new SIP preproc on snort v2.9.1 never firing?

[rmkml <rmkml () yahoo fr>]

Hi,
Im continue testing last snort v2.9.1, but new SIP preproc never firing.
Anyone have alert with SIP preproc ? (GID 140)

Im tested with default snort.conf:
  ...
  PortVar 'SIP_PORTS' defined :  [ 5060:5061 5600 ]
  ...
  Loading dynamic preprocessor library 
dynamic-preprocessors/build/usr/local/lib/snort_dynamicpreprocessor//libsf_sip_preproc.so... done
  ...
  SIP config:
   Max number of sessions: 10000 (Default)
   Status: ENABLED
   Ignore media channel: DISABLED
   Max URI length: 512
   Max Call ID length: 80
   Max Request name length: 20 (Default)
   Max From length: 256 (Default)
   Max To length: 256 (Default)
   Max Via length: 1024 (Default)
   Max Contact length: 512
   Max Content length: 1024 (Default)
   Ports:
         5060    5061    5600
   Methods:
    invite cancel ack bye register options refer subscribe update join info message notify benotify do qauth sprack 
publish service unsubscribe prack
...
   o"  )~   Version 2.9.1 IPv6 GRE (Build 71)
...
            Preprocessor Object: SF_SIP (IPV6)  Version 1.1  <Build 1>
...

Im reduced sip length but sip preproc never firing again.

Im read doc/README.sip and of course enabled udp on stream5 (default snort.conf).
Tested with nessus,nmap,many scanner, replay traffic, sipp...
Regards
Rmkml

http://twitter.com/rmkml

------------------------------------------------------------------------------
Malware Security Report: Protecting Your Business, Customers, and the 
Bottom Line. Protect your business and customers by understanding the 
threat from malware and how it can impact your online business. 
http://www.accelacomm.com/jaw/sfnl/114/51427462/
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
http://www.snort.org


Please visit http://blog.snort.org for the latest news about Snort!