# Several protosig questions **URL:** \ **Category:** Zeek\ **Created:** [October 15, 2016, 4:48pm UTC](https://community.zeek.org/t/several-protosig-questions/4415 "2016-10-15T16:48:09Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 15, 2016, 4:48pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/1 "2016-10-15T16:48:09Z")
Wow…so here’s my sig: signature protosig\_ntp\_apple { dst-ip == 17.0.0.0/8 ip-proto == udp dst-port == 123 payload /.\*\x00/ payload-size == 48 eval ProtoSig::match } First, IP is 192.168.1.95 → 17.253.4.253 udp port 123. Issue #1: CIDR doesn’t appear to work…with the above dst-ip entry this fails to identify ntp\_apple, commenting out the dst-ip the line matches. Issue #2: Payload-size; of interest, if you don’t set a payload entry, then setting payload-size with “\>” and “==” won’t match, but ANY number with “\<” fired off. Ironically I could set payload-size \< 1 and this would fire. this is using latest beta. Thank you. James ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 15, 2016, 4:52pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/2 "2016-10-15T16:52:19Z")
Also if interest, header ip[16:4] == 17.0.0.0/8 DOES in fact work, so I believe there’s an issue with the dst-ip item. James ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 17, 2016, 8:31pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/3 "2016-10-17T20:31:47Z")
Do you have a trace that you can send demonstrating the two issues? Robin ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 17, 2016, 9:08pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/4 "2016-10-17T21:08:01Z")
> Do you have a trace that you can send demonstrating the two issues? > > Robin Included! Sigs below (in 2.4.1 order mattered..I think last matched gets the protosig tag, but I've swapped these around with the same results)..in either case only ntp matches, not ntp\_apple. Maybe it's a beta thing? signature protosig\_ntp {    ip-proto == udp    dst-port == 123    payload /.\*\x00/    payload-size == 48    eval ProtoSig::match } signature protosig\_ntp\_apple {    #header ip[16:4] == 17.0.0.0/8    dst-ip = = 17.0.0.0/8    ip-proto == udp    dst-port == 123    payload /.\*\x00/    payload-size == 48    eval ProtoSig::match } Thank you. James [ntp-1.pcap](https://community.zeek.org/uploads/short-url/o8QoR3ke2rfAsu7WtDjt8My6Ret.pcap) (1.27 KB) ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 17, 2016, 9:11pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/5 "2016-10-17T21:11:27Z")
> > Do you have a trace that you can send demonstrating the two issues? > > > > Robin > > Included! Sigs below (in 2.4.1 order mattered..I think last matched > gets the protosig tag, but I've swapped these around with the same > results)..in either case only ntp matches, not ntp\_apple. Maybe it's > a beta thing? > > signature protosig\_ntp { >   ip-proto == udp >   dst-port == 123 >   payload /.\*\x00/ >   payload-size == 48 >   eval ProtoSig::match > } > > signature protosig\_ntp\_apple { >   #header ip[16:4] == 17.0.0.0/8 -\> dst-ip == 17.0.0.0/8 ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 18, 2016, 6:28pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/6 "2016-10-18T18:28:58Z")
Thanks, I'll take a look, give me a little bit. Robin ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 18, 2016, 6:30pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/7 "2016-10-18T18:30:46Z")
Thanks Robin...I err on the side of "maybe I hosed something up" in general 🙂 James ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 20, 2016, 12:28am UTC](https://community.zeek.org/t/several-protosig-questions/4415/8 "2016-10-20T00:28:28Z")
So both the problems turn out to be bugs: dst-ip is indeed not working with IPv4 CIDR ranges, and payload-size is behaving oddly with (I believe only) UDP. I have patches for both in git branch topic/robin/sig-fixes, could you give that a try? Robin ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 20, 2016, 12:44am UTC](https://community.zeek.org/t/several-protosig-questions/4415/9 "2016-10-20T00:44:32Z")
