46 lines
1.1 KiB
Markdown
46 lines
1.1 KiB
Markdown
|
# 信息港5楼测试环境，使用自定义特征udp.payload.s2c_first_data的原始数据加偏移时，命中的包中存在误报
|
|||
|
|
|
|||
|
|
| ID | Creation Date | Assignee | Status |
|
|||
|
|
|----|----------------|----------|--------|
|
|||
|
|
| OMPUB-829 | 2023-03-01T13:30:31.000+0800 | 刘学利 | 已解决 |
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
使用自定义特征udp.payload.s2c_first_data的原始数据加偏移时，命中的包中存在误报，在命中的数据包中01000000特征从1字节开始也命中了特征。**liuxueli** commented on *2023-03-11T14:53:10.659+0800*:
|
|||
|
|
|
|||
|
|
* offset+depth就是个闭区间，[0,4]包含了前5个字节，所以能命中特征，将depth改为3可避免不符合特征的payload命中。
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**daikaiqiang** commented on *2023-03-13T11:23:36.995+0800*:
|
|||
|
|
|
|||
|
|
* 已修改特征中depth数值为3，目前在信息港5楼测试环境进行测试并捕包
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
## Attachments
|
|||
|
|
|
|||
|
|
**35632/192.168.54.82.62936-220.181.111.133.4040_290704313442413406.pcapng**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**35629/wireguard_202302260848019.json**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**35631/微信图片_20230301115455.png**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|
|||
|
|
**35630/微信图片_20230301115502.png**
|
|||
|
|
|
|||
|
|
---
|
|||
|
|
|