Project

General

Profile

Actions

Bug #10989

open

Snort alert page has hidden characters in IPv6 address

Added by Steve Y over 3 years ago. Updated over 3 years ago.

Status:
New
Priority:
Low
Assignee:
-
Category:
Snort
Target version:
-
Start date:
10/17/2020
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
2.4.5-p1
Affected Plus Version:
Affected Architecture:
SG-2100

Description

It looks like Snort has hidden characters in IPv6 addresses on its alert page. This makes it difficult to search for an IP as one can only use the browser to search for four digits and a colon, and searching for a full IP can't match.

example:
2607:​f8b0:​4017:​d:​:​7

In case that doesn't come through, to the right of each colon is ASCII 8203 (https://www.codetable.net/decimal/8203). If I copy and paste it into a web site for instance I get:
https://www.ultratools.com/tools/ipv6InfoResult?ipAddress=2607%3A%26%238203%3Bf8b0%3A%26%238203%3B4017%3A%26%238203%3Bd%3A%26%238203%3B%3A%26%238203%3B7

I found this on a SG-2100 but I can't imagine it's hardware specific, it's just the only one I have Snort on at the moment since others have Suricata and not IPv6.

Actions #1

Updated by Viktor Gurov over 3 years ago

Suricata issue #10187

Actions #2

Updated by Steve Y over 3 years ago

Oh. I searched for Snort bugs.

Actions

Also available in: Atom PDF