Project

General

Profile

Actions
Copy link

Bug #10989

open

Snort alert page has hidden characters in IPv6 address

Added by Steve Y about 4 years ago. Updated about 4 years ago.

Status:
New
Priority:
Low
Assignee:
-
Category:
Snort
Target version:
-
Start date:
10/17/2020
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Affected Version:
2.4.5-p1
Affected Plus Version:
Affected Architecture:
SG-2100

Description

It looks like Snort has hidden characters in IPv6 addresses on its alert page. This makes it difficult to search for an IP as one can only use the browser to search for four digits and a colon, and searching for a full IP can't match.

example:
2607:​f8b0:​4017:​d:​:​7

In case that doesn't come through, to the right of each colon is ASCII 8203 (https://www.codetable.net/decimal/8203). If I copy and paste it into a web site for instance I get:
https://www.ultratools.com/tools/ipv6InfoResult?ipAddress=2607%3A%26%238203%3Bf8b0%3A%26%238203%3B4017%3A%26%238203%3Bd%3A%26%238203%3B%3A%26%238203%3B7

I found this on a SG-2100 but I can't imagine it's hardware specific, it's just the only one I have Snort on at the moment since others have Suricata and not IPv6.

Actions
Copy link

Also available in: Atom PDF