Can do…those patches in the bro git repository or somewhere else? I wasn’t able to find them on github. Thanks for the work Robin! James ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 20, 2016, 3:10am UTC](https://community.zeek.org/t/several-protosig-questions/4415/10 "2016-10-20T03:10:54Z")
Yeah: [Fix a couple of problems with signature matching. · bro/bro@5cf2320 · GitHub](https://github.com/bro/bro/commit/5cf2320fbc3ebb0d53e431829d2c9c56fdf6f08b) Robin ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 21, 2016, 11:38pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/11 "2016-10-21T23:38:01Z")
So ok here’s where I’m at. With only the ntp\_apple rule this works. However if I have a generic ntp rule, either before or after the ntp\_apple, I only get the ntp match: signature protosig\_ntp { ip-proto == udp dst-port == 123 payload /.\*\x00/ payload-size == 48 eval ProtoSig::match } signature protosig\_ntp\_apple { #header ip[16:4] == 17.0.0.0/8 dst-ip == 17.0.0.0/8 ip-proto == udp dst-port == 123 payload /.\*\x00/ payload-size == 48 eval ProtoSig::match } #signature protosig\_ntp { # ip-proto == udp # dst-port == 123 # payload /.\*\x00/ # payload-size == 48 # eval ProtoSig::match #} Currently with 2.4.1 protosig you put the generic one first, and the specific ones after. This appears to have changed? Anyway at least it does now match, so that’s a plus. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 24, 2016, 6:51pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/12 "2016-10-24T18:51:46Z")
> However if I have a generic ntp rule, either before or after the > ntp\_apple, I only get the ntp match: Let me clarify one thing: > eval ProtoSig::match "eval" is not for flagging a match. It's a condition by itself that influences the matching of the signature. To learn about a match use "event" instead and then hook into the "signature\_event" event. If I do that, things seem to work for me correctly with the sig-fixes branch:     # cat test.sig     signature protosig\_ntp {       ip-proto == udp       dst-port == 123       payload /.\*\x00/       payload-size == 48       event "match"          }     signature protosig\_ntp\_apple {       dst-ip == 17.0.0.0/8       ip-proto == udp       dst-port == 123       payload /.\*\x00/       payload-size == 48       event "match"     }     # cat test.bro     event signature\_match(state: signature\_state, msg: string, data: string)             {             print "signature match", state$sig\_id;             }     # bro -s ./test.sig -r ntp-1.pcap ./test.bro     signature match, protosig\_ntp     signature match, protosig\_ntp\_apple     signature match, protosig\_ntp     signature match, protosig\_ntp\_apple     signature match, protosig\_ntp     signature match, protosig\_ntp\_apple     signature match, protosig\_ntp     signature match, protosig\_ntp\_apple     signature match, protosig\_ntp     signature match, protosig\_ntp\_apple     signature match, protosig\_ntp     signature match, protosig\_ntp\_apple      If I add "eval", I do see it execute for both signatures, though more often for the generic one. That's probably an artefact of the order in which conditions are run internally; having the dst-ip in there may change that. Btw, the order of matches is undefined, and might have well changed since 2.4. Robin ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 24, 2016, 6:58pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/13 "2016-10-24T18:58:08Z")
> > However if I have a generic ntp rule, either before or after the > > ntp\_apple, I only get the ntp match: > > Let me clarify one thing: > > > eval ProtoSig::match > > "eval" is not for flagging a match. It's a condition by itself that > influences the matching of the signature. To learn about a match use > "event" instead and then hook into the "signature\_event" event. If I > do that, things seem to work for me correctly with the sig-fixes > branch: Ok cool...I've just been going per the docs here: [https://github.com/broala/bro-protosigs](https://github.com/broala/bro-protosigs) "You must add the eval ProtoSig::match condition into your signature that does the final match. That call is what ties the signature match into the protosigs Bro scripts." I'll give event a go and report my findings. Thanks so much Robin! James ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 24, 2016, 7:53pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/14 "2016-10-24T19:53:56Z")
