Open Information Security Foundation

Today

11:27 AM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

Here is another odd one. Init, retry, init, retry. But it seems the last retry is invalid?
!clipboard-202502201225-v... Victor Julien

02/19/2025

10:21 AM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

Another odd one.
!clipboard-202502191120-b98nf.png!
Victor Julien

08:33 AM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

A few more that generate alerts with the v5 branch (https://github.com/OISF/suricata/pull/12617) Victor Julien

02/18/2025

08:20 PM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

A few more interesting pcaps. Victor Julien

08:35 AM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

Example of a server hello with out of order fragments. Victor Julien

02/17/2025

05:51 PM Suricata Bug #7521 (Resolved): detect/ip-only: false positive alerts on pseudo packets ending a one direction flow

https://github.com/OISF/suricata/pull/12499 Victor Julien

05:50 PM Suricata Optimization #7558 (Closed): detect: convert rule group dumping to JsonBuilder

https://github.com/OISF/suricata/pull/12590 Victor Julien

05:50 PM Suricata Bug #7554 (Resolved): tls: parser error on unACK'd data in FIN shutdown

https://github.com/OISF/suricata/pull/12590 Victor Julien

01:10 PM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

Not sure if this is a related issue, but this gave me a -warning- alert as well. Victor Julien

12:31 PM Suricata Bug #7556: quic: valid traffic blocked in IPS mode

Another pcap Victor Julien