Support #3466: [ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - signature at /etc/suricata/rules/emerging-dns.rules:113 uses unknown classtype: "command-and-control", using default priority 3. - Suricata - Open Information Security Foundation

Actions

Copy link

Support #3466

closed

[ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - signature at /etc/suricata/rules/emerging-dns.rules:113 uses unknown classtype: "command-and-control", using default priority 3.

Added by leonardo kasper about 5 years ago. Updated about 5 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Affected Versions:

5.0.1

Label:

Description

i am executing this command

suricata -T /etc/suricata/suricata.yaml

and this error is showing

[ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - signature at /etc/suricata/rules/emerging-dns.rules:113 uses unknown classtype: "command-and-control", using default priority 3. This message won't be shown again for this classtype

I already added the emerging-dns.rules rule in the rules directory

my yaml configuration file is this

%YAML 1.1
---
Suricata configuration file. In addition to the comments describing all
options in this file, full documentation can be found at:
https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml ##
Step 1: inform Suricata about your network ##
vars: # more specifc is better for alert accuracy and performance
address-groups:
#HOME_NET: "[10.242.4.3,10.242.4.4]" 
HOME_NET: "[192.168.1.0/24]" 
#HOME_NET: "[10.0.0.0/8]" 
#HOME_NET: "[172.16.0.0/12]" 
#HOME_NET: "any" 
EXTERNAL_NET: "!$HOME_NET" 
    #EXTERNAL_NET: "any" 
HTTP_SERVERS: "$HOME_NET" 
    SMTP_SERVERS: "$HOME_NET" 
    SQL_SERVERS: "$HOME_NET" 
    DNS_SERVERS: "$HOME_NET" 
    TELNET_SERVERS: "$HOME_NET" 
    AIM_SERVERS: "$EXTERNAL_NET" 
    DNP3_SERVER: "$HOME_NET" 
    DNP3_CLIENT: "$HOME_NET" 
    MODBUS_CLIENT: "$HOME_NET" 
    MODBUS_SERVER: "$HOME_NET" 
    ENIP_CLIENT: "$HOME_NET" 
    ENIP_SERVER: "$HOME_NET" 
port-groups:
    HTTP_PORTS: "80" 
    SHELLCODE_PORTS: "!80" 
    ORACLE_PORTS: 1521
    SSH_PORTS: 22
    DNP3_PORTS: 20000
    MODBUS_PORTS: 502
    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]" 
    FTP_PORTS: 21
##
Step 2: select the rules to enable or disable ##
default-rule-path: /etc/suricata/rules
rule-files:
- botcc.rules # - botcc.portgrouped.rules
#- ciarmy.rules
#- compromised.rules
#- drop.rules
#- dshield.rules
#- emerging-activex.rules
#- emerging-attack_response.rules
#- emerging-chat.rules
#- emerging-current_events.rules
- emerging-dns.rules
#- emerging-dos.rules
#- emerging-exploit.rules
#- emerging-ftp.rules
#- emerging-games.rules
#- emerging-icmp_info.rules
#- emerging-icmp.rules
#- emerging-imap.rules
#- emerging-inappropriate.rules
#- emerging-info.rules
#- emerging-malware.rules
#- emerging-misc.rules
#- emerging-mobile_malware.rules
#- emerging-netbios.rules
#- emerging-p2p.rules
#- emerging-policy.rules
#- emerging-pop3.rules
#- emerging-rpc.rules
#- emerging-scada.rules
##- emerging-scada_special.rules
#- emerging-scan.rules
#- emerging-shellcode.rules
#- emerging-smtp.rules
#- emerging-snmp.rules
#- emerging-sql.rules
#- emerging-telnet.rules
#- emerging-tftp.rules
#- emerging-trojan.rules
#- emerging-user_agents.rules
#- emerging-voip.rules
#- emerging-web_client.rules
#- emerging-web_server.rules
#- emerging-web_specific_apps.rules
#- emerging-worm.rules
#- tor.rules
- decoder-events.rules # available in suricata sources under rules dir
- stream-events.rules # available in suricata sources under rules dir
#- http-events.rules # available in suricata sources under rules dir
#- smtp-events.rules # available in suricata sources under rules dir
- dns-events.rules # available in suricata sources under rules dir
- tls-events.rules # available in suricata sources under rules dir
- modbus-events.rules # available in suricata sources under rules dir
- app-layer-events.rules # available in suricata sources under rules dir
- dnp3-events.rules # available in suricata sources under rules dir
- ntp-events.rules # available in suricata sources under rules dir
- snwaf.rules
classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config
threshold-file: /etc/suricata/threshold.config
##
Step 3: select outputs to enable ##
The default logging directory. Any log or output file will be
placed here if its not specified with a full path name. This can be
overridden with the -l command line parameter.
default-log-dir: /var/log/suricata/
global stats configuration
stats:
enabled: yes # The interval field (in seconds) controls at what interval # the loggers are invoked.
interval: 8
Configure the type of alert (and other) logging you would like.
outputs: # a line based alerts log similar to Snort's fast.log
- fast:
enabled: yes
filename: fast.log
append: yes
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
Extensible Event Format (nicknamed EVE) event log in JSON format
- eve-log:
enabled: yes
filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
filename: eve.json
#prefix: "@cee: " # prefix to prepend to each log entry # the following are valid when type: syslog above
#identity: "suricata" 
#facility: local5