> > However if I have a generic ntp rule, either before or after the > > ntp\_apple, I only get the ntp match: > > Let me clarify one thing: > > > eval ProtoSig::match > > "eval" is not for flagging a match. It's a condition by itself that > influences the matching of the signature. To learn about a match use > "event" instead and then hook into the "signature\_event" event. If I > do that, things seem to work for me correctly with the sig-fixes > branch: Ok first off thanks for that test setup...now I can just test a sig vs. a pcap, so that's tight. My results: [13:36:27 @tester:~/dev/bro$] bro -s ./test.sig -r pcaps/ntp-1.pcap ./test.bro signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple So it does indeed match...however in the official conn.log, this is what I get: [13:36:32 @tester:~/dev/bro$] ./testhome pcaps/ntp-1.pcap [13:36:37 @tester:~/dev/bro$] cat conn.log #separator \x09 #set\_separator , #empty\_field (empty) #unset\_field - #path conn #open 2016-10-24-13-36-37 #fields ts uid id.orig\_h id.orig\_p id.resp\_h id.resp\_p proto service duration orig\_bytes resp\_bytes conn\_state local\_orig local\_resp missed\_bytes history orig\_pkts orig\_ip\_bytes resp\_pkts resp\_ip\_bytes tunnel\_parents protosig #types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string] string 1476535656.489094 ClixtHWwLmpBYkZRh 192.168.1.95 123 17.253.4.253 123 udp - 0.040715 48 48 SF T F 0 Dd 1 76 1 76 (empty) ntp 1476535656.533910 CJFnxQiLgFYwVcEFi 192.168.1.95 123 17.253.4.125 123 udp - 0.040804 48 48 SF T F 0 Dd 1 76 1 76 (empty) ntp 1476535657.111868 Cds9uP3GtXbb1jHh3d 192.168.1.95 123 17.253.26.253 123 udp - 0.037826 48 48 SF T F 0 Dd 1 76 1 76 (empty) ntp 1476535738.400766 CTkIhX1qHjadF6iple 192.168.1.100 123 17.253.4.253 123 udp - 0.040577 48 48 SF T F 0 Dd 1 76 1 76 (empty) ntp 1476535738.360132 Chm9Q6WalLZnpFx4g 192.168.1.100 123 17.253.26.253 123 udp - 0.037825 48 48 SF T F 0 Dd 1 76 1 76 (empty) ntp 1476535739.752622 CRWW8j41rCTK6gYZSk 192.168.1.100 123 17.253.4.125 123 udp - 0.040857 48 48 SF T F 0 Dd 1 76 1 76 (empty) ntp #close 2016-10-24-13-36-37 Swapping which sig is first gets me this: [13:46:24 @tester:~/dev/bro$] bro -s ./test.sig -r pcaps/ntp-1.pcap ./test.bro signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp signature match, protosig\_ntp\_apple signature match, protosig\_ntp But the same results as above in conn.log. So I guess that's a feature request? To hard define either a first rule that matches gets logged, or the last rule that matches gets logged. This will allow granular flow identification..which, to be honest, is the whole reason I'm doing this in the first place 🙂 Thanks again Robin. ---
**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\ **Post date:** [October 26, 2016, 10:47pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/15 "2016-10-26T22:47:10Z")
It's a feature, not a bug. 🙂 The signature engine always reports all matches, actually with the intention to \*not\* make order matter. What you could do is add logic in scriptland that selects which match to continue working with, based on some scheme you come up with (like having a table of signature names map to priorities). Robin ---
**Author:** ![James\_inthe\_box](https://avatars.discourse-cdn.com/v4/letter/j/6f9a4e/32.png) [@James\_inthe\_box](https://community.zeek.org/u/James_inthe_box)\ **Post date:** [October 27, 2016, 11:43am UTC](https://community.zeek.org/t/several-protosig-questions/4415/16 "2016-10-27T11:43:08Z")
Thanks Robin…that helps. Truth be told I wouldn’t have a clue on where to start have a table of sigs to map priorities, so I guess I’ll suck it up and just make specific sigs and leave out the generics. I’ll keep testing and report anything else…thanks again for the work on this. James ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:44pm UTC](https://community.zeek.org/t/several-protosig-questions/4415/17 "2022-05-06T15:44:09Z")