Project

General

Profile

Actions
Copy link

Feature #1767

open
MK OD

Support DTLS protocol

Feature #1767: Support DTLS protocol

Added by Mats Klepsland over 10 years ago. Updated 12 days ago.

Status:
Triaged
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:
Protocol

Description

Add support for DTLS (Datagram Transport Layer Security) protocol. It is based on TLS, so it should be possible to use the TLS decoder (with some modifications) to decode DTLS as well.

Files

Download all files
dtls-udp.pcap (2.73 KB) dtls-udp.pcap Stuart DC, 06/02/2026 06:08 PM
dtls2.pcap (21.6 KB) dtls2.pcap Stuart DC, 06/02/2026 06:08 PM

Related issues 1 (1 open — 0 closed)

Related to Suricata - Task #4151: Research: New protocol supportTriagedCommunity TicketActions

VJ Updated by Victor Julien over 10 years ago Actions
Copy link
 #1

  • Status changed from New to Assigned
  • Target version set to TBD

VJ Updated by Victor Julien almost 7 years ago Actions
Copy link
 #2

Rust pretty please!

KK Updated by Konstantin Klinger over 6 years ago Actions
Copy link
 #3

Is there any current update on this ticket? Would be great to have support, should be working with an adaption of the TLS parser.

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #4

  • Label Protocol added

VJ Updated by Victor Julien about 6 years ago Actions
Copy link
 #5

  • Status changed from Assigned to New
  • Assignee changed from Mats Klepsland to Community Ticket

PA Updated by Philippe Antoine almost 3 years ago Actions
Copy link
 #6

  • Related to Task #4151: Research: New protocol support added

SD Updated by Stuart DC 3 months ago Actions
Copy link Download all files
 #7

Interested to see DTLS supported and possibly using the same tls.* keywords.

Added some pcaps I created in a lab.

JI Updated by Jason Ish 3 months ago Actions
Copy link
 #8

  • Status changed from New to Triaged
  • Assignee changed from Community Ticket to OISF Dev

VJ Updated by Victor Julien 12 days ago Actions
Copy link
 #9

Stuart DC wrote in #note-7:

Interested to see DTLS supported and possibly using the same tls.* keywords.

Added some pcaps I created in a lab.

Would you also expect `alert tls ... tls.sni; content:"blah";` to work? Not just the keyword, but also the rule protocol specification? (`alert tls`). In http we have `alert http` (both 1 and 2) and `http1` and `http2`. Not sure how that should work here.

Actions
Copy link

Also available in: PDF Atom