#level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug
#redis: # server: 127.0.0.1 # port: 6379 # async: true ## if redis replies are read asynchronously # mode: list ## possible values: list|lpush (default), rpush, channel|publish # ## lpush and rpush are using a Redis list. "list" is an alias for lpush # ## publish is using a Redis channel. "channel" is an alias for publish # key: suricata ## key or channel to use (default to suricata) # Redis pipelining set up. This will enable to only do a query every # 'batch-size' events. This should lower the latency induced by network # connection at the cost of some memory. There is no flushing implemented # so this setting as to be reserved to high traffic suricata. # pipelining: # enabled: yes ## set enable to yes to enable query pipelining # batch-size: 10 ## number of entry to keep in buffer
types:
- alert: # payload: yes # enable dumping payload in Base64 # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) # http-body: yes # enable dumping of http body in Base64 # http-body-printable: yes # enable dumping of http body in printable format
metadata: yes # add L7/applayer fields, flowbit and other vars to the alert # Enable the logging of tagged packets for rules using the # "tag" keyword.
tagged-packets: yes # HTTP X-Forwarded-For support by adding an extra field or overwriting # the source or destination IP address (depending on flow direction) # with the one reported in the X-Forwarded-For HTTP header. This is # helpful when reviewing alerts for traffic that is being reverse # or forward proxied.
xff:
enabled: no # Two operation modes are available, "extra-data" and "overwrite".
mode: extra-data # Two proxy deployments are supported, "reverse" and "forward". In # a "reverse" deployment the IP address used is the last one, in a # "forward" deployment the first IP address is used.
deployment: reverse # Header name where the actual IP address will be reported, if more # than one IP address is present, the last IP address will be the # one taken into consideration.
header: X-Forwarded-For
- http:
extended: yes # enable this for extended logging information # custom allows additional http fields to be included in eve-log # the example below adds three additional fields when uncommented
#custom: [Accept-Encoding, Accept-Language, Authorization]
- dns: # control logging of queries and answers # default yes, no to disable
query: yes # enable logging of DNS queries
answer: yes # enable logging of DNS answers # control which RR types are logged # all enabled if custom not specified
#custom: [a, aaaa, cname, mx, ns, ptr, txt]
- tls:
extended: yes # enable this for extended logging information # output TLS transaction where the session is resumed using a # session id
#session-resumption: no # custom allows to control which tls fields that are included # in eve-log
#custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain]
- files:
force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, # sha1 and sha256
#force-hash: [md5]
#- drop: # alerts: yes # log alerts that caused drops # flows: all # start or all: 'start' logs only a single drop # # per flow direction. All logs each dropped pkt.
- smtp:
#extended: yes # enable this for extended logging information # this includes: bcc, message-id, subject, x_mailer, user-agent # custom fields logging from the list: # reply-to, bcc, message-id, subject, x-mailer, user-agent, received, # x-originating-ip, in-reply-to, references, importance, priority, # sensitivity, organization, content-md5, date
#custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc] # output md5 of fields: body, subject # for the body you need to set app-layer.protocols.smtp.mime.body-md5 # to yes
#md5: [body, subject]
#- dnp3
#- nfs
- ssh
#- stats:
#totals: yes # stats for all threads merged together
#threads: no # per thread stats
#deltas: no # include delta values # bi-directional flows
#- flow # uni-directional flows
#- netflow # Vars log flowbits and other packet and flow vars
#- vars # alert output for use with Barnyard2
- unified2-alert:
enabled: no
filename: unified2.alert # File size limit. Can be specified in kb, mb, gb. Just a number # is parsed as bytes.
#limit: 32mb # By default unified2 log files have the file creation time (in # unix epoch format) appended to the filename. Set this to yes to # disable this behaviour.
#nostamp: no # Sensor ID field of unified2 alerts.
#sensor-id: 0 # Include payload of packets related to alerts. Defaults to true, set to # false if payload is not required.
#payload: yes # HTTP X-Forwarded-For support by adding the unified2 extra header or # overwriting the source or destination IP address (depending on flow # direction) with the one reported in the X-Forwarded-For HTTP header. # This is helpful when reviewing alerts for traffic that is being reverse # or forward proxied.
xff:
enabled: no # Two operation modes are available, "extra-data" and "overwrite". Note # that in the "overwrite" mode, if the reported IP address in the HTTP # X-Forwarded-For header is of a different version of the packet # received, it will fall-back to "extra-data" mode.
