Skip to content

Commit 3497301

Browse files
committed
dcerpc: update alert count
In the given pcap, the packets that match criteria for sid:1 are 39, 76. the packets that match the criteria for sid:2 are 36, 73. However, due to some trailing data at the beginning of the input passed to the DCERPC parser for the packets 73-76 (request-response pair), they were disregarded with an error during header parsing causing app_layer_error exception_policy to trigger. This no longer exists with the patch for: Ticket: 7251
1 parent 47e8ab8 commit 3497301

File tree

1 file changed

+20
-0
lines changed

1 file changed

+20
-0
lines changed

tests/truncate-applayer-test-02/test.yaml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,31 @@ args:
55

66
checks:
77
- filter:
8+
min-version: 9
9+
count: 2
10+
match:
11+
event_type: alert
12+
alert.signature_id: 1
13+
- filter:
14+
min-version: 9
15+
count: 2
16+
match:
17+
event_type: alert
18+
alert.signature_id: 2
19+
- filter:
20+
min-version: 9
21+
count: 0
22+
match:
23+
event_type: flow
24+
flow.exception_policy[0].target: app_layer_error
25+
- filter:
26+
lt-version: 9
827
count: 1
928
match:
1029
event_type: alert
1130
alert.signature_id: 1
1231
- filter:
32+
lt-version: 9
1333
count: 1
1434
match:
1535
event_type: alert

0 commit comments

Comments
 (0)