API tools faq
paste
imherenotyet

/var/log/suricata/suricata.log

imherenotyet
Jun 22nd, 2023 (edited)
120
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 116.07 KB | None | 0 0
raw download clone embed print report
  1. 22/6/2023 -- 19:53:49 - <Notice> - Signal Received. Stopping engine.
  2. 22/6/2023 -- 19:53:49 - <Perf> - 0 new flows, 0 established flows were timed out, 0 flows in closed state
  3. 22/6/2023 -- 19:53:49 - <Info> - time elapsed 10937.033s
  4. 22/6/2023 -- 19:53:50 - <Perf> - 107131 flows processed
  5. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#0) Treated: Pkts 1508733, Bytes 330808218, Errors 0
  6. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#0) Verdict: Accepted 1504699, Dropped 4033, Replaced 1
  7. 22/6/2023 -- 19:53:50 - <Perf> - AutoFP - Total flow handler queues - 12
  8. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#1) Treated: Pkts 1508402, Bytes 336436862, Errors 0
  9. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#1) Verdict: Accepted 1503890, Dropped 4510, Replaced 0
  10. 22/6/2023 -- 19:53:50 - <Perf> - AutoFP - Total flow handler queues - 12
  11. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#2) Treated: Pkts 1492952, Bytes 332643460, Errors 0
  12. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#2) Verdict: Accepted 1488015, Dropped 4935, Replaced 0
  13. 22/6/2023 -- 19:53:50 - <Perf> - AutoFP - Total flow handler queues - 12
  14. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#3) Treated: Pkts 1261065, Bytes 323811119, Errors 0
  15. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#3) Verdict: Accepted 1257271, Dropped 3793, Replaced 2
  16. 22/6/2023 -- 19:53:50 - <Perf> - AutoFP - Total flow handler queues - 12
  17. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#4) Treated: Pkts 23417277, Bytes 25737572345, Errors 0
  18. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#4) Verdict: Accepted 23365892, Dropped 51384, Replaced 4
  19. 22/6/2023 -- 19:53:50 - <Perf> - AutoFP - Total flow handler queues - 12
  20. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#5) Treated: Pkts 1180682, Bytes 296324710, Errors 0
  21. 22/6/2023 -- 19:53:50 - <Notice> - (RX-NFQ#5) Verdict: Accepted 1174282, Dropped 6399, Replaced 5
  22. 22/6/2023 -- 19:53:50 - <Perf> - AutoFP - Total flow handler queues - 12
  23. 22/6/2023 -- 19:53:50 - <Info> - Alerts: 2043
  24. 22/6/2023 -- 19:53:50 - <Perf> - ippair memory usage: 414144 bytes, maximum: 16777216
  25. 22/6/2023 -- 19:53:50 - <Perf> - host memory usage: 398144 bytes, maximum: 33554432
  26. 22/6/2023 -- 19:53:51 - <Info> - cleaning up signature grouping structure... complete
  27. 22/6/2023 -- 19:53:51 - <Perf> - Cleaning up Hyperscan global scratch
  28. 22/6/2023 -- 19:53:51 - <Perf> - Clearing Hyperscan database cache
  29. 22/6/2023 -- 19:53:51 - <Notice> - This is Suricata version 6.0.12 RELEASE running in SYSTEM mode
  30. 22/6/2023 -- 19:53:51 - <Info> - CPUs/cores online: 12
  31. 22/6/2023 -- 19:53:51 - <Config> - app-layer.error-policy: ignore
  32. 22/6/2023 -- 19:53:51 - <Config> - 'default' server has 'request-body-minimal-inspect-size' set to 32295 and 'request-body-inspect-window' set to 4034 after randomization.
  33. 22/6/2023 -- 19:53:51 - <Config> - 'default' server has 'response-body-minimal-inspect-size' set to 40549 and 'response-body-inspect-window' set to 16425 after randomization.
  34. 22/6/2023 -- 19:53:51 - <Config> - SMB stream depth: 0
  35. 22/6/2023 -- 19:53:51 - <Config> - SMB max-read-size: 0
  36. 22/6/2023 -- 19:53:51 - <Config> - SMB max-write-size: 0
  37. 22/6/2023 -- 19:53:51 - <Config> - SMB max-write-queue-size: 0
  38. 22/6/2023 -- 19:53:51 - <Config> - SMB max-write-queue-cnt: 0
  39. 22/6/2023 -- 19:53:51 - <Config> - SMB max-read-queue-size: 0
  40. 22/6/2023 -- 19:53:51 - <Config> - SMB max-read-queue-cnt: 0
  41. 22/6/2023 -- 19:53:51 - <Config> - read: max record size: 0, max queued chunks 0, max queued size 0
  42. 22/6/2023 -- 19:53:51 - <Config> - write: max record size: 0, max queued chunks 0, max queued size 0
  43. 22/6/2023 -- 19:53:51 - <Config> - Protocol detection and parser disabled for modbus protocol.
  44. 22/6/2023 -- 19:53:51 - <Config> - Protocol detection and parser disabled for enip protocol.
  45. 22/6/2023 -- 19:53:51 - <Config> - Protocol detection and parser disabled for DNP3.
  46. 22/6/2023 -- 19:53:51 - <Info> - NFQ running in standard ACCEPT/DROP mode
  47. 22/6/2023 -- 19:53:51 - <Config> - RWX pages denied by OS
  48. 22/6/2023 -- 19:53:51 - <Config> - PCRE won't use JIT as OS doesn't allow RWX pages
  49. 22/6/2023 -- 19:53:51 - <Config> - allocated 262144 bytes of memory for the host hash... 4096 buckets of size 64
  50. 22/6/2023 -- 19:53:51 - <Config> - preallocated 1000 hosts of size 136
  51. 22/6/2023 -- 19:53:51 - <Config> - host memory usage: 398144 bytes, maximum: 33554432
  52. 22/6/2023 -- 19:53:51 - <Config> - Core dump size set to unlimited.
  53. 22/6/2023 -- 19:53:51 - <Config> - defrag.memcap-policy: ignore
  54. 22/6/2023 -- 19:53:51 - <Config> - allocated 3670016 bytes of memory for the defrag hash... 65536 buckets of size 56
  55. 22/6/2023 -- 19:53:51 - <Config> - preallocated 65535 defrag trackers of size 160
  56. 22/6/2023 -- 19:53:51 - <Config> - defrag memory usage: 14155616 bytes, maximum: 33554432
  57. 22/6/2023 -- 19:53:51 - <Config> - flow.memcap-policy: ignore
  58. 22/6/2023 -- 19:53:51 - <Config> - flow size 320, memcap allows for 419430 flows. Per hash row in perfect conditions 6
  59. 22/6/2023 -- 19:53:51 - <Config> - stream "prealloc-sessions": 2048 (per thread)
  60. 22/6/2023 -- 19:53:51 - <Config> - stream "memcap": 67108864
  61. 22/6/2023 -- 19:53:51 - <Config> - stream "midstream" session pickups: disabled
  62. 22/6/2023 -- 19:53:51 - <Config> - stream "async-oneside": disabled
  63. 22/6/2023 -- 19:53:51 - <Config> - stream "checksum-validation": enabled
  64. 22/6/2023 -- 19:53:51 - <Config> - stream.memcap-policy: ignore
  65. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly.memcap-policy: ignore
  66. 22/6/2023 -- 19:53:51 - <Config> - memcap-policy: 0/0
  67. 22/6/2023 -- 19:53:51 - <Config> - stream.midstream-policy: ignore
  68. 22/6/2023 -- 19:53:51 - <Config> - stream."inline": enabled
  69. 22/6/2023 -- 19:53:51 - <Config> - stream "bypass": disabled
  70. 22/6/2023 -- 19:53:51 - <Config> - stream "max-synack-queued": 5
  71. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly "memcap": 268435456
  72. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly "depth": 1048576
  73. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly "toserver-chunk-size": 2644
  74. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly "toclient-chunk-size": 2474
  75. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly.raw: enabled
  76. 22/6/2023 -- 19:53:51 - <Config> - stream.liberal-timestamps: disabled
  77. 22/6/2023 -- 19:53:51 - <Config> - stream.reassembly "segment-prealloc": 2048
  78. 22/6/2023 -- 19:53:51 - <Info> - dropped the caps for main thread
  79. 22/6/2023 -- 19:53:51 - <Info> - fast output device (regular) initialized: fast.log
  80. 22/6/2023 -- 19:53:51 - <Info> - eve-log output device (regular) initialized: eve.json
  81. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'alert'
  82. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'anomaly'
  83. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'http'
  84. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'dns'
  85. 22/6/2023 -- 19:53:51 - <Config> - eve-log dns version not set, defaulting to version 2
  86. 22/6/2023 -- 19:53:51 - <Config> - eve-log dns version not set, defaulting to version 2
  87. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'tls'
  88. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'files'
  89. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'drop'
  90. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'smtp'
  91. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'ftp'
  92. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'rdp'
  93. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'nfs'
  94. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'smb'
  95. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'tftp'
  96. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'ikev2'
  97. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'dcerpc'
  98. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'krb5'
  99. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'snmp'
  100. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'rfb'
  101. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'sip'
  102. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'dhcp'
  103. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'ssh'
  104. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'mqtt'
  105. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'stats'
  106. 22/6/2023 -- 19:53:51 - <Config> - enabling 'eve-log' module 'flow'
  107. 22/6/2023 -- 19:53:51 - <Info> - stats output device (regular) initialized: stats.log
  108. 22/6/2023 -- 19:53:51 - <Config> - Delayed detect disabled
  109. 22/6/2023 -- 19:53:51 - <Info> - Running in live mode, activating unix socket
  110. 22/6/2023 -- 19:53:51 - <Config> - pattern matchers: MPM: hs, SPM: hs
  111. 22/6/2023 -- 19:53:51 - <Config> - grouping: tcp-whitelist (default) 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080
  112. 22/6/2023 -- 19:53:51 - <Config> - grouping: udp-whitelist (default) 53, 135, 5060
  113. 22/6/2023 -- 19:53:51 - <Config> - prefilter engines: MPM
  114. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_uri
  115. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_uri
  116. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_uri
  117. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_uri
  118. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_request_line
  119. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_client_body
  120. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_response_line
  121. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header
  122. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header
  123. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header
  124. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header
  125. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header_names
  126. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header_names
  127. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header_names
  128. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_header_names
  129. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_accept
  130. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_accept
  131. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_accept_enc
  132. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_accept_enc
  133. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_accept_lang
  134. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_accept_lang
  135. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_referer
  136. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_referer
  137. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_connection
  138. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_connection
  139. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_len
  140. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_len
  141. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_len
  142. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_len
  143. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_type
  144. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_type
  145. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_type
  146. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_content_type
  147. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http.server
  148. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http.server
  149. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http.location