mode: extra-data # Two proxy deployments are supported, "reverse" and "forward". In # a "reverse" deployment the IP address used is the last one, in a # "forward" deployment the first IP address is used.
deployment: reverse # Header name where the actual IP address will be reported, if more # than one IP address is present, the last IP address will be the # one taken into consideration.
header: X-Forwarded-For # a line based log of HTTP requests (no alerts)
- http-log:
enabled: yes
filename: http.log
append: yes
#extended: yes # enable this for extended logging information
#custom: yes # enabled the custom logging format (defined by customformat)
#customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P" 
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # a line based log of TLS handshake parameters (no alerts)
- tls-log:
enabled: yes # Log TLS connections.
filename: tls.log # File to store TLS logs.
append: yes
#extended: yes # Log extended information like fingerprint
#custom: yes # enabled the custom logging format (defined by customformat)
#customformat: "%{%D-%H:%M:%S}t.%z %a:%p -> %A:%P %v %n %d %D" 
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # output TLS transaction where the session is resumed using a # session id
#session-resumption: no # output module to store certificates chain to disk
- tls-store:
enabled: no
#certs-log-dir: certs # directory to store the certificates files # a line based log of DNS requests and/or replies (no alerts)
- dns-log:
enabled: yes
filename: dns.log
append: yes
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # Packet log... log packets in pcap format. 3 modes of operation: "normal" # "multi" and "sguil". # # In normal mode a pcap file "filename" is created in the default-log-dir, # or are as specified by "dir". # In multi mode, a file is created per thread. This will perform much # better, but will create multiple files where 'normal' would create one. # In multi mode the filename takes a few special variables: # - %n -- thread number # - %i -- thread id # - %t -- timestamp (secs or secs.usecs based on 'ts-format' # E.g. filename: pcap.%n.%t # # Note that it's possible to use directories, but the directories are not # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the # per thread directory. # # Also note that the limit and max-files settings are enforced per thread. # So the size limit when using 8 threads with 1000mb files and 2000 files # is: 8*1000*2000 ~ 16TiB. # # In Sguil mode "dir" indicates the base directory. In this base dir the # pcaps are created in th directory structure Sguil expects: # # $sguil-base-dir/YYYY-MM-DD/$filename.<timestamp> # # By default all packets are logged except: # - TCP streams beyond stream.reassembly.depth # - encrypted streams after the key exchange #
- pcap-log:
enabled: no
filename: log.pcap # File size limit. Can be specified in kb, mb, gb. Just a number # is parsed as bytes.
limit: 1000mb # If set to a value will enable ring buffer mode. Will keep Maximum of "max-files" of size "limit" 
max-files: 2000
mode: normal # normal, multi or sguil. # Directory to place pcap files. If not provided the default log # directory will be used. Required for "sguil" mode.
#dir: /nsm_data/
#ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stopped being logged. # a full alerts log containing much information for signature writers # or for investigating suspected false positives.
- alert-debug:
enabled: no
filename: alert-debug.log
append: yes
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # alert output to prelude (http://www.prelude-technologies.com/) only # available if Suricata has been compiled with --enable-prelude
- alert-prelude:
enabled: no
profile: suricata
log-packet-content: no
log-packet-header: yes # Stats.log contains data from various counters of the suricata engine.
- stats:
enabled: yes
filename: stats.log
append: yes # append to file (yes) or overwrite it (no)
totals: yes # stats for all threads merged together
threads: no # per thread stats
#null-values: yes # print counters that have value 0 # a line based alerts log similar to fast.log into syslog
- syslog:
enabled: no # reported identity to syslog. If ommited the program name (usually # suricata) will be used.
#identity: "suricata" 
facility: local5
#level: Info ## possible levels: Emergency, Alert, Critical, ## Error, Warning, Notice, Info, Debug # a line based information for dropped packets in IPS mode
- drop:
enabled: yes
filename: drop.log
append: yes
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram' # output module to store extracted files to disk # # The files are stored to the log-dir in a format "file.<id>" where <id> is # an incrementing number starting at 1. For each file "file.<id>" a meta # file "file.<id>.meta" is created. # # File extraction depends on a lot of things to be fully done: # - file-store stream-depth. For optimal results, set this to 0 (unlimited) # - http request / response body sizes. Again set to 0 for optimal results. # - rules that contain the "filestore" keyword.
- file-store:
enabled: no # set to yes to enable
log-dir: files # directory to store the files
force-magic: no # force logging magic on all stored files # force logging of checksums, available hash functions are md5, # sha1 and sha256
