Re: Raw payload expressions are mangled

Sunny73Cr <[email protected]>
Newsgroups gmane.comp.security.firewalls.netfilter.general
Message-ID <gwahcYIw793HXoIlydvHfjEr4aIOm4Mmv7VlsDq0N1KU6zZyRQTS219wEnMH0KqmR2Ir9DhDbPzUYBy4m98D1KQf9WC_Zc9PrxFWgo1X-u0=@protonmail.com> 
The rule translation results in matching the binary:
"0b0001010000000001"

It should be "0b0010010000000001"

or really any selection from:

"0b0010010000000001"
"0b0110010000000001"
"0b1010010000000001"
"0b1110010000000001"

in order to match an "indeterminate LI"; as my rule was not concerned with this value.

I cannot reason as to why VN is matched as 2 instead of 4.

sunny
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.