Warning

Clients with equipment having one of the serial numbers available on this link are affected by the update referenced in the table. Other serial numbers are not affected.

Warning

For performance reasons, it is strongly recommanded to directly install version 2.5.3.104 of GCap

4. Known problems

4.1. TCP transactions and extracted files

All versions of Suricata (4.X, 5.X, and 6.X) have a bug that erroneously reports that an extracted file of interest has not been extracted. The problem appears for TCP sessions running as follows:

• Initial handshake.

• PUSH of a file in its entirety without any ACK.

• ACK of all segments and closing the connection by RST.

This erroneous report disrupts the operation of the GCap which does not send the file to the GCenter.

A partial fix is present in versions greater than or equal to 2.5.3.104.

4.2. Resetting the GCap

The reset function is not reliable enough in GCap versions equal to or higher than 2.5.3.103, and has been disabled. Its operation will be reviewed and corrected in its entirety in version 2.5.3.105.

4.3. Erroneous status display of the monitoring interfaces

When the network card fails, the status of the affected interface displayed by the configuration utility may be incorrect.

4.4. Replay of PCAP files

The “replay pcap” function is not operational when multi-tenancy per interface is used.

4.5. Protection of the authentication mechanism (anti-bruteforce)

The authentication attempt counter is incremented whenever a login attempt is made, even if no password is entered by the user.