Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Flow bytes pkts syntax/v7 #12206

Closed
wants to merge 3 commits into from
+345 −194
Closed

Flow bytes pkts syntax/v7 #12206

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
eac315f
flow/pkts: make syntax cleaner and compact
inashivb Nov 29, 2024
f1e76fc
doc: update syntax for flow.pkts & flow.bytes
inashivb Oct 8, 2024
5320e79
flow/pkts: allow matching on either direction
inashivb Aug 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 28 additions & 57 deletions doc/userguide/rules/flow-keywords.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -318,90 +318,61 @@ Signature example::

In this example, we combine `flow.age` and `flowbits` to get an alert on the first packet after the flow's age is older than one hour.

flow.pkts_toclient
------------------
flow.pkts
---------

Flow number of packets to client (integer)
Flow number of packets (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.pkts_toclient uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
flow.pkts uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>` and supports
following directions:

Syntax::

flow.pkts_toclient: [op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::

flow.pkts_toclient:3 # exactly 3
flow.pkts_toclient:<3 # smaller than 3
flow.pkts_toclient:>=2 # greater than or equal to 2
* toclient

Signature example::
* toserver

alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toclient:20; sid:1;)

flow.pkts_toserver
------------------

Flow number of packets to server (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.pkts_toserver uses an :ref:`unsigned 32-bit integer <rules-integer-keywords>`.
* either

Syntax::

flow.pkts_toserver: [op]<number>
flow.pkts:<direction>,[op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::

flow.pkts_toserver:3 # exactly 3
flow.pkts_toserver:<3 # smaller than 3
flow.pkts_toserver:>=2 # greater than or equal to 2
flow.pkts:toclient,3 # exactly 3
flow.pkts:toserver,<3 # smaller than 3
flow.pkts:either,>=2 # greater than or equal to 2

Signature example::

alert ip any any -> any any (msg:"Flow has 20 packets"; flow.pkts_toserver:20; sid:1;)

flow.bytes_toclient
inashivb marked this conversation as resolved.
Show resolved Hide resolved
-------------------
alert ip any any -> any any (msg:"Flow has 20 packets in toclient dir"; flow.pkts:toclient,20; sid:1;)

Flow number of bytes to client (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.bytes_toclient uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>`.

Syntax::

flow.bytes_toclient: [op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::
flow.bytes
----------

flow.bytes_toclient:3 # exactly 3
flow.bytes_toclient:<3 # smaller than 3
flow.bytes_toclient:>=2 # greater than or equal to 2
Flow number of bytes (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

Signature example::
flow.bytes uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>` and supports
following directions:

alert ip any any -> any any (msg:"Flow has less than 2000 bytes"; flow.bytes_toclient:<2000; sid:1;)
* toclient

flow.bytes_toserver
-------------------
* toserver

Flow number of bytes to server (integer)
This keyword does not wait for the end of the flow, but will be checked at each packet.

flow.bytes_toserver uses an :ref:`unsigned 64-bit integer <rules-integer-keywords>`.
* either

Syntax::

flow.bytes_toserver: [op]<number>
flow.bytes:<direction>,[op]<number>

The number of packets can be matched exactly, or compared using the _op_ setting::
The number of bytes can be matched exactly, or compared using the _op_ setting::

flow.bytes_toserver:3 # exactly 3
flow.bytes_toserver:<3 # smaller than 3
flow.bytes_toserver:>=2 # greater than or equal to 2
flow.bytes:toclient,3 # exactly 3
flow.bytes:toserver,<3 # smaller than 3
flow.bytes:either,>=2 # greater than or equal to 2

Signature example::

alert ip any any -> any any (msg:"Flow has less than 2000 bytes"; flow.bytes_toserver:<2000; sid:1;)
alert ip any any -> any any (msg:"Flow has less than 2000 bytes in toserver dir"; flow.bytes:toserver,<2000; sid:1;)
6 changes: 4 additions & 2 deletions src/detect-engine-register.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -581,10 +581,12 @@ void SigTableSetup(void)
DetectReplaceRegister();
DetectFlowRegister();
DetectFlowAgeRegister();
DetectFlowPktsToClientRegister();
DetectFlowPktsRegister();
DetectFlowPktsToServerRegister();
DetectFlowBytesToClientRegister();
DetectFlowPktsToClientRegister();
DetectFlowBytesRegister();
DetectFlowBytesToServerRegister();
DetectFlowBytesToClientRegister();
DetectRequiresRegister();
DetectWindowRegister();
DetectRpcRegister();
Expand Down
6 changes: 4 additions & 2 deletions src/detect-engine-register.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,10 +127,12 @@ enum DetectKeywordId {
DETECT_FRAME,

DETECT_FLOW_AGE,
DETECT_FLOW_PKTS_TO_CLIENT,
DETECT_FLOW_PKTS,
DETECT_FLOW_PKTS_TO_SERVER,
DETECT_FLOW_BYTES_TO_CLIENT,
DETECT_FLOW_PKTS_TO_CLIENT,
DETECT_FLOW_BYTES,
DETECT_FLOW_BYTES_TO_SERVER,
DETECT_FLOW_BYTES_TO_CLIENT,

DETECT_REQUIRES,

Expand Down
Loading
Loading