  150. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http.location
  151. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_protocol
  152. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_protocol
  153. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_start
  154. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_start
  155. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_header
  156. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_header
  157. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_header
  158. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_header
  159. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_method
  160. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_method
  161. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_cookie
  162. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_cookie
  163. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_cookie
  164. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_cookie
  165. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  166. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  167. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  168. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  169. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  170. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  171. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  172. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  173. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  174. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  175. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.name
  176. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  177. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  178. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  179. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  180. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  181. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  182. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  183. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  184. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  185. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  186. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file.magic
  187. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_user_agent
  188. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_user_agent
  189. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_host
  190. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_host
  191. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_host
  192. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_raw_host
  193. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_stat_msg
  194. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_stat_code
  195. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http_stat_code
  196. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http2_header_name
  197. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http2_header_name
  198. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http2_header
  199. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for http2_header
  200. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dns_query
  201. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dnp3_data
  202. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dnp3_data
  203. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tls.sni
  204. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tls.cert_issuer
  205. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tls.cert_subject
  206. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tls.cert_serial
  207. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tls.cert_fingerprint
  208. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tls.certs
  209. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ja3.hash
  210. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ja3.string
  211. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ja3s.hash
  212. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ja3s.string
  213. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dce_stub_data
  214. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dce_stub_data
  215. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dce_stub_data
  216. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for dce_stub_data
  217. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for smb_named_pipe
  218. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for smb_share
  219. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh.proto
  220. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh.proto
  221. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh_software
  222. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh_software
  223. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh.hassh
  224. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh.hassh.server
  225. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh.hassh.string
  226. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ssh.hassh.server.string
  227. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file_data
  228. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file_data
  229. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file_data
  230. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file_data
  231. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file_data
  232. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for file_data
  233. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for krb5_cname
  234. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for krb5_sname
  235. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.method
  236. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.uri
  237. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.protocol
  238. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.protocol
  239. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.method
  240. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.stat_msg
  241. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.request_line
  242. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for sip.response_line
  243. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for rfb.name
  244. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for snmp.community
  245. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for snmp.community
  246. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.connect.clientid
  247. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.connect.username
  248. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.connect.password
  249. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.connect.willtopic
  250. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.connect.willmessage
  251. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.publish.topic
  252. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.publish.message
  253. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.subscribe.topic
  254. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for mqtt.unsubscribe.topic
  255. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for icmpv4.hdr
  256. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for tcp.hdr
  257. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for udp.hdr
  258. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for icmpv6.hdr
  259. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ipv4.hdr
  260. 22/6/2023 -- 19:53:51 - <Perf> - using shared mpm ctx' for ipv6.hdr
  261. 22/6/2023 -- 19:53:51 - <Config> - IP reputation disabled
  262. 22/6/2023 -- 19:53:51 - <Config> - Loading rule file: /var/lib/suricata/rules/suricata.rules
  263. 22/6/2023 -- 19:53:55 - <Config> - Loading rule file: /var/lib/suricata/rules/bittorrent.rules
  264. 22/6/2023 -- 19:53:55 - <Config> - Loading rule file: /var/lib/suricata/rules/emerging-p2p.rules
  265. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET P2P Ares Server Connection"; flow:established,to_server; dsize:<70; content:"r|be|bloop|00|dV"; content:"Ares|00 0a|"; distance:16; reference:url,aresgalaxy.sourceforge.net; reference:url,doc.emergingthreats.net/bin/view/Main/2008591; classtype:policy-violation; sid:2008591; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  266. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET 1024: -> $EXTERNAL_NET 1024: (msg:"ET P2P Ares Server Connection"; flow:established,to_server; dsize:<70; content:"r|be|bloop|00|dV"; content:"Ares|00 0a|"; distance:16; reference:url,aresgalaxy.sourceforge.net; reference:url,doc.emergingthreats.net/bin/view/Main/2008591; classtype:policy-violation; sid:2008591; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 41
  267. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 6969 (msg:"ET P2P BitTorrent Announce"; flow: to_server,established; content:"/announce"; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000369; classtype:policy-violation; sid:2000369; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  268. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 6969 (msg:"ET P2P BitTorrent Announce"; flow: to_server,established; content:"/announce"; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000369; classtype:policy-violation; sid:2000369; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 43
  269. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET P2P Edonkey Publicize File ACK"; dsize:<20; content:"|e3 0d|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003311; classtype:policy-violation; sid:2003311; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  270. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $EXTERNAL_NET 1024:65535 -> $HOME_NET 1024:65535 (msg:"ET P2P Edonkey Publicize File ACK"; dsize:<20; content:"|e3 0d|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003311; classtype:policy-violation; sid:2003311; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 51
  271. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Edonkey Connect Request"; dsize:25; content:"|e3 0a|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003312; classtype:policy-violation; sid:2003312; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  272. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Edonkey Connect Request"; dsize:25; content:"|e3 0a|"; depth:2; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003312; classtype:policy-violation; sid:2003312; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 53
  273. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P GnucDNA UDP Ultrapeer Traffic"; content:"SCP@|83|DNA@"; threshold: type both,track by_src,count 10,seconds 600; reference:url,doc.emergingthreats.net/bin/view/Main/2002760; classtype:policy-violation; sid:2002760; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  274. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P GnucDNA UDP Ultrapeer Traffic"; content:"SCP@|83|DNA@"; threshold: type both,track by_src,count 10,seconds 600; reference:url,doc.emergingthreats.net/bin/view/Main/2002760; classtype:policy-violation; sid:2002760; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 61
  275. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Kazaa over UDP"; content:"KaZaA"; nocase; threshold: type threshold, track by_src,count 10, seconds 60; reference:url,www.kazaa.com/us/index.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001796; classtype:policy-violation; sid:2001796; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  276. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Kazaa over UDP"; content:"KaZaA"; nocase; threshold: type threshold, track by_src,count 10, seconds 60; reference:url,www.kazaa.com/us/index.htm; reference:url,doc.emergingthreats.net/bin/view/Main/2001796; classtype:policy-violation; sid:2001796; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 63
