3 Jan
2012
3 Jan
'12
1:28 p.m.
#730: Find and fix tcp sequence counting bugs
---------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: Normal | Milestone: Bro2.1
Component: Bro | Version:
Keywords: |
---------------------+--------------------
Sometimes the code that watches for tcp sequence wrap around will trigger
erroneously and the payload value will be grossly misrepresented in the
c$(resp|orig)$size fields.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
18 Jan
18 Jan
1:33 p.m.
#730: Find and fix tcp sequence counting bugs
----------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: High | Milestone: Bro2.1
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Changes (by seth):
* priority: Normal => High
Comment:
I'll try and get some tracefiles posted here soon that exhibit the
problem.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:1>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
26 Jan
26 Jan
10:40 a.m.
#730: Find and fix tcp sequence counting bugs
----------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: High | Milestone: Bro2.1
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Comment (by jswaro):
If you can provide traces, I'd be interested in assisting in fixing this
problem. I have a problem similar to this that I am working on, which I
imagine a solution to one would solve the other if I'm not mistaken.
On Wed, Jan 18, 2012 at 4:33 PM, Bro Tracker <bro(a)tracker.bro-
ids.org>wrote:
#730: Find and fix tcp sequence counting bugs
----------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: High | Milestone: Bro2.1
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Changes (by seth):
* priority: Normal => High
Comment:
I'll try and get some tracefiles posted here soon that exhibit the
problem.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:1>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
_______________________________________________
bro-dev mailing list
bro-dev(a)bro-ids.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:2>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
1:18 p.m.
#730: Find and fix tcp sequence counting bugs
----------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: High | Milestone: Bro2.1
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Comment (by seth):
I attached a trace file that exhibits the problem. There is some
intermediate box that is sending RST packets in this case causing the
large byte count.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:3>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
11 Jul
11 Jul
11:22 p.m.
#730: Find and fix tcp sequence counting bugs
----------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: High | Milestone: Bro2.2
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Changes (by seth):
* milestone: Bro2.1 => Bro2.2
Comment:
I don't want to make changes as large as this would involve before the 2.1
release.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:4>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
14 Dec
14 Dec
3:09 p.m.
#730: Find and fix tcp sequence counting bugs
----------------------+--------------------
Reporter: seth | Owner:
Type: Problem | Status: new
Priority: High | Milestone: Bro2.2
Component: Bro | Version:
Resolution: | Keywords:
----------------------+--------------------
Comment (by jsiwek):
In [81ae68be16c919c4a662aed5d29cdca86e401b15/bro]:
{{{
#!CommitTicketReference repository="bro"
revision="81ae68be16c919c4a662aed5d29cdca86e401b15"
Fix a case where c$resp$size is misrepresented. Addresses #730.
That field is based on TCP sequence numbers and on seeing a SYN followed
by a failed RST injection response, the initial sequence number tracked
the value in the injection (most likely zero) instead of value in
subsequent SYN response. This could make c$resp$size be set to large
values when it's not really.
Also removed some dead code paths.
}}}
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:5>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
3:12 p.m.
#730: Find and fix tcp sequence counting bugs
----------------------------+--------------------
Reporter: seth | Owner:
Type: Merge Request | Status: new
Priority: High | Milestone: Bro2.2
Component: Bro | Version:
Resolution: | Keywords:
----------------------------+--------------------
Changes (by jsiwek):
* type: Problem => Merge Request
Comment:
Patch for at least the case in the large-byte-count1.trace example is in
`topic/jsiwek/ticket-730`.
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:6>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
20 Dec
20 Dec
5:55 p.m.
#730: Find and fix tcp sequence counting bugs
----------------------------+--------------------
Reporter: seth | Owner: robin
Type: Merge Request | Status: closed
Priority: High | Milestone: Bro2.2
Component: Bro | Version:
Resolution: fixed | Keywords:
----------------------------+--------------------
Changes (by robin):
* owner: => robin
* status: new => closed
* resolution: => fixed
Comment:
In [ca8a8b09fa878ac0866d0c248cf07f47961452d0/bro]:
{{{
#!CommitTicketReference repository="bro"
revision="ca8a8b09fa878ac0866d0c248cf07f47961452d0"
Merge remote-tracking branch 'origin/topic/jsiwek/ticket-730'
* origin/topic/jsiwek/ticket-730:
Fix a case where c$resp$size is misrepresented. Addresses #730.
Closes #730.
}}}
--
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/730#comment:7>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker
3225
days inactive
3578
days old
7 comments
1 participants
participants (1)
-
Bro Tracker