#force-hash: [md5]
force-filestore: no # force storing of all files # override global stream-depth for sessions in which we want to # perform file extraction. Set to 0 for unlimited.
#stream-depth: 0
#waldo: file.waldo # waldo file to store the file_id across runs # uncomment to disable meta file writing
#write-meta: no # uncomment the following variable to define how many files can # remain open for filestore by Suricata. Default value is 0 which # means files get closed after each write
#max-open-files: 1000 # output module to log files tracked in a easily parsable json format
- file-log:
enabled: no
filename: files-json.log
append: yes
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
force-magic: no # force logging magic on all logged files # force logging of checksums, available hash functions are md5, # sha1 and sha256
#force-hash: [md5] # Log TCP data after stream normalization # 2 types: file or dir. File logs into a single logfile. Dir creates # 2 files per TCP session and stores the raw TCP data into them. # Using 'both' will enable both file and dir modes. # # Note: limited by stream.depth
- tcp-data:
enabled: no
type: file
filename: tcp-data.log # Log HTTP body data after normalization, dechunking and unzipping. # 2 types: file or dir. File logs into a single logfile. Dir creates # 2 files per HTTP session and stores the normalized data into them. # Using 'both' will enable both file and dir modes. # # Note: limited by the body limit settings
- http-body-data:
enabled: yes
type: file
filename: http-data.log # Lua Output Support - execute lua script to generate alert and event # output. # Documented at: # https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Lua_Output
- lua:
enabled: no
#scripts-dir: /etc/suricata/lua-output/
scripts: # - script1.lua
Logging configuration. This is not about logging IDS alerts/events, but
output about what Suricata is doing, like startup messages, errors, etc.
logging: # The default log level, can be overridden in an output section. # Note that debug level logging will only be emitted if Suricata was # compiled with the --enable-debug configure option. # # This value is overriden by the SC_LOG_LEVEL env var.
default-log-level: notice # The default output format. Optional parameter, should default to # something reasonable if not provided. Can be overriden in an # output section. You can leave this out to get the default. # # This value is overriden by the SC_LOG_FORMAT env var.
#default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- " # A regex to filter output. Can be overridden in an output section. # Defaults to empty (no filter). # # This value is overriden by the SC_LOG_OP_FILTER env var.
default-output-filter: # Define your logging outputs. If none are defined, or they are all # disabled you will get the default - console output.
outputs:
- console:
enabled: yes # type: json
- file:
enabled: yes
level: info
filename: /var/log/suricata/suricata.log # type: json
- syslog:
enabled: no
facility: local5
format: "[%i] <%d> -- " # type: json ##
Step 4: configure common capture settings ##
See "Advanced Capture Options" below for more options, including NETMAP
and PF_RING. ##
Linux high speed capture support
af-packet:
- interface: enp0s3 # Number of receive threads. "auto" uses the number of cores
#threads: auto # Default clusterid. AF_PACKET will load balance packets based on flow.
cluster-id: 99 # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash. # This is only supported for Linux kernel > 3.1 # possible value are: # * cluster_round_robin: round robin load balancing # * cluster_flow: all packets of a given flow are send to the same socket # * cluster_cpu: all packets treated in kernel by a CPU are send to the same socket # * cluster_qm: all packets linked by network card to a RSS queue are sent to the same # socket. Requires at least Linux 3.14. # * cluster_random: packets are sent randomly to sockets but with an equipartition. # Requires at least Linux 3.14. # * cluster_rollover: kernel rotates between sockets filling each socket before moving # to the next. Requires at least Linux 3.10. # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system # with capture card using RSS (require cpu affinity tuning and system irq tuning)
cluster-type: cluster_flow # In some fragmentation case, the hash can not be computed. If "defrag" is set # to yes, the kernel will do the needed defragmentation before sending the packets.
defrag: yes # After Linux kernel 3.10 it is possible to activate the rollover option: if a socket is # full then kernel will send the packet on the next socket with room available. This option # can minimize packet drop and increase the treated bandwidth on single intensive flow.
#rollover: yes # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
#use-mmap: yes # Lock memory map to avoid it goes to swap. Be careful that over suscribing could lock # your system
#mmap-locked: yes # Use tpacket_v3 capture mode, only active if use-mmap is true # Don't use it in IPS or TAP mode as it causes severe latency