  277. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $EXTERNAL_NET 41170 -> $HOME_NET any (msg:"ET P2P Manolito Connection (1)"; dsize:<48; content:"|3d 4a d9|"; depth:3; reference:url,doc.emergingthreats.net/2009097; classtype:policy-violation; sid:2009097; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  278. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $EXTERNAL_NET 41170 -> $HOME_NET any (msg:"ET P2P Manolito Connection (1)"; dsize:<48; content:"|3d 4a d9|"; depth:3; reference:url,doc.emergingthreats.net/2009097; classtype:policy-violation; sid:2009097; rev:2; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 65
  279. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 41170 (msg:"ET P2P Manolito Ping"; dsize:<24; content:"|3d|"; depth:1; content:"|d9|"; distance:1; content:"|ed bb|"; distance:13; threshold: type limit, track by_src, seconds 300, count 1; reference:url,doc.emergingthreats.net/2009098; classtype:policy-violation; sid:2009098; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  280. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 41170 (msg:"ET P2P Manolito Ping"; dsize:<24; content:"|3d|"; depth:1; content:"|d9|"; distance:1; content:"|ed bb|"; distance:13; threshold: type limit, track by_src, seconds 300, count 1; reference:url,doc.emergingthreats.net/2009098; classtype:policy-violation; sid:2009098; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 67
  281. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp any any -> any any (msg:"ET P2P Phatbot Control Connection"; flow: established; content:"Wonk-"; content:"|00|#waste|00|"; within: 15; reference:url,www.lurhq.com/phatbot.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000015; classtype:trojan-activity; sid:2000015; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  282. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any any -> any any (msg:"ET P2P Phatbot Control Connection"; flow: established; content:"Wonk-"; content:"|00|#waste|00|"; within: 15; reference:url,www.lurhq.com/phatbot.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000015; classtype:trojan-activity; sid:2000015; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 69
  283. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $EXTERNAL_NET 2234 -> $HOME_NET any (msg:"ET P2P Soulseek Filesearch Results"; flow: from_server,established; content:"|09 00 00 00 78|"; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001187; classtype:policy-violation; sid:2001187; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  284. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET 2234 -> $HOME_NET any (msg:"ET P2P Soulseek Filesearch Results"; flow: from_server,established; content:"|09 00 00 00 78|"; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001187; classtype:policy-violation; sid:2001187; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 71
  285. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Server Key Retrieval"; flow:established,to_server; content:"GET /tor/server/"; depth:16; threshold:type limit, track by_src, count 1, seconds 30; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002950; classtype:policy-violation; sid:2002950; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  286. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Server Key Retrieval"; flow:established,to_server; content:"GET /tor/server/"; depth:16; threshold:type limit, track by_src, count 1, seconds 30; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002950; classtype:policy-violation; sid:2002950; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 73
  287. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Status Update"; flow:established,to_server; content:"GET /tor/status/"; depth:16; threshold:type limit, track by_src, count 1, seconds 60; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002951; classtype:policy-violation; sid:2002951; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  288. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Status Update"; flow:established,to_server; content:"GET /tor/status/"; depth:16; threshold:type limit, track by_src, count 1, seconds 60; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002951; classtype:policy-violation; sid:2002951; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 75
  289. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET P2P TOR 1.0 Inbound Circuit Traffic"; flow:established; content:"TOR"; content:"<identity>"; rawbytes; distance:10; within:35; threshold:type limit, track by_src, count 1, seconds 120; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002952; classtype:policy-violation; sid:2002952; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  290. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET any -> $HOME_NET 1024: (msg:"ET P2P TOR 1.0 Inbound Circuit Traffic"; flow:established; content:"TOR"; content:"<identity>"; rawbytes; distance:10; within:35; threshold:type limit, track by_src, count 1, seconds 120; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002952; classtype:policy-violation; sid:2002952; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 77
  291. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Outbound Circuit Traffic"; flow:established; content:"TOR"; content:"<identity>"; rawbytes; distance:10; within:35; threshold:type limit, track by_src, count 1, seconds 120; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002953; classtype:policy-violation; sid:2002953; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  292. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 1024: (msg:"ET P2P TOR 1.0 Outbound Circuit Traffic"; flow:established; content:"TOR"; content:"<identity>"; rawbytes; distance:10; within:35; threshold:type limit, track by_src, count 1, seconds 120; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2002953; classtype:policy-violation; sid:2002953; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 79
  293. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT ping request"; content:"d1|3a|ad2|3a|id20|3a|"; depth:12; nocase; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008581; classtype:policy-violation; sid:2008581; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  294. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT ping request"; content:"d1|3a|ad2|3a|id20|3a|"; depth:12; nocase; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008581; classtype:policy-violation; sid:2008581; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 81
  295. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT announce_peers request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; depth:14; content:"e1|3a|q13|3a|announce_peer1|3a|"; nocase; distance:55; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008585; classtype:policy-violation; sid:2008585; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  296. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT announce_peers request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; depth:14; content:"e1|3a|q13|3a|announce_peer1|3a|"; nocase; distance:55; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008585; classtype:policy-violation; sid:2008585; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 83
  297. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P LimeWire P2P Traffic"; flow: established; content:"Server|3a| LimeWire"; nocase; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2007800; classtype:policy-violation; sid:2007800; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  298. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P LimeWire P2P Traffic"; flow: established; content:"Server|3a| LimeWire"; nocase; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2007800; classtype:policy-violation; sid:2007800; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 85
  299. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET 8247 (msg:"ET P2P Octoshape P2P streaming media"; content:"POST / HTTP/1."; depth:64; content:"Oshtcp-streamtype|3a|"; threshold: type limit, track by_src, count 1, seconds 600; reference:url,doc.emergingthreats.net/2010008; classtype:policy-violation; sid:2010008; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  300. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET 8247 (msg:"ET P2P Octoshape P2P streaming media"; content:"POST / HTTP/1."; depth:64; content:"Oshtcp-streamtype|3a|"; threshold: type limit, track by_src, count 1, seconds 600; reference:url,doc.emergingthreats.net/2010008; classtype:policy-violation; sid:2010008; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 87
  301. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT nodes reply"; content:"d1|3a|rd2|3a|id20|3a|"; nocase; depth:12; content:"5|3a|nodes"; nocase; distance:20; within:7; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008583; classtype:policy-violation; sid:2008583; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  302. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT nodes reply"; content:"d1|3a|rd2|3a|id20|3a|"; nocase; depth:12; content:"5|3a|nodes"; nocase; distance:20; within:7; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008583; classtype:policy-violation; sid:2008583; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 91
  303. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Direct Connect Traffic (client-server)"; flow:from_client,established; content:"$MyINFO"; depth:7; reference:url,en.wikipedia.org/wiki/Direct_connect_file-sharing_application; reference:url,doc.emergingthreats.net/bin/view/Main/2002814; classtype:policy-violation; sid:2002814; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  304. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Direct Connect Traffic (client-server)"; flow:from_client,established; content:"$MyINFO"; depth:7; reference:url,en.wikipedia.org/wiki/Direct_connect_file-sharing_application; reference:url,doc.emergingthreats.net/bin/view/Main/2002814; classtype:policy-violation; sid:2002814; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 93
  305. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET 4660:4799 (msg:"ET P2P eDonkey Server Status Request"; content:"|e3 96|"; depth: 2; reference:url,www.edonkey.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001298; classtype:policy-violation; sid:2001298; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  306. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET 4660:4799 (msg:"ET P2P eDonkey Server Status Request"; content:"|e3 96|"; depth: 2; reference:url,www.edonkey.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001298; classtype:policy-violation; sid:2001298; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 99
  307. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp any 1024: -> any 1024: (msg:"ET P2P Gnutella TCP Traffic"; flow: established,to_server; content:"GNUTELLA"; depth:8; content:"200 OK|0d 0a|"; within:15; threshold: type both,track by_src,count 5,seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2007801; classtype:policy-violation; sid:2007801; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  308. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any 1024: -> any 1024: (msg:"ET P2P Gnutella TCP Traffic"; flow: established,to_server; content:"GNUTELLA"; depth:8; content:"200 OK|0d 0a|"; within:15; threshold: type both,track by_src,count 5,seconds 360; reference:url,doc.emergingthreats.net/bin/view/Main/2007801; classtype:policy-violation; sid:2007801; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 103
  309. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P KuGoo P2P Connection"; dsize:<30; content:"|64|"; depth:1; content:"|70|"; distance:5; content:"|50 37|"; distance:4; reference:url,koogoo.com; reference:url,doc.emergingthreats.net/2009966; classtype:policy-violation; sid:2009966; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  310. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P KuGoo P2P Connection"; dsize:<30; content:"|64|"; depth:1; content:"|70|"; distance:5; content:"|50 37|"; distance:4; reference:url,koogoo.com; reference:url,doc.emergingthreats.net/2009966; classtype:policy-violation; sid:2009966; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 105
