-keywords` test, there is a rule that uses `http.uri`: > Here, other examples of rules: > > There are some other tests, too, in which you can find possibly useful material. Hope they’ll be of help! ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 3, 2021, 5:33am UTC](https://forum.suricata.io/t/some-match-bypass/1536/13 "2021-08-03T05:33:42Z")
thank you very much! ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 3, 2021, 6:47am UTC](https://forum.suricata.io/t/some-match-bypass/1536/14 "2021-08-03T06:47:00Z")
> [@jufajardini](#): > > `alert http2 any any -> any any (http.uri; content:"/doc/manual/html/index.html"; sid:12;)` 3/8/2021 – 14:47:58 - - [ERRCODE: SC\_ERR\_CONFLICTING\_RULE\_KEYWORDS(141)] - can’t set rule app proto to http: already set to http2 my suricata version 6.0.1 RELEASE ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [August 5, 2021, 9:39am UTC](https://forum.suricata.io/t/some-match-bypass/1536/15 "2021-08-05T09:39:21Z")
Hi leezp, Sorry for the late reply. So, I tried running those rules and didn’t get this error you’ve shared. Did it fire with the rule you quoted? > [@leezp](#): > > 3/8/2021 – 14:47:58 - - [ERRCODE: SC\_ERR\_CONFLICTING\_RULE\_KEYWORDS(141)] - can’t set rule app proto to http: already set to http2 Regarding `http.uri` not working, could you be more specific on what do you mean by that? Do you see any errors? Thanks for providing the info to let us understand the issues better! ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 23, 2021, 2:28am UTC](https://forum.suricata.io/t/some-match-bypass/1536/16 "2021-08-23T02:28:03Z")
how to compile an edition with lua support and how to config it , please ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 23, 2021, 3:14am UTC](https://forum.suricata.io/t/some-match-bypass/1536/17 "2021-08-23T03:14:52Z")
How to analyze the difference of payload between two consecutive packets using suricata rules or lua script ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [August 23, 2021, 11:11pm UTC](https://forum.suricata.io/t/some-match-bypass/1536/18 "2021-08-23T23:11:01Z")
Hi leezp, in order to enable lua support, you’ll need to run the configure option `--enable-lua` If your system doesn’t have the preferred lua version (`lib lua5.1`), Suricata will complain and point out to how to solve it. ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 25, 2021, 7:01am UTC](https://forum.suricata.io/t/some-match-bypass/1536/19 "2021-08-25T07:01:47Z")
my suricata.yaml - lua: enabled: yes scripts-dir: /home/suricata/rules/test scripts: - script1.lua my rules: alert dns any any → any any (msg:“test lua”; lua:test/script1.lua; sid:112223;) my script1.lua: function init() local needs = {} needs[“type”] = “packet” needs[“filter”] = “alerts” return needs end function setup() alert\_count = 0 end function log() timestring = SCPacketTimeString() sid, rev, gid = SCRuleIds() msg = SCRuleMsg() class, priority = SCRuleClass() ``` ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCPacketTuple() if class == nil then class = "unknown" end print (timestring .. " [**] [" .. gid .. ":" .. sid .. ":" .. rev .. "] " .. msg .. " [**] [Classification: " .. class .. "] [Priority: " .. priority .. "] {" .. protocol .. "} " .. src_ip .. ":" .. src_port .. " -> " .. dst_ip .. ":" .. dst_port) alert_count = alert_count + 1; ``` end function deinit() print (“Alerted " … alert\_count … " times”); end errored： - [ERRCODE: SC\_ERR\_LUA\_ERROR(212)] - unsupported data type type ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [August 25, 2021, 11:34am UTC](https://forum.suricata.io/t/some-match-bypass/1536/20 "2021-08-25T11:34:50Z")
So, I’m not an expert with lua scripts, but from what I could gather, it’s not the lua support that is not working. I tried a similar version of your script with a local suricata verify test, and that worked. When I tried to use it with suri in live mode, it didn’t seem to work, so… I don’t know. I’m appending my script to the end of this answer. The error suggests that Suricata doesn’t recognize the keyword `type` in your script’s specific context. It could be some small typo somewhere or a wrong symbol, or it can also be that the combination you’re using doesn’t work in the way you want to use it. Right now, I’m unable to offer more help with this… … my script: ```auto function init(args) local needs = {} needs["type"] = "packet" needs["filter"] = "alerts" return needs end function setup(args) alert_count = 0 end function log(args) timestring = SCPacketTimeString() sid, rev, gid = SCRuleIds() msg = SCRuleMsg() class, priority = SCRuleClass() ip_version, src_ip, dst_ip, protocol, src_port, dst_port = SCPacketTuple() if class == nil then class = "unknown" end print (timestring .. " [**] [" .. gid .. ":" .. sid .. ":" .. rev .. "] " .. msg .. " [**] [Classification: " .. class .. "] [Priority: " .. priority .. "] {" .. protocol .. "} " .. src_ip .. ":" .. src_port .. " -> " .. dst_ip .. ":" .. dst_port) alert_count = alert_count + 1 end function deinit(args) print ("Alerted " .. alert_count .. " times"); end ``` ---
**Author:** ![leezp](https://avatars.discourse-cdn.com/v4/letter/l/b782af/32.png) [@leezp](https://forum.suricata.io/u/leezp)\ **Post date:** [August 27, 2021, 6:13am UTC](https://forum.suricata.io/t/some-match-bypass/1536/21 "2021-08-27T06:13:58Z")
how to save request and response payload in an alert of eve.json. i experimented but only get one-direction log. such as ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/1X/923cfae7baaf38566ee2c8f6c8e17d38820298f6.png) i only get “530 User cannot log in.\r\n221 Goodbye.” [Next page](https://forum.suricata.io/t/some-match-bypass/1536.md?page=2)