#tpacket-v3: yes # Ring size will be computed with respect to max_pending_packets and number # of threads. You can set manually the ring size in number of packets by setting # the following value. If you are using flow cluster-type and have really network # intensive single-flow you could want to set the ring-size independently of the number # of threads:
#ring-size: 2048 # Block size is used by tpacket_v3 only. It should set to a value high enough to contain # a decent number of packets. Size is in bytes so please consider your MTU. It should be # a power of 2 and it must be multiple of page size (usually 4096).
#block-size: 32768 # tpacket_v3 block timeout: an open block is passed to userspace if it is not # filled after block-timeout milliseconds.
#block-timeout: 10 # On busy system, this could help to set it to yes to recover from a packet drop # phase. This will result in some packets (at max a ring flush) being non treated.
#use-emergency-flush: yes # recv buffer size, increase value could improve performance # buffer-size: 32768 # Set to yes to disable promiscuous mode # disable-promisc: no # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - kernel: use indication sent by kernel for each packet (default) # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. # Warning: 'checksum-validation' must be set to yes to have any validation
#checksum-checks: kernel # BPF filter to apply to this interface. The pcap filter syntax apply here.
#bpf-filter: port 80 or udp # You can use the following variables to activate AF_PACKET tap or IPS mode. # If copy-mode is set to ips or tap, the traffic coming to the current # interface will be copied to the copy-iface interface. If 'tap' is set, the # copy is complete. If 'ips' is set, the packet matching a 'drop' action # will not be copied.
#copy-mode: ips
#copy-iface: eth1 # Put default values here. These will be used for an interface that is not # in the list above.
- interface: default
#threads: auto
#use-mmap: no
#rollover: yes
#tpacket-v3: yes
Cross platform libpcap capture support
pcap:
- interface: enp0s3 # On Linux, pcap will try to use mmaped capture and will use buffer-size # as total of memory used by the ring. So set this to something bigger # than 1% of your bandwidth.
#buffer-size: 16777216
#bpf-filter: "tcp and port 25" # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. (default) # Warning: 'checksum-validation' must be set to yes to have any validation
#checksum-checks: auto # With some accelerator cards using a modified libpcap (like myricom), you # may want to have the same number of capture threads as the number of capture # rings. In this case, set up the threads variable to N to start N threads # listening on the same interface.
#threads: 16 # set to no to disable promiscuous mode:
#promisc: no # set snaplen, if not set it defaults to MTU if MTU can be known # via ioctl call and to full capture if not.
#snaplen: 1518 # Put default values here
- interface: default
#checksum-checks: auto
Settings for reading pcap files
pcap-file: # Possible values are: # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. (default) # Warning: 'checksum-validation' must be set to yes to have checksum tested
checksum-checks: auto
See "Advanced Capture Options" below for more options, including NETMAP
and PF_RING. ##
Step 5: App Layer Protocol Configuration ##
Configure the app-layer parsers. The protocols section details each
protocol. #
The option "enabled" takes 3 values - "yes", "no", "detection-only".
"yes" enables both detection and the parser, "no" disables both, and
"detection-only" enables protocol detection only (parser disabled).
app-layer:
protocols:
tls:
enabled: yes
detection-ports:
dp: 443 # Completely stop processing TLS/SSL session after the handshake # completed. If bypass is enabled this will also trigger flow # bypass. If disabled (the default), TLS/SSL session is still # tracked for Heartbleed and other anomalies.
#no-reassemble: yes
dcerpc:
enabled: yes
ftp:
enabled: yes
ssh:
enabled: yes
smtp:
enabled: yes # Configure SMTP-MIME Decoder
mime: # Decode MIME messages from SMTP transactions # (may be resource intensive) # This field supercedes all others because it turns the entire # process on or off
decode-mime: yes # Decode MIME entity bodies (ie. base64, quoted-printable, etc.)
decode-base64: yes
decode-quoted-printable: yes # Maximum bytes per header data value stored in the data structure # (default is 2000)
header-value-depth: 2000 # Extract URLs and save in state data structure
extract-urls: yes # Set to yes to compute the md5 of the mail body. You will then # be able to journalize it.
body-md5: no # Configure inspected-tracker for file_data keyword
inspected-tracker:
content-limit: 100000
content-inspect-min-size: 32768
content-inspect-window: 4096
imap:
enabled: detection-only
msn:
enabled: detection-only
smb:
enabled: yes
detection-ports:
dp: 139, 445 # smb2 detection is disabled internally inside the engine.
#smb2: # enabled: yes # Note: NFS parser depends on Rust support: pass --enable-rust # to configure.
nfs:
enabled: no
dns: # memcaps. Globally and per flow/state.
#global-memcap: 16mb
#state-memcap: 512kb # How many unreplied DNS requests are considered a flood. # If the limit is reached, app-layer-event:dns.flooded; will match.
