Project

General

Profile

Bug #10989

Snort alert page has hidden characters in IPv6 address

Added by Steve Yates about 2 months ago. Updated about 2 months ago.

Status:
New
Priority:
Low
Assignee:
-
Category:
Snort
Target version:
-
Start date:
10/17/2020
Due date:
% Done:

0%

Estimated time:
Affected Version:
2.4.5-p1
Affected Architecture:
SG-2100

Description

It looks like Snort has hidden characters in IPv6 addresses on its alert page. This makes it difficult to search for an IP as one can only use the browser to search for four digits and a colon, and searching for a full IP can't match.

example:
2607:​f8b0:​4017:​d:​:​7

In case that doesn't come through, to the right of each colon is ASCII 8203 (https://www.codetable.net/decimal/8203). If I copy and paste it into a web site for instance I get:
https://www.ultratools.com/tools/ipv6InfoResult?ipAddress=2607%3A%26%238203%3Bf8b0%3A%26%238203%3B4017%3A%26%238203%3Bd%3A%26%238203%3B%3A%26%238203%3B7

I found this on a SG-2100 but I can't imagine it's hardware specific, it's just the only one I have Snort on at the moment since others have Suricata and not IPv6.

History

#1 Updated by Viktor Gurov about 2 months ago

Suricata issue #10187

#2 Updated by Steve Yates about 2 months ago

Oh. I searched for Snort bugs.

Also available in: Atom PDF