Help regarding GTP Inspect Inspector

Hello!
I am currently working on trying to configure snort 3 to process GTP
packets.
I have enabled the inspector in the snort.lua. In my rules file, I have
included gid:143, sid:1. But when snort is run against a pcap file, the
inspector does not seem to be triggered/activated.
Not sure what steps I am missing.
Any help in this regard would be greatly appreciated.

Attached to this mail is the pcap file, configuration and the rule that I
have tried.

Configuration (gtp specific portions not full configuration file):
gtp_inspect = default_gtp
binder =
{
{ when = { proto = 'udp', ports = '2123 2152 3386', role='server' }, use =
{ type = 'gtp_inspect' } },
{ when = { service = 'gtp' },              use = { type = 'gtp_inspect' } }
}


Rule used:
alert (message:"Invalid Length";gid:143;sid:1;)

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette