Project

General

Profile

Actions
Copy link

Feature #1872

open
PM AH

add --list-decoder-protos or similar

Feature #1872: add --list-decoder-protos or similar

Added by Peter Manev over 9 years ago. Updated almost 6 years ago.

Status:
Assigned
Priority:
Normal
Assignee:
Andreas Herz
Target version:
TBD
Effort:
Difficulty:
Label:

Description

It would be useful to have 

suricata --list-decoder-protos

or similar to list supported decoder protocols like we have : 

pevma@DONPEDRO:~$ sudo suricata --list-app-layer-protos
=========Supported App Layer Protocols=========
http
ftp
smtp
tls
ssh
imap
msn
smb
dcerpc
dns

Related issues 1 (0 open — 1 closed)

Related to Suricata - Feature #635: output: missing keywords in list-keywords outputClosedPhilippe AntoineActions

AH Updated by Andreas Herz over 9 years ago Actions
Copy link
 #1

  • Assignee set to OISF Dev
  • Target version set to TBD

AH Updated by Andreas Herz almost 7 years ago Actions
Copy link
 #2

  • Related to Feature #635: output: missing keywords in list-keywords output added

VJ Updated by Victor Julien almost 7 years ago Actions
Copy link
 #3

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Andreas Herz

AH Updated by Andreas Herz almost 7 years ago Actions
Copy link
 #4

While the app-layer-protocols are also keywords usable in rules not all decode protos are real keywords (vlan, pppoe f or example), so should we still print it the same way?

PM Updated by Peter Manev almost 7 years ago Actions
Copy link
 #5

Maybe have a message per field that is not a keyword? could be messy though.

VJ Updated by Victor Julien almost 7 years ago Actions
Copy link
 #6

I think these are different things. We have protocols that suri can decode and protocol names for in rules. I don't mind having 2 options to list each set.

AH Updated by Andreas Herz almost 7 years ago Actions
Copy link
 #7

Just to be sure, you would suggest to split those into two options like --list-decoder-protos and --list-decoder-protos-keywords (names still to be discussed)?

VJ Updated by Victor Julien over 6 years ago Actions
Copy link
 #8

Yeah. I would think --list-decoder-protos and --list-rule-protos

PM Updated by Peter Manev over 6 years ago Actions
Copy link
 #9

I like that approach.

AH Updated by Andreas Herz over 6 years ago Actions
Copy link
 #10

I can implement that but --list-decoder-protos would still have all and --list-rule-protos would be a subset excluding those which aren't keywords. But while playing around with #635 I would either add those of the --list-rule-protos to the --list-keywords list (to match idea 1) or as a section (to match idea 2).

VJ Updated by Victor Julien almost 6 years ago Actions
Copy link
 #11

I'm confused with what you're asking/saying, but I think its best to start with an implementation and then we can discuss the result/output. It's not a big project so it won't be a waste of time if things need to change.

Actions
Copy link

Also available in: PDF Atom