Suricata can't define IP options

Rules
,
1

Hello,
I try use ipopts : ssrr in my rules. But I get alert any case when set any IP flag in packet.

2

What version of Suricata are you using?
What platform and release (Linux x.y, Macos 10.x, …)?
Can you provide the rule?

3

Suricata version: 6.0.4
Platform: Linux
Rule: alert ip any any -> any any (ipopts: ssrr; msg: "issue"; rev: 1; sid:1;)

4

Do you have some updates? =)

5

Can you also provide the pcap?

6

84b58b808f9f81c09728cb923a2c0eb0.pcap (730 Bytes)
Yes, sure

7

Do you have some updates? =)

8

Thanks for bringing this to our attention. There may be an issue with how this is handled so I created Bug #6864: Detect: ipopts keyword misfires - Suricata - Open Information Security Foundation to track it.

1 Like
9

Thank you very match!

10

I’ve prepared a PR with the changes – if you’re able to build with my PR, let me know if this works for you