#request-flood: 500
tcp:
enabled: yes
detection-ports:
dp: 53
udp:
enabled: yes
detection-ports:
dp: 53
http:
enabled: yes # memcap: 64mb # default-config: Used when no server-config matches # personality: List of personalities used by default # request-body-limit: Limit reassembly of request body for inspection # by http_client_body & pcre /P option. # response-body-limit: Limit reassembly of response body for inspection # by file_data, http_server_body & pcre /Q option. # double-decode-path: Double decode path section of the URI # double-decode-query: Double decode query section of the URI # response-body-decompress-layer-limit: # Limit to how many layers of compression will be # decompressed. Defaults to 2. # # server-config: List of server configurations to use if address matches # address: List of ip addresses or networks for this block # personalitiy: List of personalities used by this block # request-body-limit: Limit reassembly of request body for inspection # by http_client_body & pcre /P option. # response-body-limit: Limit reassembly of response body for inspection # by file_data, http_server_body & pcre /Q option. # double-decode-path: Double decode path section of the URI # double-decode-query: Double decode query section of the URI # # uri-include-all: Include all parts of the URI. By default the # 'scheme', username/password, hostname and port # are excluded. Setting this option to true adds # all of them to the normalized uri as inspected # by http_uri, urilen, pcre with /U and the other # keywords that inspect the normalized uri. # Note that this does not affect http_raw_uri. # Also, note that including all was the default in # 1.4 and 2.0beta1. # # meta-field-limit: Hard size limit for request and response size # limits. Applies to request line and headers, # response line and headers. Does not apply to # request or response bodies. Default is 18k. # If this limit is reached an event is raised. # # Currently Available Personalities: # Minimal, Generic, IDS (default), IIS_4_0, IIS_5_0, IIS_5_1, IIS_6_0, # IIS_7_0, IIS_7_5, Apache_2
libhtp:
default-config:
personality: IDS # Can be specified in kb, mb, gb. Just a number indicates # it's in bytes.
request-body-limit: 100kb
response-body-limit: 100kb # inspection limits
request-body-minimal-inspect-size: 32kb
request-body-inspect-window: 4kb
response-body-minimal-inspect-size: 40kb
response-body-inspect-window: 16kb # response body decompression (0 disables)
response-body-decompress-layer-limit: 2 # auto will use http-body-inline mode in IPS mode, yes or no set it statically
http-body-inline: auto # Take a random value for inspection sizes around the specified value. # This lower the risk of some evasion technics but could lead # detection change between runs. It is set to 'yes' by default.
#randomize-inspection-sizes: yes # If randomize-inspection-sizes is active, the value of various # inspection size will be choosen in the [1 - range%, 1 + range%] # range # Default value of randomize-inspection-range is 10.
#randomize-inspection-range: 10 # decoding
double-decode-path: no
double-decode-query: no
server-config:
#- apache: # address: [192.168.1.0/24, 127.0.0.0/8, "::1"] # personality: Apache_2 # # Can be specified in kb, mb, gb. Just a number indicates # # it's in bytes. # request-body-limit: 4096 # response-body-limit: 4096 # double-decode-path: no # double-decode-query: no
#- iis7: # address: # - 192.168.0.0/24 # - 192.168.10.0/24 # personality: IIS_7_0 # # Can be specified in kb, mb, gb. Just a number indicates # # it's in bytes. # request-body-limit: 4096 # response-body-limit: 4096 # double-decode-path: no # double-decode-query: no # Note: Modbus probe parser is minimalist due to the poor significant field # Only Modbus message length (greater than Modbus header length) # And Protocol ID (equal to 0) are checked in probing parser # It is important to enable detection port and define Modbus port # to avoid false positive
modbus: # How many unreplied Modbus requests are considered a flood. # If the limit is reached, app-layer-event:modbus.flooded; will match.
#request-flood: 500
enabled: no
detection-ports:
dp: 502 # According to MODBUS Messaging on TCP/IP Implementation Guide V1.0b, it # is recommended to keep the TCP connection opened with a remote device # and not to open and close it for each MODBUS/TCP transaction. In that # case, it is important to set the depth of the stream reassembling as # unlimited (stream.reassembly.depth: 0) # Stream reassembly size for modbus. By default track it completely.
stream-depth: 0 # DNP3
dnp3:
enabled: no
detection-ports:
dp: 20000 # SCADA EtherNet/IP and CIP protocol support
enip:
enabled: no
detection-ports:
dp: 44818
sp: 44818 # Note: parser depends on experimental Rust support # with --enable-rust-experimental passed to configure
ntp:
enabled: no
Limit for the maximum number of asn1 frames to decode (default 256)
asn1-max-frames: 256 ############################################################################## ##
Advanced settings below ## ############################################################################## ##
Run Options ##
