From cf66439e52b19751f88b6d33492f7b64501dbd12 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Wed, 8 Mar 2023 16:10:01 -0600 Subject: [PATCH] tests/quic-ietf: fix test Suricata was matching on the wrong ja3. --- tests/quic-ietf/test.rules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/quic-ietf/test.rules b/tests/quic-ietf/test.rules index 96a0bd4d6..996800ce4 100644 --- a/tests/quic-ietf/test.rules +++ b/tests/quic-ietf/test.rules @@ -1,3 +1,3 @@ alert quic any any -> any any (msg:"QUIC SNI"; quic.sni; content:"msquic.net"; sid:4;) -alert quic any any -> any any (msg:"QUIC JA3"; ja3.string; content:"771,4866,43-51-41"; sid:3;) +alert quic any any -> any any (msg:"QUIC JA3"; ja3s.string; content:"771,4866,43-51-41"; sid:3;) alert quic any any -> any any (msg:"QUIC JA3 HASH"; ja3.hash; content:"deadbeefdeadbeefdeadbeefdeadbeef"; sid:5;) -- 2.47.2