# Suricata protocol DCERPC cannot trigger alert when adding new rule

**URL:** <https://forum.suricata.io/t/suricata-protocol-dcerpc-cannot-trigger-alert-when-adding-new-rule/4788>\
**Category:** Rules\
**Tags:** bug\
**Created:** [July 31, 2024, 3:57am UTC](https://forum.suricata.io/t/suricata-protocol-dcerpc-cannot-trigger-alert-when-adding-new-rule/4788 "2024-07-31T03:57:49Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dachoa1005](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/dachoa1005/32/3730_2.png) [@dachoa1005](https://forum.suricata.io/u/dachoa1005)\
**Post date:** [July 31, 2024, 3:57am UTC](https://forum.suricata.io/t/suricata-protocol-dcerpc-cannot-trigger-alert-when-adding-new-rule/4788/1 "2024-07-31T03:57:49Z")

</div>

Currently, I have 2 Suricata rules:  
+) alert tcp any any → any any (msg:“DCERPC rule”; flow:to\_server,established; dce\_iface:5d2b62aa-ee0a-4a95-91ae-b064fdb471fc; dce\_opnum:1; dce\_stub\_data; content:“|42 77 4E 6F 64 65 49 50 2E 65 78 65 20|”; content:!“|00|”; within:100; distance:97; sid:1; rev:1; )  
+) alert tcp any any → any any (msg:“Conflict rule”; flow:to\_client,established; file\_data; content:“xmlns|3A|”; content:“DAV|3A|”; within:10; content:“|3A|response xmlns|3A|”; fast\_pattern; content:“…”; within:200; content:“|3A|href\>”; within:200; pcre:“/\x3ahref\>[^\<]\*?\x2e\x2e[\x2f\x5c]/i”; sid:2; rev:1; )

Suricata version 6.0.10, 6.0.14, 7.0.5  
Operating system and/or Linux distribution: Debian 9, Debian 11  
How you installed Suricata: build from source using commands:  
+) bash scripts/bundle.sh  
+) bash autogen.sh  
+) configure  
+) make  
Then run Suricata using command:  
+) ./src/suricata -c ./suricata.yaml -S ./local.rules -r /home/debian/test.pcap --runmode=single  
The problem is: if ./local.rules only include DCERPC rule → Suricata can trigger 1 alert as expect  
But when ./local.rules include 2 rules: DCERPC rule and Conflict rule → cannot trigger alert for pcap file above.  
One more infomation, if I change direct of Conflict rule from to\_server instead of to\_client (replay pcap file with DCERPC rule (not change) and Conflict rule (with flow:to\_server,established;)) → Suricata can trigger alert as expect.  
Let me know if you need additional information.  
[test.pcap](https://forum.suricata.io/uploads/short-url/cKC7HnN9KpPLeqgByYX3GL8G7fl.pcap) (5.9 KB)

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [July 31, 2024, 5:48am UTC](https://forum.suricata.io/t/suricata-protocol-dcerpc-cannot-trigger-alert-when-adding-new-rule/4788/2 "2024-07-31T05:48:29Z")

</div>

Thanks for your report. I can confirm there is an issue. I’ve created a ticket here:

> **[Bug #7187: detect: dcerpc logging and matching issues - Suricata - Open...](https://redmine.openinfosecfoundation.org/issues/7187)**
>
> Redmine

---

<div class="post-metadata">

**Author:** ![vjulien](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/vjulien/32/4_2.png) [@vjulien](https://forum.suricata.io/u/vjulien)\
**Post date:** [July 31, 2024, 12:27pm UTC](https://forum.suricata.io/t/suricata-protocol-dcerpc-cannot-trigger-alert-when-adding-new-rule/4788/3 "2024-07-31T12:27:10Z")

</div>

If you’re able to test things, please have a look at:

> <https://github.com/OISF/suricata/pull/11590>
>
> In the DCERPC over TCP pcap, logging and rule matching is disrupted by adding a …simple rule:
> 
> alert tcp any any -\> any any (flow:to\_server,established; \\
> dce\_iface:5d2b62aa-ee0a-4a95-91ae-b064fdb471fc; dce\_opnum:1; \\
> dce\_stub\_data; content:"|42 77 4E 6F 64 65 49 50 2E 65 78 65 20|"; \\
> content:!"|00|"; within:100; distance:97; sid:1; rev:1; )
> 
> Works: alert + 3 dcerpc records.
> 
> But when adding a trivial rule:
> 
> alert tcp any any -\> any any (flow:to\_server,established; \\
> dce\_iface:5d2b62aa-ee0a-4a95-91ae-b064fdb471fc; dce\_opnum:1; \\
> dce\_stub\_data; content:"|42 77 4E 6F 64 65 49 50 2E 65 78 65 20|"; \\
> content:!"|00|"; within:100; distance:97; sid:1; rev:1; )
> alert tcp any any -\> any any (dsize:3; sid:2; rev:1; )
> 
> The alert for sid:1 disappears and also there is one dcerpc event less.
> 
> In the single rule case we can aggressively free the transactions, as there is only an sgh in the toserver direction.
> 
> This means that when we encounter the 2nd REQUEST, the first 2 transactions have already been processed and freed. So for the 2nd REQUEST we open a new TX and run inspection and logging on it.
> 
> When the 2nd rule is added, it adds toclient sgh as well. This means that we will now slightly delay the freeing of the transactions.
> 
> As a consequence we still have the TX for the first REQUEST when the 2nd REQUEST is parsed. This leads to the 2nd REQUEST re-using the TX. Since the TX is already marked as inspected, it means the toserver rule now no longer matches. Also we're not logging this TX correctly now.
> 
> This commit fixes the issue by not "finding" a TX that as already been marked complete in the search direction.
> 
> Bug #7187.
> 
> SV\_BRANCH=https://github.com/OISF/suricata-verify/pull/1995

---

<div class="post-metadata">

**Author:** ![dachoa1005](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/dachoa1005/32/3730_2.png) [@dachoa1005](https://forum.suricata.io/u/dachoa1005)\
**Post date:** [July 31, 2024, 12:33pm UTC](https://forum.suricata.io/t/suricata-protocol-dcerpc-cannot-trigger-alert-when-adding-new-rule/4788/4 "2024-07-31T12:33:44Z")

</div>

Thank you for your response. I will test it and inform you of the results tomorrow.