Run suricata as user and group.
#run-as:
user: suri
group: suri
Some logging module will use that name in event as identifier. The default
value is the hostname
#sensor-name: suricata
Default location of the pid file. The pid file is only used in
daemon mode (start Suricata with -D). If not running in daemon mode
the --pidfile command line option must be used to create a pid file.
#pid-file: /usr/local/var/run/suricata.pid
Daemon working directory
Suricata will change directory to this one if provided
Default: "/" 
#daemon-directory: "/" 
Suricata core dump configuration. Limits the size of the core dump file to
approximately max-dump. The actual core dump size will be a multiple of the
page size. Core dumps that would be larger than max-dump are truncated. On
Linux, the actual core dump size may be a few pages larger than max-dump.
Setting max-dump to 0 disables core dumping.
Setting max-dump to 'unlimited' will give the full core dump file.
On 32-bit Linux, a max-dump value >= ULONG_MAX may cause the core dump size
to be 'unlimited'.
coredump:
max-dump: unlimited
If suricata box is a router for the sniffed networks, set it to 'router'. If
it is a pure sniffing setup, set it to 'sniffer-only'.
If set to auto, the variable is internally switch to 'router' in IPS mode
and 'sniffer-only' in IDS mode.
This feature is currently only used by the reject* keywords.
host-mode: auto
Number of packets preallocated per thread. The default is 1024. A higher number
will make sure each CPU will be more easily kept busy, but may negatively
impact caching. #
If you are using the CUDA pattern matcher (mpm-algo: ac-cuda), different rules
apply. In that case try something like 60000 or more. This is because the CUDA
pattern matcher buffers and scans as many packets as possible in parallel.
#max-pending-packets: 1024
Runmode the engine should use. Please check --list-runmodes to get the available
runmodes for each packet acquisition method. Defaults to "autofp" (auto flow pinned
load balancing).
#runmode: autofp
Specifies the kind of flow load balancer used by the flow pinned autofp mode. #
Supported schedulers are: #
round-robin - Flows assigned to threads in a round robin fashion.
active-packets - Flows assigned to threads that have the lowest number of
unprocessed packets (default).
hash - Flow alloted usihng the address hash. More of a random
technique. Was the default in Suricata 1.2.1 and older. #
#autofp-scheduler: active-packets
Preallocated size for packet. Default is 1514 which is the classical
size for pcap on ethernet. You should adjust this value to the highest
packet size (MTU + hardware header) on your system.
#default-packet-size: 1514
Unix command socket can be used to pass commands to suricata.
An external tool can then connect to get information from suricata
or trigger some modifications of the engine. Set enabled to yes
to activate the feature. In auto mode, the feature will only be
activated in live capture mode. You can use the filename variable to set
the file name of the socket.
unix-command:
enabled: auto
#filename: custom.socket
Magic file. The extension .mgc is added to the value here.
#magic-file: /usr/share/file/magic
#magic-file:
legacy:
uricontent: enabled ##
Detection settings ##
Set the order of alerts bassed on actions
The default order is pass, drop, reject, alert
action-order:
- pass
- drop
- reject
- alert
IP Reputation
#reputation-categories-file: /usr/local/etc/suricata/iprep/categories.txt
#default-reputation-path: /usr/local/etc/suricata/iprep
#reputation-files:
- reputation.list
When run with the option --engine-analysis, the engine will read each of
the parameters below, and print reports for each of the enabled sections
and exit. The reports are printed to a file in the default log dir
given by the parameter "default-log-dir", with engine reporting
subsection below printing reports in its own report file.
engine-analysis: # enables printing reports for fast-pattern for every rule.
rules-fast-pattern: yes # enables printing reports for each rule
rules: yes
#recursion and match limits for PCRE where supported
pcre:
match-limit: 3500
match-limit-recursion: 1500 ##
Advanced Traffic Tracking and Reconstruction Settings ##
Host specific policies for defragmentation and TCP stream
reassembly. The host OS lookup is done using a radix tree, just
like a routing table so the most specific entry matches.
host-os-policy: # Make the default policy windows.
windows: [0.0.0.0/0]
bsd: []
bsd-right: []
old-linux: []
linux: [192.168.1.0/24, 192.168.1.25]
old-solaris: []
solaris: []
hpux10: []
hpux11: []
irix: []
macos: []
vista: []
windows2k3: []
Defrag settings:
defrag:
memcap: 32mb
hash-size: 65536
trackers: 65535 # number of defragmented flows to follow
max-frags: 65535 # number of fragments to keep (higher than trackers)
prealloc: yes
timeout: 60
Enable defrag per host settings
host-config: #
- dmz:
timeout: 30
address: [192.168.1.0/24, 127.0.0.0/8, 1.1.1.0/24, 2.2.2.0/24, "1.1.1.1", "2.2.2.2", "::1"] #
- lan:
timeout: 45
address:
- 192.168.0.0/24
- 192.168.10.0/24
- 172.16.14.0/24
Flow settings:
By default, the reserved memory (memcap) for flows is 32MB. This is the limit
