Dear Doctor:
i had a problem in rule matching.
my rule is
alert http any any → any any (msg:“test”; flow:to_client; http.stat_code; content:“200”; sid:1111111;)
my suricata version 6.0.1 RELEASE
my suricata.yaml :
stream:
midstream: yes
memcap: 64mb
checksum-validation: no
inline: auto
reassembly:
memcap: 256mb
depth: 1mb
toserver-chunk-size: 1024
toclient-chunk-size: 1024
randomize-chunk-size: yes
my command:
suricata -r ./landray.pcap -v -c ./suricata.yaml
it doesn’t mactch …
landray.pcap (379.6 KB)
Looking forward to hearing from you