  311. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $EXTERNAL_NET 2240 -> $HOME_NET 1024: (msg:"ET P2P SoulSeek P2P Login Response"; flow:from_server,established; content:"|5c 01 00 00 01 00 00 00|"; depth:8; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/2008611; classtype:policy-violation; sid:2008611; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  312. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $EXTERNAL_NET 2240 -> $HOME_NET 1024: (msg:"ET P2P SoulSeek P2P Login Response"; flow:from_server,established; content:"|5c 01 00 00 01 00 00 00|"; depth:8; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/2008611; classtype:policy-violation; sid:2008611; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 109
  313. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Vuze BT Connection"; flow:established; content:"|00 00|"; depth:2; content:"|05|AZVER|01|"; distance:5; within:7; content:"appid"; within:10; threshold:type limit, track by_src, count 10, seconds 600; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010139; classtype:policy-violation; sid:2010139; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  314. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Vuze BT Connection"; flow:established; content:"|00 00|"; depth:2; content:"|05|AZVER|01|"; distance:5; within:7; content:"appid"; within:10; threshold:type limit, track by_src, count 10, seconds 600; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010139; classtype:policy-violation; sid:2010139; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 111
  315. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET any (msg:"ET P2P Vuze BT UDP Connection (2)"; dsize:94; content:"|00 00 04|"; depth:3; content:"|00 00 00 00 00|"; distance:14; within:5; content:"|ff ff ff ff 00 00 00 00 02 05 21|"; distance:8; within:11; content:"|00 00 00 00 00 00|"; distance:25; within:6; content:"|00 00|"; distance:20; within:2; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010141; classtype:policy-violation; sid:2010141; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  316. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET any (msg:"ET P2P Vuze BT UDP Connection (2)"; dsize:94; content:"|00 00 04|"; depth:3; content:"|00 00 00 00 00|"; distance:14; within:5; content:"|ff ff ff ff 00 00 00 00 02 05 21|"; distance:8; within:11; content:"|00 00 00 00 00 00|"; distance:25; within:6; content:"|00 00|"; distance:20; within:2; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010141; classtype:policy-violation; sid:2010141; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 113
  317. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $EXTERNAL_NET any -> $HOME_NET 1024:65535 (msg:"ET P2P Vuze BT UDP Connection (3)"; dsize:80; content:"|00 00 04|"; depth:3; content:"|00 00 00 00 00|"; distance:14; within:5; content:"|02 05 21 04|"; distance:4; within:4; threshold:type limit, track by_dst, count 10, seconds 600; reference:url,doc.emergingthreats.net/2010142; classtype:policy-violation; sid:2010142; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  318. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $EXTERNAL_NET any -> $HOME_NET 1024:65535 (msg:"ET P2P Vuze BT UDP Connection (3)"; dsize:80; content:"|00 00 04|"; depth:3; content:"|00 00 00 00 00|"; distance:14; within:5; content:"|02 05 21 04|"; distance:4; within:4; threshold:type limit, track by_dst, count 10, seconds 600; reference:url,doc.emergingthreats.net/2010142; classtype:policy-violation; sid:2010142; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 115
  319. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $EXTERNAL_NET any -> $HOME_NET 1024:65535 (msg:"ET P2P Vuze BT UDP Connection (4)"; dsize:<300; content:"|00 00 04|"; depth:3; content:"|00 00 00 00 00|"; distance:14; within:5; content:"|ff ff ff ff|"; distance:8; within:4; reference:url,doc.emergingthreats.net/2010143; classtype:policy-violation; sid:2010143; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  320. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $EXTERNAL_NET any -> $HOME_NET 1024:65535 (msg:"ET P2P Vuze BT UDP Connection (4)"; dsize:<300; content:"|00 00 04|"; depth:3; content:"|00 00 00 00 00|"; distance:14; within:5; content:"|ff ff ff ff|"; distance:8; within:4; reference:url,doc.emergingthreats.net/2010143; classtype:policy-violation; sid:2010143; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 117
  321. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Connection Request(2)"; dsize:35; content:"|e4 20|"; depth:2; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009968; classtype:policy-violation; sid:2009968; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  322. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Connection Request(2)"; dsize:35; content:"|e4 20|"; depth:2; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009968; classtype:policy-violation; sid:2009968; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 119
  323. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Firewalled Request"; dsize:35; content:"|e4 50|"; depth:2; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009969; classtype:policy-violation; sid:2009969; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  324. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Firewalled Request"; dsize:35; content:"|e4 50|"; depth:2; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009969; classtype:policy-violation; sid:2009969; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 121
  325. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Server Status Request"; dsize:44; content:"|8c 97|"; depth:2; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009972; classtype:policy-violation; sid:2009972; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  326. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Server Status Request"; dsize:44; content:"|8c 97|"; depth:2; threshold: type limit, count 5, seconds 600, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009972; classtype:policy-violation; sid:2009972; rev:4; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 123
  327. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Gnutella Connect"; flow: established,to_server; content:"GNUTELLA CONNECT/"; nocase; depth:17; reference:url,www.gnutella.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001664; classtype:policy-violation; sid:2001664; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  328. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Gnutella Connect"; flow: established,to_server; content:"GNUTELLA CONNECT/"; nocase; depth:17; reference:url,www.gnutella.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001664; classtype:policy-violation; sid:2001664; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 127
  329. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Gnutella TCP Ultrapeer Traffic"; flow: established,to_server; content:"GNUTELLA"; depth:8; content:"X-Ultrapeer|3a| True"; nocase; threshold: type both,track by_src,count 5,seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2002761; classtype:policy-violation; sid:2002761; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  330. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Gnutella TCP Ultrapeer Traffic"; flow: established,to_server; content:"GNUTELLA"; depth:8; content:"X-Ultrapeer|3a| True"; nocase; threshold: type both,track by_src,count 5,seconds 3600; reference:url,doc.emergingthreats.net/bin/view/Main/2002761; classtype:policy-violation; sid:2002761; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 129
  331. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Limewire P2P UDP Traffic"; dsize:35; content:"|49 50 40 83 53 43 50 41 00 00|"; offset:25; depth:10; threshold: type both, track by_src, count 1, seconds 360; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001809; classtype:policy-violation; sid:2001809; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  332. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P Limewire P2P UDP Traffic"; dsize:35; content:"|49 50 40 83 53 43 50 41 00 00|"; offset:25; depth:10; threshold: type both, track by_src, count 1, seconds 360; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001809; classtype:policy-violation; sid:2001809; rev:8; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 131
  333. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT get_peers request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; offset:12; content:"9|3a|info_hash20|3a|"; nocase; distance:20; within:14; content:"e1|3a|q9|3a|get_peers1|3a|"; nocase; distance:20; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008584; classtype:policy-violation; sid:2008584; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  334. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT get_peers request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; offset:12; content:"9|3a|info_hash20|3a|"; nocase; distance:20; within:14; content:"e1|3a|q9|3a|get_peers1|3a|"; nocase; distance:20; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008584; classtype:policy-violation; sid:2008584; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 133
  335. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp any any -> any 4660:4799 (msg:"ET P2P ed2k request part"; flow: to_server,established; content:"|e3|"; offset: 1; content:"|00 00 00 47|"; distance: 2; within: 4; reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000332; classtype:policy-violation; sid:2000332; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  336. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any any -> any 4660:4799 (msg:"ET P2P ed2k request part"; flow: to_server,established; content:"|e3|"; offset: 1; content:"|00 00 00 47|"; distance: 2; within: 4; reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000332; classtype:policy-violation; sid:2000332; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 135
  337. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp any any -> any 4660:4799 (msg:"ET P2P ed2k file request answer"; flow: to_server,established; content:"|e3|"; offset: 1; content:"|00 00 00 59|"; distance: 2; within: 4; reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000333; classtype:policy-violation; sid:2000333; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  338. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any any -> any 4660:4799 (msg:"ET P2P ed2k file request answer"; flow: to_server,established; content:"|e3|"; offset: 1; content:"|00 00 00 59|"; distance: 2; within: 4; reference:url,www.giac.org/practical/GCIH/Ian_Gosling_GCIH.pdf; reference:url,doc.emergingthreats.net/bin/view/Main/2000333; classtype:policy-violation; sid:2000333; rev:11; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 137
  339. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT find_node request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; depth:24; content:"6|3a|target20|3a|"; nocase; distance:20; content:"e1|3a|q9|3a|find_node1|3a|"; nocase; distance:20; content:"e1|3a|q9|3a|find_node1|3a|"; distance:20; nocase; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008582; classtype:policy-violation; sid:2008582; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  340. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent DHT find_node request"; content:"d1|3a|ad2|3a|id20|3a|"; nocase; depth:24; content:"6|3a|target20|3a|"; nocase; distance:20; content:"e1|3a|q9|3a|find_node1|3a|"; nocase; distance:20; content:"e1|3a|q9|3a|find_node1|3a|"; distance:20; nocase; threshold: type both, count 1, seconds 300, track by_src; reference:url,wiki.theory.org/BitTorrentDraftDHTProtocol; reference:url,doc.emergingthreats.net/bin/view/Main/2008582; classtype:policy-violation; sid:2008582; rev:7; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 151
