Project

General

Profile

Actions
Copy link

Bug #5750

open

Spurious "SURICATA DNP3 Length too small" error and failed reassembly

Added by Alex Lasky almost 2 years ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Assignee:
Jason Ish
Target version:
TBD
Affected Versions:
6.0.4
Effort:
Difficulty:
Label:

Description

DNP3 preprocessor fails to correctly reassemble DNP3 fragments in some cases, generating a spurious "SURICATA DNP3 Length too small" error. As the attached two examples show, the problem seems to occur where the final frame of the fragment has an all-zero's payload excluding CRC's and transport byte, though I don't know if this is a necessary or sufficient condition.

Files

Download all files
DNP3ReassemblyError1.pcap (2.43 KB) DNP3ReassemblyError1.pcap Alex Lasky, 12/12/2022 05:38 AM
DNP3ReassemblyError2.pcap (3.2 KB) DNP3ReassemblyError2.pcap Alex Lasky, 12/12/2022 05:38 AM
DNP3ReassemblyError.json (3.2 KB) DNP3ReassemblyError.json Alex Lasky, 12/12/2022 05:44 AM
Actions
Copy link

Also available in: Atom PDF