Re: Multiple alerts generated when detecting HTTP traffic

Run your test that generates multiple alerts using -A csv instead of -A alert_full and send the csv alerts you get.
________________________________
From: Snort-users <[email protected]> on behalf of 徐必昂 <[email protected]>
Sent: Thursday, April 11, 2024 4:40 AM
To: [email protected] <[email protected]>
Subject: [Snort-users] Multiple alerts generated when detecting HTTP traffic

Hello. I previously raised an issue on github (https://github.com/snort3/snort3/issues/356), "InverseRE" told me it was because I enabled the search_engine.detect_raw_tcp option, but when I tested it using the following two commands the output was the same:
    sudo snort -c /usr/local/etc/snort/snort.lua -i lo -R /path/to/rule/file -A alert_full -k none --lua 'search_engine.detect_raw_tcp = true'
    sudo snort -c /usr/local/etc/snort/snort.lua -i lo -R /path/to/rule/file -A alert_full -k none --lua 'search_engine.detect_raw_tcp = false'
I saved the output of the two commands to files and compared them. The results are as follows:
    $ diff detect_raw_tcp_false.log detect_raw_tcp_true.log
    117c117
    < appid: MaxRss diff: 3024
    ---
    > appid: MaxRss diff: 3144
    241,242c241,242
    <                   seconds: 0.024722
    <                  pkts/sec: 324
    ---
    >                   seconds: 0.024748
    >                  pkts/sec: 323
And according to the snort3 documentation, this option is set to false by default, and I didn't modify it.
So is this option the cause of the problem? If so, what's wrong with my command? If not, what causes this problem?

Thanks.
_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

        To unsubscribe, send an email to:
        [email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette