From 474961952ff5ef620b7a0de3fa3254b15fa4bedf Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Mon, 23 Oct 2023 17:01:37 -0300 Subject: [PATCH] tests/tcp-hdr: actually test tcp-hdr keyword Noticed that the tcp-hdr keyword test rule was actually using tcp.mss. Adjusted it to use tcp.hdr instead. --- tests/tcp-hdr-keyword/test.rules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/tcp-hdr-keyword/test.rules b/tests/tcp-hdr-keyword/test.rules index a1aa40a19..8204ac8cb 100644 --- a/tests/tcp-hdr-keyword/test.rules +++ b/tests/tcp-hdr-keyword/test.rules @@ -1 +1 @@ -alert tcp any any -> any any (tcp.mss:<536; sid:1234; rev:5;) +alert tcp any any -> any any (tcp.hdr; content:"|02 04|"; offset:20; byte_test:2,<,536,0,big,relative; sid:1234; rev:5;) -- 2.47.2