  341. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P Ocelot BitTorrent Server in Use"; flow:established,from_server; content:"HTTP/1.1 200 |0d 0a|Server|3a| Ocelot "; depth:30; classtype:policy-violation; sid:2012467; rev:2; metadata:created_at 2011_03_10, updated_at 2011_03_10;)"
  342. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P Ocelot BitTorrent Server in Use"; flow:established,from_server; content:"HTTP/1.1 200 |0d 0a|Server|3a| Ocelot "; depth:30; classtype:policy-violation; sid:2012467; rev:2; metadata:created_at 2011_03_10, updated_at 2011_03_10;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 153
  343. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 6881:6889 (msg:"GPL P2P BitTorrent transfer"; flow:to_server,established; content:"|13|BitTorrent protocol"; depth:20; classtype:policy-violation; sid:2102181; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;)"
  344. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 6881:6889 (msg:"GPL P2P BitTorrent transfer"; flow:to_server,established; content:"|13|BitTorrent protocol"; depth:20; classtype:policy-violation; sid:2102181; rev:3; metadata:created_at 2010_09_23, updated_at 2010_09_23;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 159
  345. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp any 4711 -> $HOME_NET any (msg:"GPL P2P eDonkey server response"; flow:established,from_server; content:"Server|3A| eMule"; reference:url,www.emule-project.net; classtype:policy-violation; sid:2102587; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;)"
  346. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any 4711 -> $HOME_NET any (msg:"GPL P2P eDonkey server response"; flow:established,from_server; content:"Server|3A| eMule"; reference:url,www.emule-project.net; classtype:policy-violation; sid:2102587; rev:4; metadata:created_at 2010_09_23, updated_at 2010_09_23;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 163
  347. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL P2P GNUTella client request"; flow:to_server,established; content:"GNUTELLA OK"; depth:40; classtype:policy-violation; sid:2100557; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)"
  348. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL P2P GNUTella client request"; flow:to_server,established; content:"GNUTELLA OK"; depth:40; classtype:policy-violation; sid:2100557; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 165
  349. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL P2P GNUTella client request"; flow:to_server,established; content:"GNUTELLA"; depth:8; classtype:policy-violation; sid:2101432; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)"
  350. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL P2P GNUTella client request"; flow:to_server,established; content:"GNUTELLA"; depth:8; classtype:policy-violation; sid:2101432; rev:7; metadata:created_at 2010_09_23, updated_at 2010_09_23;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 167
  351. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Connection Request"; dsize:35; content:"|e4 21|"; depth:2; threshold: type limit, count 1, seconds 300, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009967; classtype:policy-violation; sid:2009967; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  352. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024:65535 (msg:"ET P2P eMule KAD Network Connection Request"; dsize:35; content:"|e4 21|"; depth:2; threshold: type limit, count 1, seconds 300, track by_src; reference:url,emule-project.net; reference:url,doc.emergingthreats.net/2009967; classtype:policy-violation; sid:2009967; rev:5; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 173
  353. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent Traffic"; flow: established; content:"|0000400907000000|"; depth:8; threshold: type limit, count 1, seconds 120, track by_src; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000357; classtype:policy-violation; sid:2000357; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  354. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BitTorrent Traffic"; flow: established; content:"|0000400907000000|"; depth:8; threshold: type limit, count 1, seconds 120, track by_src; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000357; classtype:policy-violation; sid:2000357; rev:9; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 177
  355. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET any (msg:"ET P2P Vuze BT UDP Connection (5)"; dsize:<20; content:"|00 00 04 17 27 10 19 80 00 00 00 00|"; depth:12; threshold: type limit, count 1, seconds 120, track by_src; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010144; classtype:policy-violation; sid:2010144; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  356. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET any (msg:"ET P2P Vuze BT UDP Connection (5)"; dsize:<20; content:"|00 00 04 17 27 10 19 80 00 00 00 00|"; depth:12; threshold: type limit, count 1, seconds 120, track by_src; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010144; classtype:policy-violation; sid:2010144; rev:6; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 179
  357. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET !7680 (msg:"ET P2P BitTorrent peer sync"; flow:established; content:"|00 00 00 0d 06 00|"; depth:6; threshold: type limit, track by_dst, seconds 300, count 1; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000334; classtype:policy-violation; sid:2000334; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)"
  358. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET !7680 (msg:"ET P2P BitTorrent peer sync"; flow:established; content:"|00 00 00 0d 06 00|"; depth:6; threshold: type limit, track by_dst, seconds 300, count 1; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,doc.emergingthreats.net/bin/view/Main/2000334; classtype:policy-violation; sid:2000334; rev:13; metadata:created_at 2010_07_30, updated_at 2010_07_30;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 193
  359. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 7680 (msg:"ET P2P MS WUDO Peer Sync"; flow:established; content:"|00 00 00 0d 06 00|"; depth:6; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq; classtype:policy-violation; sid:2022371; rev:1; metadata:created_at 2016_01_15, updated_at 2016_01_15;)"
  360. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp $HOME_NET any -> $EXTERNAL_NET 7680 (msg:"ET P2P MS WUDO Peer Sync"; flow:established; content:"|00 00 00 0d 06 00|"; depth:6; reference:url,bitconjurer.org/BitTorrent/protocol.html; reference:url,windows.microsoft.com/en-us/windows-10/windows-update-delivery-optimization-faq; classtype:policy-violation; sid:2022371; rev:1; metadata:created_at 2016_01_15, updated_at 2016_01_15;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 195
  361. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P BitTorrent - Torrent File Downloaded"; flow:established,to_client; file_data; content:"d8|3a|announce"; within:11; content:!"mapfactor.com"; classtype:policy-violation; sid:2014734; rev:5; metadata:created_at 2012_05_11, updated_at 2012_05_11;)"
  362. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P BitTorrent - Torrent File Downloaded"; flow:established,to_client; file_data; content:"d8|3a|announce"; within:11; content:!"mapfactor.com"; classtype:policy-violation; sid:2014734; rev:5; metadata:created_at 2012_05_11, updated_at 2012_05_11;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 197
  363. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024: (msg:"ET P2P Vuze BT UDP Connection"; dsize:<80; content:!"|00 22 02 00|"; depth: 4; content:"|00 00 04|"; distance:8; within:3; content:"|00 00 00 00 00|"; distance:6; within:5; threshold: type limit, count 1, seconds 120, track by_src; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010140; classtype:policy-violation; sid:2010140; rev:7; metadata:created_at 2010_07_30, updated_at 2016_11_01;)"
  364. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> $EXTERNAL_NET 1024: (msg:"ET P2P Vuze BT UDP Connection"; dsize:<80; content:!"|00 22 02 00|"; depth: 4; content:"|00 00 04|"; distance:8; within:3; content:"|00 00 00 00 00|"; distance:6; within:5; threshold: type limit, count 1, seconds 120, track by_src; reference:url,vuze.com; reference:url,doc.emergingthreats.net/2010140; classtype:policy-violation; sid:2010140; rev:7; metadata:created_at 2010_07_30, updated_at 2016_11_01;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 199
  365. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET [!3389,1024:65535] -> $EXTERNAL_NET [!3389,1024:65535] (msg:"ET P2P Edonkey Search Request (search by name)"; dsize:>5; content:"|e3 98|"; depth:2; content:"|01|"; within:3; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003319; classtype:policy-violation; sid:2003319; rev:4; metadata:created_at 2010_07_30, updated_at 2019_01_18;)"
  366. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET [!3389,1024:65535] -> $EXTERNAL_NET [!3389,1024:65535] (msg:"ET P2P Edonkey Search Request (search by name)"; dsize:>5; content:"|e3 98|"; depth:2; content:"|01|"; within:3; reference:url,www.giac.org/certified_professionals/practicals/gcih/0446.php; reference:url,doc.emergingthreats.net/bin/view/Main/2003319; classtype:policy-violation; sid:2003319; rev:4; metadata:created_at 2010_07_30, updated_at 2019_01_18;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 201
  367. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert udp $HOME_NET 1024:65535 -> [$EXTERNAL_NET,!224.0.0.0/4] 1024:65535 (msg:"ET P2P ThunderNetwork UDP Traffic"; dsize:<38; content:"|32 00 00 00|"; depth:4; content:"|00 00 00 00|"; distance:1; threshold:type limit, track by_src, count 1, seconds 300; reference:url,xunlei.com; reference:url,en.wikipedia.org/wiki/Xunlei; reference:url,doc.emergingthreats.net/2009099; classtype:policy-violation; sid:2009099; rev:4; metadata:created_at 2010_07_30, updated_at 2019_01_28;)"
  368. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert udp $HOME_NET 1024:65535 -> [$EXTERNAL_NET,!224.0.0.0/4] 1024:65535 (msg:"ET P2P ThunderNetwork UDP Traffic"; dsize:<38; content:"|32 00 00 00|"; depth:4; content:"|00 00 00 00|"; distance:1; threshold:type limit, track by_src, count 1, seconds 300; reference:url,xunlei.com; reference:url,en.wikipedia.org/wiki/Xunlei; reference:url,doc.emergingthreats.net/2009099; classtype:policy-violation; sid:2009099; rev:4; metadata:created_at 2010_07_30, updated_at 2019_01_28;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 203
  369. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P Soulseek"; flow: established; content:"slsknet"; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001188; classtype:policy-violation; sid:2001188; rev:9; metadata:created_at 2010_07_30, updated_at 2019_09_27;)"
  370. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET P2P Soulseek"; flow: established; content:"slsknet"; reference:url,www.slsknet.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001188; classtype:policy-violation; sid:2001188; rev:9; metadata:created_at 2010_07_30, updated_at 2019_09_27;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 205
  371. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL P2P BitTorrent announce request"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/announce"; content:"info_hash="; content:"event=started"; classtype:policy-violation; sid:2102180; rev:7; metadata:created_at 2010_09_23, updated_at 2020_04_21;)"
  372. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL P2P BitTorrent announce request"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/announce"; content:"info_hash="; content:"event=started"; classtype:policy-violation; sid:2102180; rev:7; metadata:created_at 2010_09_23, updated_at 2020_04_21;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 207
  373. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P QVOD P2P Sharing Traffic detected (tcp)"; flow:established,from_client; urilen:8; content:"|13|QVOD protocol|00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; http.method; content:"POST"; http.uri; content:"/service"; classtype:policy-violation; sid:2014459; rev:3; metadata:created_at 2012_04_03, updated_at 2020_04_21;)"
  374. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P QVOD P2P Sharing Traffic detected (tcp)"; flow:established,from_client; urilen:8; content:"|13|QVOD protocol|00 00 00 00 00 00 00 00 00 00 00 00 00 00|"; http.method; content:"POST"; http.uri; content:"/service"; classtype:policy-violation; sid:2014459; rev:3; metadata:created_at 2012_04_03, updated_at 2020_04_21;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 209
  375. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BearShare P2P Gnutella Client HTTP Request"; flow:to_server,established; http.uri; content:"/gnutella/"; nocase; content:"?client=BEAR"; nocase; content:"&version="; reference:url,doc.emergingthreats.net/bin/view/Main/2006379; classtype:trojan-activity; sid:2006379; rev:7; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_04_22;)"
  376. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BearShare P2P Gnutella Client HTTP Request"; flow:to_server,established; http.uri; content:"/gnutella/"; nocase; content:"?client=BEAR"; nocase; content:"&version="; reference:url,doc.emergingthreats.net/bin/view/Main/2006379; classtype:trojan-activity; sid:2006379; rev:7; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_04_22;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 211
  377. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Enhanced CTorrent 3.x)"; flow:to_server,established; http.user_agent; content:"Enhanced-CTorrent"; reference:url,www.rahul.net/dholmes/ctorrent; reference:url,doc.emergingthreats.net/2011703; classtype:policy-violation; sid:2011703; rev:7; metadata:created_at 2010_07_30, updated_at 2020_04_23;)"
  378. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Enhanced CTorrent 3.x)"; flow:to_server,established; http.user_agent; content:"Enhanced-CTorrent"; reference:url,www.rahul.net/dholmes/ctorrent; reference:url,doc.emergingthreats.net/2011703; classtype:policy-violation; sid:2011703; rev:7; metadata:created_at 2010_07_30, updated_at 2020_04_23;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 213
  379. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Opera/10.x)"; flow:to_server,established; http.user_agent; content:"Opera BitTorrent, Opera/"; reference:url,www.opera.com; reference:url,doc.emergingthreats.net/2011701; classtype:policy-violation; sid:2011701; rev:7; metadata:created_at 2010_07_30, updated_at 2020_04_23;)"
  380. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Opera/10.x)"; flow:to_server,established; http.user_agent; content:"Opera BitTorrent, Opera/"; reference:url,www.opera.com; reference:url,doc.emergingthreats.net/2011701; classtype:policy-violation; sid:2011701; rev:7; metadata:created_at 2010_07_30, updated_at 2020_04_23;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 215
  381. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Vagaa peer-to-peer (Transfer)"; flow:from_client,established; http.header; content:"VAGAA-OPERATION|3a| Transfer|0d 0a|"; reference:url,en.wikipedia.org/wiki/Vagaa; classtype:policy-violation; sid:2018012; rev:3; metadata:created_at 2014_01_27, updated_at 2020_04_27;)"
  382. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Vagaa peer-to-peer (Transfer)"; flow:from_client,established; http.header; content:"VAGAA-OPERATION|3a| Transfer|0d 0a|"; reference:url,en.wikipedia.org/wiki/Vagaa; classtype:policy-violation; sid:2018012; rev:3; metadata:created_at 2014_01_27, updated_at 2020_04_27;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 217
  383. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (uTorrent)"; flow:to_server,established; http.header; content:"User-Agent|3a 20|uTorrent"; reference:url,www.utorrent.com; reference:url,doc.emergingthreats.net/2011706; classtype:policy-violation; sid:2011706; rev:7; metadata:created_at 2010_07_30, updated_at 2022_05_03;)"
  384. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (uTorrent)"; flow:to_server,established; http.header; content:"User-Agent|3a 20|uTorrent"; reference:url,www.utorrent.com; reference:url,doc.emergingthreats.net/2011706; classtype:policy-violation; sid:2011706; rev:7; metadata:created_at 2010_07_30, updated_at 2022_05_03;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 219
  385. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x)"; flow:established,to_server; http.user_agent; content:"Transmission/"; depth:13; reference:url,www.transmissionbt.com; reference:url,doc.emergingthreats.net/2011699; classtype:policy-violation; sid:2011699; rev:7; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_08_18;)"
  386. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Transmission/1.x)"; flow:established,to_server; http.user_agent; content:"Transmission/"; depth:13; reference:url,www.transmissionbt.com; reference:url,doc.emergingthreats.net/2011699; classtype:policy-violation; sid:2011699; rev:7; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_08_18;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 221
  387. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Deluge 1.x.x)"; flow:to_server,established; http.user_agent; content:"Deluge"; depth:6; reference:url,deluge-torrent.org; reference:url,doc.emergingthreats.net/2011704; classtype:policy-violation; sid:2011704; rev:7; metadata:created_at 2010_07_30, updated_at 2020_08_18;)"
  388. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Deluge 1.x.x)"; flow:to_server,established; http.user_agent; content:"Deluge"; depth:6; reference:url,deluge-torrent.org; reference:url,doc.emergingthreats.net/2011704; classtype:policy-violation; sid:2011704; rev:7; metadata:created_at 2010_07_30, updated_at 2020_08_18;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 223
  389. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Pando Client User-Agent Detected"; flow:established,to_server; http.user_agent; content:"Pando/"; reference:url,doc.emergingthreats.net/bin/view/Main/2008625; classtype:policy-violation; sid:2008625; rev:8; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_08_27;)"
  390. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Pando Client User-Agent Detected"; flow:established,to_server; http.user_agent; content:"Pando/"; reference:url,doc.emergingthreats.net/bin/view/Main/2008625; classtype:policy-violation; sid:2008625; rev:8; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_08_27;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 225
  391. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Tor Get Server Request"; flow:established,to_server; http.uri; content:"/tor/server/"; nocase; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2008113; classtype:policy-violation; sid:2008113; rev:5; metadata:created_at 2010_07_30, updated_at 2020_09_01;)"
  392. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Tor Get Server Request"; flow:established,to_server; http.uri; content:"/tor/server/"; nocase; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2008113; classtype:policy-violation; sid:2008113; rev:5; metadata:created_at 2010_07_30, updated_at 2020_09_01;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 227
  393. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Tor Get Status Request"; flow:established,to_server; http.uri; content:"/tor/status/"; nocase; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2008115; classtype:policy-violation; sid:2008115; rev:5; metadata:created_at 2010_07_30, updated_at 2020_09_02;)"
  394. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Tor Get Status Request"; flow:established,to_server; http.uri; content:"/tor/status/"; nocase; reference:url,tor.eff.org; reference:url,doc.emergingthreats.net/2008115; classtype:policy-violation; sid:2008115; rev:5; metadata:created_at 2010_07_30, updated_at 2020_09_02;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 229
  395. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (FDM 3.x)"; flow:to_server,established; http.user_agent; content:"FDM 3."; depth:6; reference:url,www.freedownloadmanager.org; reference:url,doc.emergingthreats.net/2011712; classtype:policy-violation; sid:2011712; rev:8; metadata:created_at 2010_07_30, updated_at 2020_09_13;)"
  396. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (FDM 3.x)"; flow:to_server,established; http.user_agent; content:"FDM 3."; depth:6; reference:url,www.freedownloadmanager.org; reference:url,doc.emergingthreats.net/2011712; classtype:policy-violation; sid:2011712; rev:8; metadata:created_at 2010_07_30, updated_at 2020_09_13;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 231
  397. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BTWebClient UA uTorrent in use"; flow:established,to_server; http.user_agent; content:"BTWebClient"; classtype:policy-violation; sid:2012247; rev:6; metadata:created_at 2011_01_27, updated_at 2020_09_14;)"
  398. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BTWebClient UA uTorrent in use"; flow:established,to_server; http.user_agent; content:"BTWebClient"; classtype:policy-violation; sid:2012247; rev:6; metadata:created_at 2011_01_27, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 233
  399. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (rTorrent)"; flow:to_server,established; http.user_agent; content:"rtorrent/"; depth:9; reference:url,libtorrent.rakshasa.no; reference:url,doc.emergingthreats.net/2011705; classtype:policy-violation; sid:2011705; rev:7; metadata:created_at 2010_07_30, updated_at 2020_09_14;)"
  400. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (rTorrent)"; flow:to_server,established; http.user_agent; content:"rtorrent/"; depth:9; reference:url,libtorrent.rakshasa.no; reference:url,doc.emergingthreats.net/2011705; classtype:policy-violation; sid:2011705; rev:7; metadata:created_at 2010_07_30, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 235
  401. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Libtorrent User-Agent"; flow:to_server,established; http.user_agent; content:"libtorrent"; nocase; classtype:policy-violation; sid:2012390; rev:6; metadata:created_at 2011_02_27, former_category P2P, updated_at 2020_09_14;)"
  402. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Libtorrent User-Agent"; flow:to_server,established; http.user_agent; content:"libtorrent"; nocase; classtype:policy-violation; sid:2012390; rev:6; metadata:created_at 2011_02_27, former_category P2P, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 237
  403. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client HTTP Request"; flow:to_server,established; http.uri; content:"/trackerphp/announce.php?"; nocase; content:"?port="; nocase; content:"&peer_id="; reference:url,doc.emergingthreats.net/bin/view/Main/2006375; classtype:trojan-activity; sid:2006375; rev:8; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_09_14;)"
  404. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client HTTP Request"; flow:to_server,established; http.uri; content:"/trackerphp/announce.php?"; nocase; content:"?port="; nocase; content:"&peer_id="; reference:url,doc.emergingthreats.net/bin/view/Main/2006375; classtype:trojan-activity; sid:2006375; rev:8; metadata:created_at 2010_07_30, former_category P2P, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 239
  405. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Morpheus Install"; flow: to_server,established; http.uri; content:"/morpheus/morpheus.exe"; nocase; reference:url,www.morpheus.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001035; classtype:policy-violation; sid:2001035; rev:11; metadata:created_at 2010_07_30, updated_at 2020_09_14;)"
  406. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Morpheus Install"; flow: to_server,established; http.uri; content:"/morpheus/morpheus.exe"; nocase; reference:url,www.morpheus.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001035; classtype:policy-violation; sid:2001035; rev:11; metadata:created_at 2010_07_30, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 241
  407. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Morpheus Install ini Download"; flow: to_server,established; http.uri; content:"/morpheus/morpheus_sm.ini"; nocase; reference:url,www.morpheus.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001036; classtype:policy-violation; sid:2001036; rev:11; metadata:created_at 2010_07_30, updated_at 2020_09_14;)"
  408. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Morpheus Install ini Download"; flow: to_server,established; http.uri; content:"/morpheus/morpheus_sm.ini"; nocase; reference:url,www.morpheus.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001036; classtype:policy-violation; sid:2001036; rev:11; metadata:created_at 2010_07_30, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 243
  409. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Morpheus Update Request"; flow: to_server,established; http.uri; content:"/gwebcache/gcache.asg?hostfile="; nocase; reference:url,www.morpheus.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001037; classtype:policy-violation; sid:2001037; rev:11; metadata:created_at 2010_07_30, updated_at 2020_09_14;)"
  410. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Morpheus Update Request"; flow: to_server,established; http.uri; content:"/gwebcache/gcache.asg?hostfile="; nocase; reference:url,www.morpheus.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001037; classtype:policy-violation; sid:2001037; rev:11; metadata:created_at 2010_07_30, updated_at 2020_09_14;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 245
  411. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P zzima_loader"; flow:established, to_server; http.method; content: "GET"; http.uri; content:"/zzima_loader/"; fast_pattern; http.user_agent; content:"zzima-nloader/ 1.0.3.1"; depth:22; http.header_names; content:!"Referer|0d 0a|"; reference:md5,810b4464785d8d007ca0c86c046ac0ef; classtype:trojan-activity; sid:2018532; rev:5; metadata:created_at 2014_06_05, updated_at 2020_09_24;)"
  412. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P zzima_loader"; flow:established, to_server; http.method; content: "GET"; http.uri; content:"/zzima_loader/"; fast_pattern; http.user_agent; content:"zzima-nloader/ 1.0.3.1"; depth:22; http.header_names; content:!"Referer|0d 0a|"; reference:md5,810b4464785d8d007ca0c86c046ac0ef; classtype:trojan-activity; sid:2018532; rev:5; metadata:created_at 2014_06_05, updated_at 2020_09_24;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 247
  413. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P p2p Related User-Agent (eChanblard)"; flow:to_server,established; http.user_agent; content:"eChanblard"; depth:10; endswith; reference:url,doc.emergingthreats.net/2011232; classtype:trojan-activity; sid:2011232; rev:9; metadata:created_at 2010_07_30, updated_at 2020_10_13;)"
  414. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P p2p Related User-Agent (eChanblard)"; flow:to_server,established; http.user_agent; content:"eChanblard"; depth:10; endswith; reference:url,doc.emergingthreats.net/2011232; classtype:trojan-activity; sid:2011232; rev:9; metadata:created_at 2010_07_30, updated_at 2020_10_13;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 249
  415. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Ares traffic"; flow:established,to_server; http.user_agent; content:"Ares"; startswith; reference:url,www.aresgalaxy.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001059; classtype:policy-violation; sid:2001059; rev:11; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  416. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Ares traffic"; flow:established,to_server; http.user_agent; content:"Ares"; startswith; reference:url,www.aresgalaxy.org; reference:url,doc.emergingthreats.net/bin/view/Main/2001059; classtype:policy-violation; sid:2001059; rev:11; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 251
  417. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Azureus P2P Client User-Agent"; flow:to_server,established; http.user_agent; content:"Azureus"; depth:7; reference:url,doc.emergingthreats.net/bin/view/Main/2007799; classtype:policy-violation; sid:2007799; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  418. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Azureus P2P Client User-Agent"; flow:to_server,established; http.user_agent; content:"Azureus"; depth:7; reference:url,doc.emergingthreats.net/bin/view/Main/2007799; classtype:policy-violation; sid:2007799; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 253
  419. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (BTSP)"; flow:to_server,established; http.user_agent; content:"BTSP/"; depth:5; reference:url,doc.emergingthreats.net/2011713; classtype:policy-violation; sid:2011713; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  420. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (BTSP)"; flow:to_server,established; http.user_agent; content:"BTSP/"; depth:5; reference:url,doc.emergingthreats.net/2011713; classtype:policy-violation; sid:2011713; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 255
  421. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (BitComet)"; flow:to_server,established; http.user_agent; content:"BitComet/"; depth:9; reference:url,www.bitcomet.com; reference:url,doc.emergingthreats.net/2011710; classtype:policy-violation; sid:2011710; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  422. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (BitComet)"; flow:to_server,established; http.user_agent; content:"BitComet/"; depth:9; reference:url,www.bitcomet.com; reference:url,doc.emergingthreats.net/2011710; classtype:policy-violation; sid:2011710; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 257
  423. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (BitTornado)"; flow:to_server,established; http.user_agent; content:"BitTornado/"; depth:11; reference:url,www.bittornado.com; reference:url,doc.emergingthreats.net/2011702; classtype:policy-violation; sid:2011702; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  424. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (BitTornado)"; flow:to_server,established; http.user_agent; content:"BitTornado/"; depth:11; reference:url,www.bittornado.com; reference:url,doc.emergingthreats.net/2011702; classtype:policy-violation; sid:2011702; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 259
  425. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Bittorrent/5.x.x)"; flow:to_server,established; http.user_agent; content:"Bittorrent"; depth:10; reference:url,doc.emergingthreats.net/bin/view/Main/2006372; classtype:trojan-activity; sid:2006372; rev:10; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  426. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (Bittorrent/5.x.x)"; flow:to_server,established; http.user_agent; content:"Bittorrent"; depth:10; reference:url,doc.emergingthreats.net/bin/view/Main/2006372; classtype:trojan-activity; sid:2006372; rev:10; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 261
  427. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (KTorrent/3.x.x)"; flow:to_server,established; http.user_agent; content:"KTorrent/3"; depth:10; reference:url,ktorrent.org; reference:url,doc.emergingthreats.net/2011700; classtype:policy-violation; sid:2011700; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  428. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Bittorrent P2P Client User-Agent (KTorrent/3.x.x)"; flow:to_server,established; http.user_agent; content:"KTorrent/3"; depth:10; reference:url,ktorrent.org; reference:url,doc.emergingthreats.net/2011700; classtype:policy-violation; sid:2011700; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 263
  429. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Client User-Agent (Shareaza 2.x)"; flow:to_server,established; http.user_agent; content:"Shareaza 2."; depth:11; reference:url,shareaza.sourceforge.net; reference:url,doc.emergingthreats.net/2011707; classtype:policy-violation; sid:2011707; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  430. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Client User-Agent (Shareaza 2.x)"; flow:to_server,established; http.user_agent; content:"Shareaza 2."; depth:11; reference:url,shareaza.sourceforge.net; reference:url,doc.emergingthreats.net/2011707; classtype:policy-violation; sid:2011707; rev:7; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 267
  431. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BearShare P2P Gnutella Client User-Agent (BearShare 6.x.x.x)"; flow:to_server,established; http.user_agent; content:"BearShare"; depth:9; reference:url,doc.emergingthreats.net/bin/view/Main/2006371; classtype:trojan-activity; sid:2006371; rev:10; metadata:created_at 2010_07_30, updated_at 2020_10_19;)"
  432. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P BearShare P2P Gnutella Client User-Agent (BearShare 6.x.x.x)"; flow:to_server,established; http.user_agent; content:"BearShare"; depth:9; reference:url,doc.emergingthreats.net/bin/view/Main/2006371; classtype:trojan-activity; sid:2006371; rev:10; metadata:created_at 2010_07_30, updated_at 2020_10_19;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 269
  433. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P FFTorrent P2P Client User-Agent (FFTorrent/x.x.x)"; flow:to_server,established; http.user_agent; content:"FFTorrent/"; depth:10; classtype:policy-violation; sid:2028942; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_11_05, deployment Perimeter, signature_severity Major, updated_at 2020_10_21;)"
  434. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P FFTorrent P2P Client User-Agent (FFTorrent/x.x.x)"; flow:to_server,established; http.user_agent; content:"FFTorrent/"; depth:10; classtype:policy-violation; sid:2028942; rev:2; metadata:affected_product Windows_XP_Vista_7_8_10_Server_32_64_Bit, attack_target Client_Endpoint, created_at 2019_11_05, deployment Perimeter, signature_severity Major, updated_at 2020_10_21;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 271
  435. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Possible Torrent Download via HTTP Request"; flow:established,to_server; http.uri; content:".torrent"; nocase; endswith; http.host; content:!"mapfactor.com"; content:!"verismic.blob.core.windows.net"; reference:url,doc.emergingthreats.net/bin/view/Main/2007727; classtype:policy-violation; sid:2007727; rev:12; metadata:created_at 2010_07_30, former_category P2P, signature_severity Informational, updated_at 2022_11_21;)"
  436. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P Possible Torrent Download via HTTP Request"; flow:established,to_server; http.uri; content:".torrent"; nocase; endswith; http.host; content:!"mapfactor.com"; content:!"verismic.blob.core.windows.net"; reference:url,doc.emergingthreats.net/bin/view/Main/2007727; classtype:policy-violation; sid:2007727; rev:12; metadata:created_at 2010_07_30, former_category P2P, signature_severity Informational, updated_at 2022_11_21;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 275
  437. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_DUPLICATE_SIG(176)] - Duplicate signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P LimeWire P2P Traffic"; flow:established,to_server; http.user_agent; content:"LimeWire"; startswith; nocase; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001808; classtype:policy-violation; sid:2001808; rev:9; metadata:created_at 2010_07_30, updated_at 2023_02_13;)"
  438. 22/6/2023 -- 19:53:55 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET P2P LimeWire P2P Traffic"; flow:established,to_server; http.user_agent; content:"LimeWire"; startswith; nocase; reference:url,www.limewire.com; reference:url,doc.emergingthreats.net/bin/view/Main/2001808; classtype:policy-violation; sid:2001808; rev:9; metadata:created_at 2010_07_30, updated_at 2023_02_13;)" from file /var/lib/suricata/rules/emerging-p2p.rules at line 277
  439. 22/6/2023 -- 19:53:55 - <Config> - No rules loaded from emerging-p2p.rules.
  440. 22/6/2023 -- 19:53:55 - <Info> - 3 rule files processed. 34379 rules successfully loaded, 87 rules failed
  441. 22/6/2023 -- 19:53:55 - <Info> - Threshold config parsed: 0 rule(s) found
  442. 22/6/2023 -- 19:53:56 - <Perf> - using shared mpm ctx' for tcp-packet
  443. 22/6/2023 -- 19:53:56 - <Perf> - using shared mpm ctx' for tcp-stream
  444. 22/6/2023 -- 19:53:56 - <Perf> - using shared mpm ctx' for udp-packet
  445. 22/6/2023 -- 19:53:56 - <Perf> - using shared mpm ctx' for other-ip
  446. 22/6/2023 -- 19:53:56 - <Info> - 34382 signatures processed. 1275 are IP-only rules, 5227 are inspecting packet payload, 27673 inspect application layer, 108 are decoder event only
  447. 22/6/2023 -- 19:53:56 - <Config> - building signature grouping structure, stage 1: preprocessing rules... complete
  448. 22/6/2023 -- 19:53:56 - <Perf> - TCP toserver: 41 port groups, 40 unique SGH's, 1 copies
  449. 22/6/2023 -- 19:53:56 - <Perf> - TCP toclient: 21 port groups, 21 unique SGH's, 0 copies
  450. 22/6/2023 -- 19:53:56 - <Perf> - UDP toserver: 41 port groups, 39 unique SGH's, 2 copies
  451. 22/6/2023 -- 19:53:56 - <Perf> - UDP toclient: 21 port groups, 16 unique SGH's, 5 copies
  452. 22/6/2023 -- 19:53:56 - <Perf> - OTHER toserver: 254 proto groups, 4 unique SGH's, 250 copies
  453. 22/6/2023 -- 19:53:56 - <Perf> - OTHER toclient: 254 proto groups, 0 unique SGH's, 254 copies
  454. 22/6/2023 -- 19:53:56 - <Perf> - Unique rule groups: 120
  455. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "toserver TCP packet": 29
  456. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "toclient TCP packet": 20
  457. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "toserver TCP stream": 31
  458. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "toclient TCP stream": 20
  459. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "toserver UDP packet": 39
  460. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "toclient UDP packet": 16
  461. 22/6/2023 -- 19:53:56 - <Perf> - Builtin MPM "other IP packet": 3
  462. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_uri (http)": 8
  463. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_uri (http2)": 8
  464. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_raw_uri (http)": 2
  465. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_raw_uri (http2)": 2
  466. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_request_line (http)": 5
  467. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_client_body (http)": 7
  468. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_response_line (http)": 1
  469. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_header (http)": 8
  470. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_header (http)": 8
  471. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_header (http2)": 8
  472. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_header (http2)": 8
  473. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_header_names (http)": 9
  474. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_header_names (http)": 9
  475. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_header_names (http2)": 9
  476. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_header_names (http2)": 9
  477. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_accept (http)": 5
  478. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_accept (http2)": 5
  479. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_accept_enc (http)": 1
  480. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_accept_enc (http2)": 1
  481. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_accept_lang (http)": 1
  482. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_accept_lang (http2)": 1
  483. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_referer (http)": 1
  484. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_referer (http2)": 1
  485. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_connection (http)": 1
  486. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_connection (http2)": 1
  487. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_content_len (http)": 1
  488. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_content_len (http2)": 1
  489. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_content_len (http)": 1
  490. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_content_len (http2)": 1
  491. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_content_type (http)": 2
  492. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_content_type (http2)": 2
  493. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_content_type (http)": 2
  494. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_content_type (http2)": 2
  495. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http.server (http)": 2
  496. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http.server (http2)": 2
  497. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http.location (http)": 1
  498. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http.location (http2)": 1
  499. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_start (http)": 6
  500. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_start (http)": 6
  501. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_raw_header (http)": 2
  502. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_raw_header (http)": 2
  503. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_raw_header (http2)": 2
  504. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_raw_header (http2)": 2
  505. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_method (http)": 2
  506. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_method (http2)": 2
  507. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_cookie (http)": 3
  508. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_cookie (http)": 3
  509. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_cookie (http2)": 3
  510. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_cookie (http2)": 3
  511. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_user_agent (http)": 7
  512. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_user_agent (http2)": 7
  513. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_host (http)": 1
  514. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_host (http)": 2
  515. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_host (http2)": 1
  516. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_host (http2)": 2
  517. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_raw_host (http)": 1
  518. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver http_raw_host (http2)": 1
  519. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_stat_code (http)": 2
  520. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient http_stat_code (http2)": 2
  521. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver dns_query (dns)": 1
  522. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver dns_query (dns)": 1
  523. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver tls.sni (tls)": 2
  524. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver tls.sni (tls)": 1
  525. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient tls.cert_issuer (tls)": 5
  526. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient tls.cert_subject (tls)": 4
  527. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient tls.cert_serial (tls)": 2
  528. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient tls.certs (tls)": 3
  529. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver ja3.hash (tls)": 2
  530. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient ja3s.hash (tls)": 1
  531. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver ssh.proto (ssh)": 1
  532. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient ssh.proto (ssh)": 1
  533. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver file_data (smtp)": 7
  534. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient file_data (http)": 7
  535. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver file_data (smb)": 7
  536. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient file_data (smb)": 7
  537. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toserver file_data (http2)": 7
  538. 22/6/2023 -- 19:53:56 - <Perf> - AppLayer MPM "toclient file_data (http2)": 7
  539. 22/6/2023 -- 19:54:04 - <Config> - AutoFP mode using "Hash" flow load balancer
  540. 22/6/2023 -- 19:54:04 - <Info> - binding this thread 0 to queue '0'
  541. 22/6/2023 -- 19:54:04 - <Info> - setting queue length to 4096
  542. 22/6/2023 -- 19:54:04 - <Info> - setting nfnl bufsize to 6144000
  543. 22/6/2023 -- 19:54:04 - <Info> - binding this thread 1 to queue '1'
  544. 22/6/2023 -- 19:54:04 - <Info> - setting queue length to 4096
  545. 22/6/2023 -- 19:54:04 - <Info> - setting nfnl bufsize to 6144000
  546. 22/6/2023 -- 19:54:04 - <Info> - binding this thread 2 to queue '2'
  547. 22/6/2023 -- 19:54:04 - <Info> - setting queue length to 4096
  548. 22/6/2023 -- 19:54:04 - <Info> - setting nfnl bufsize to 6144000
  549. 22/6/2023 -- 19:54:04 - <Info> - binding this thread 3 to queue '3'
  550. 22/6/2023 -- 19:54:04 - <Info> - setting queue length to 4096
  551. 22/6/2023 -- 19:54:04 - <Info> - setting nfnl bufsize to 6144000
  552. 22/6/2023 -- 19:54:04 - <Info> - binding this thread 4 to queue '4'
  553. 22/6/2023 -- 19:54:04 - <Info> - setting queue length to 4096
  554. 22/6/2023 -- 19:54:04 - <Info> - setting nfnl bufsize to 6144000
  555. 22/6/2023 -- 19:54:04 - <Info> - binding this thread 5 to queue '5'
  556. 22/6/2023 -- 19:54:04 - <Info> - setting queue length to 4096
  557. 22/6/2023 -- 19:54:04 - <Info> - setting nfnl bufsize to 6144000
  558. 22/6/2023 -- 19:54:04 - <Config> - using 1 flow manager threads
  559. 22/6/2023 -- 19:54:04 - <Config> - using 1 flow recycler threads
  560. 22/6/2023 -- 19:54:04 - <Info> - Running in live mode, activating unix socket
  561. 22/6/2023 -- 19:54:04 - <Info> - Using unix socket file '/var/run/suricata/suricata-command.socket'
  562. 22/6/2023 -- 19:54:04 - <Notice> - all 24 packet processing threads, 4 management threads initialized, engine started.
  563.  
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!