snort3: reject rule problem

--===============2052101390356641757==
Content-Type: multipart/alternative; boundary="000000000000d5aee90593677616"

--000000000000d5aee90593677616
Content-Type: text/plain; charset="UTF-8"

Hello
I have reject rule that send Port unreachable for ping.

It's Ok, but only for 1st packet.

The next ping packets are silently dropped and not detected and not logged.

reject icmp 192.168.0.1 any -> any any ( gid:8000; sid:1; msg:"ping";  )

This happens when stream and stream_icmp inspectors are in config.


If I remove stream {} and/or stream_icmp {} inspectors from snort lua
config, then ALL OK: each packet is
dropped, logged and ICMP Port unreach is sending on each dropped packet.



Part of config:


stream={}
stream_icmp={}
reject={control="port"}

Thanks.

--000000000000d5aee90593677616
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">
<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><pre style=3D"color:rgb(=
0,0,0);margin:0em">Hello
I have reject rule that send Port unreachable for ping.

It&#39;s Ok, but only for 1st packet.

The next ping packets are silently dropped and not detected and not logged.

reject icmp 192.168.0.1 any -&gt; any any ( gid:8000; sid:1; msg:&quot;ping=
&quot;;  )

This happens when stream and stream_icmp inspectors are in config.</pre><pr=
e style=3D"color:rgb(0,0,0);margin:0em"><br></pre><pre style=3D"color:rgb(0=
,0,0);margin:0em">If I remove stream {} and/or stream_icmp {} inspectors fr=
om snort lua config, then ALL OK: each packet is
dropped, logged and ICMP Port unreach is sending on each dropped packet.</p=
re><pre style=3D"color:rgb(0,0,0);margin:0em"><br></pre><pre style=3D"color=
:rgb(0,0,0);margin:0em"><br></pre><pre style=3D"color:rgb(0,0,0);margin:0em=
">Part of config:</pre><pre style=3D"color:rgb(0,0,0);margin:0em"><br></pre=
><pre style=3D"color:rgb(0,0,0);margin:0em"><pre style=3D"margin:0em">strea=
m=3D{}
stream_icmp=3D{}
reject=3D{control=3D&quot;port&quot;}
<br></pre><pre style=3D"margin:0em">Thanks.</pre></pre></div></div></div>

</div>

--000000000000d5aee90593677616--

--===============2052101390356641757==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============2052101390356641757==--