(spp_ssh) Protocol mismatch
The rule is designed to trigger an alert when it detects a protocol mismatch in the SSH communication. This could occur if the SSH client and server attempt to communicate using different SSH protocol versions or incompatible encryption algorithms. Such protocol mismatches may result from misconfigurations, attempts to use non-standard SSH implementations, or potential man-in-the-middle attacks attempting to interfere with SSH communication.
(spp_sip) Maximum dialogs within a session reached
The rule is designed to trigger an alert when it detects a SIP event where the maximum number of allowed dialogs within a session is exceeded. In SIP, a dialog represents a peer-to-peer communication relationship between two user agents (e.g., phones, softphones, etc.). A session can include multiple dialogs for different communication exchanges.
(spp_sip) Empty request URI
The rule is designed to trigger an alert when it detects SIP events where the request URI (Uniform Resource Identifier) is empty. The request URI in a SIP message identifies the target of the SIP request, indicating the desired communication session. An empty request URI is abnormal and can indicate a potential security issue or malformed SIP message.
(http_inspect) WEBROOT DIRECTORY TRAVERSAL
The rule is designed to trigger an alert when it detects a potential webroot directory traversal attack in the HTTP request. Directory traversal (also known as path traversal) is a web application vulnerability where an attacker tries to access files or directories outside of the intended web application's root directory. This attack is possible when the web application does not properly validate and sanitize user input used to construct file paths.
(http_inspect) SERVER CONSECUTIVE SMALL CHUNK SIZES
The rule is designed to trigger an alert when it detects consecutive small chunk sizes in the HTTP server's response during a chunked transfer encoding scenario. In HTTP chunked transfer encoding, the server divides the response data into smaller chunks and sends them in succession, with each chunk's size specified before the chunk itself. Consecutive small chunk sizes in the server's response could indicate potential issues or anomalies in the HTTP communication. This behavior might be seen in malformed or manipulated HTTP traffic, which may require further investigation.