Feature #1105: Detect icmpv6 on ipv4 - Suricata - Open Information Security Foundation

Actions

Feature #1105

closed

Detect icmpv6 on ipv4

Added by Victor Julien over 10 years ago. Updated over 10 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Target version:

Effort:

Difficulty:

Label:

Description

Invalid combination. We already do detect the reverse (icmpv4 on ipv6).

Files

2200092-001-nsa-public-tp-01.pcap (100 Bytes) 2200092-001-nsa-public-tp-01.pcap

Victor Julien, 02/08/2014 04:27 AM

Actions

#1

Updated by Victor Julien over 10 years ago

File 2200092-001-nsa-public-tp-01.pcap 2200092-001-nsa-public-tp-01.pcap added

Attached an example of this from the NSA data set: https://www.itoc.usma.edu/research/dataset/

Actions

#2

Updated by Victor Julien over 10 years ago

Status changed from Assigned to Closed
% Done changed from 0 to 100

Addressed by:

commit fdca557e0162e02ee5b40949948685e3ca8ae5c0
Author: Victor Julien <victor@inliniac.net>
Date:   Sat Feb 8 11:25:13 2014 +0100

    ipv4 decoder: set 'invalid' event on icmpv6

    ICMPv6 on IPv4 is invalid, so if we encounter this we set an event
    and flag the packet as invalid.

    Ticket #1105.

Actions

Also available in: Atom PDF