Open Information Security Foundation

04/29/2011

11:32 AM Suricata Bug #283: Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

My cutting and pasting skills are not aging well... Here's the first instance of the rule being triggered as describe... John Pile

11:26 AM Suricata Bug #283: Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

I'm now able to reproduce the alert on a replay with 2008100 as the only rule loaded using the enclosed trigger.pcap.... John Pile

04/28/2011

04:36 PM Suricata Bug #283: Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

I'm including a copy of the config.log in case there's anything of interest in how this was compiled. John Pile

04/27/2011

06:10 PM Suricata Bug #283: Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

... John Pile

04/19/2011

11:18 AM Suricata Bug #283: Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

I reran with 2008100 as the only rule, and it is still triggered when I open the same page. John Pile

10:29 AM Suricata Bug #283: Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

I'm including the ruleset I used, in case one rule was fired but a different rule was reported. John Pile

04/18/2011

03:05 PM Suricata Bug #283 (Closed): Invalid trigger of rule 1:2008100:10 (running Suricata 1.0.3 on FC14)

Rule 2008100 is being triggered when I access a management page on a Splunk server in my LAN:... John Pile