detection problem in client body

[Felix Erlacher via Snort-users <snort-users () lists snort org>]

Hi all,

I am having a detection problem with an http_client_body rule. I tried
to provide a minimal example in the attachments.
post.pcapng contains two full tcp connections with one http request (and
corresponding response) each. The first post request has 'foo' in the
client body, the second post request has 'foo123' in the client body.
test.rules contains a rule which is looking for the letter 'o' in the
http_client_body.
If I run snort in IDS mode, only the second post request is triggering
an alert while the first post request does not although it also contains
an 'o' in the client body. The only notable difference (to me) is the
'123' added to the client body, which IMHO should not make any difference.

Why is the first post request not triggering an alert?

I am using the newest snort 2.9.11.1 with standard config (minimal
changes, attached), snort output is attached. As can be seen, I am using
the -k none switch.

thx and regards

Felix

Attachment: test.rules
Description:

Attachment: post.pcapng
Description:

Attachment: snort.output
Description:

Attachment: snort.conf
Description:

_______________________________________________
Snort-users mailing list
Snort-users () lists snort org
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette