OPNsense Forum

English Forums => Intrusion Detection and Prevention => Topic started by: fxs on November 14, 2019, 09:36:27 PM

Title: errcod sc_WARN FLOWBIT(306)
Post by: fxs on November 14, 2019, 09:36:27 PM
Hi,
Easy question: what should I do ? 
Easy answer?
(I'm newbie).
Hardware is DEC630 from deciso.
Versions   OPNsense 19.7.6-amd64
FreeBSD 11.2-RELEASE-p14-HBSD
OpenSSL 1.0.2t 10 Sep 2019

Quote
Nov 13 23:54:51   suricata: [100235] <Notice> -- all 5 packet processing threads, 4 management threads initialized, engine started.
Nov 13 23:53:51   suricata: [100235] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'FB346039_0' is checked but not set. Checked in 2024774 and 0 other sigs
Nov 13 23:53:51   suricata: [100235] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ET.Netwire.HB.1' is checked but not set. Checked in 2018282 and 0 other sigs
Nov 13 23:53:51   suricata: [100235] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'FB180732_3' is checked but not set. Checked in 2024698 and 0 other sigs
Nov 13 23:53:51   suricata: [100235] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'ETPRO.bayrob_packet' is checked but not set. Checked in 2819946 and 0 other sigs
Nov 13 23:53:51   suricata: [100235] <Warning> -- [ERRCODE: SC_WARN_FLOWBIT(306)] - flowbit 'et.BHEK.PDF' is checked but not set. Checked in 2017416 and 0 other sigs
Nov 13 23:53:28   suricata: [100235] <Warning> -- [ERRCODE: SC_WARN_DEFAULT_WILL_CHANGE(317)] - in 5.0 the default for decoder event stats will go from 'decoder.<proto>.<event>' to 'decoder.event.<proto>.<event>'. See ticket #2225. To suppress this message, set stats.decoder-events-prefix in the yaml.
Nov 13 23:53:28   suricata: [100267] <Notice> -- This is Suricata version 4.1.5 RELEASE
Title: Re: errcod sc_WARN FLOWBIT(306)
Post by: siga75 on November 16, 2019, 02:52:53 PM
nothing to be worried

https://suricata.readthedocs.io/en/latest/rules/flow-keywords.html