for flow allocation inside the engine. You can change this value to allow
more memory usage for flows.
The hash-size determine the size of the hash used to identify flows inside
the engine, and by default the value is 65536.
At the startup, the engine can preallocate a number of flows, to get a better
performance. The number of flows preallocated is 10000 by default.
emergency-recovery is the percentage of flows that the engine need to
prune before unsetting the emergency state. The emergency state is activated
when the memcap limit is reached, allowing to create new flows, but
prunning them with the emergency timeouts (they are defined below).
If the memcap is reached, the engine will try to prune flows
with the default timeouts. If it doens't find a flow to prune, it will set
the emergency bit and it will try again with more agressive timeouts.
If that doesn't work, then it will try to kill the last time seen flows
not in use.
The memcap can be specified in kb, mb, gb. Just a number indicates it's
in bytes.
flow:
memcap: 128mb
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
#managers: 1 # default to one flow manager
#recyclers: 1 # default to one flow recycler thread
This option controls the use of vlan ids in the flow (and defrag)
hashing. Normally this should be enabled, but in some (broken)
setups where both sides of a flow are not tagged with the same vlan
tag, we can ignore the vlan id's in the flow hashing.
vlan:
use-for-tracking: true
Specific timeouts for flows. Here you can specify the timeouts that the
active flows will wait to transit from the current state to another, on each
protocol. The value of "new" determine the seconds to wait after a hanshake or
stream startup before the engine free the data of that flow it doesn't
change the state to established (usually if we don't receive more packets
of that flow). The value of "established" is the amount of
seconds that the engine will wait to free the flow if it spend that amount
without receiving new packets or closing the connection. "closed" is the
amount of time to wait after a flow is closed (usually zero). "bypassed" 
timeout controls locally bypassed flows. For these flows we don't do any other
tracking. If no packets have been seen after this timeout, the flow is discarded. #
There's an emergency mode that will become active under attack circumstances,
making the engine to check flow status faster. This configuration variables
use the prefix "emergency-" and work similar as the normal ones.
Some timeouts doesn't apply to all the protocols, like "closed", for udp and
icmp.
flow-timeouts:
default:
new: 30
established: 300
closed: 0
bypassed: 100
emergency-new: 10
emergency-established: 100
emergency-closed: 0
emergency-bypassed: 50
tcp:
new: 60
established: 600
closed: 60
bypassed: 100
emergency-new: 5
emergency-established: 100
emergency-closed: 10
emergency-bypassed: 50
udp:
new: 30
established: 300
bypassed: 100
emergency-new: 10
emergency-established: 100
emergency-bypassed: 50
icmp:
new: 30
established: 300
bypassed: 100
emergency-new: 10
emergency-established: 100
emergency-bypassed: 50
Stream engine settings. Here the TCP stream tracking and reassembly
engine is configured. #
stream:
memcap: 32mb # Can be specified in kb, mb, gb. Just a
# number indicates it's in bytes.
checksum-validation: yes # To validate the checksum of received
# packet. If csum validation is specified as
# "yes", then packet with invalid csum will not
# be processed by the engine stream/app layer.
# Warning: locally generated trafic can be
# generated without checksum due to hardware offload
# of checksum. You can control the handling of checksum
# on a per-interface basis via the 'checksum-checks'
# option
prealloc-sessions: 2k # 2k sessions prealloc'd per stream thread
midstream: false # don't allow midstream session pickups
async-oneside: false # don't enable async stream handling
inline: no # stream inline mode
drop-invalid: yes # in inline mode, drop packets that are invalid with regards to streaming engine
max-synack-queued: 5 # Max different SYN/ACKs to queue
bypass: no # Bypass packets when stream.depth is reached #
reassembly:
memcap: 64mb # Can be specified in kb, mb, gb. Just a number
# indicates it's in bytes.
depth: 1mb # Can be specified in kb, mb, gb. Just a number
# indicates it's in bytes.
toserver-chunk-size: 2560 # inspect raw stream in chunks of at least
# this size. Can be specified in kb, mb,
# gb. Just a number indicates it's in bytes.
toclient-chunk-size: 2560 # inspect raw stream in chunks of at least
# this size. Can be specified in kb, mb,
# gb. Just a number indicates it's in bytes.
randomize-chunk-size: yes # Take a random value for chunk size around the specified value.
# This lower the risk of some evasion technics but could lead
# detection change between runs. It is set to 'yes' by default.
randomize-chunk-range: 10 # If randomize-chunk-size is active, the value of chunk-size is
# a random value between (1 - randomize-chunk-range/100)*toserver-chunk-size
# and (1 + randomize-chunk-range/100)*toserver-chunk-size and the same
# calculation for toclient-chunk-size.
# Default value of randomize-chunk-range is 10. #
raw: yes # 'Raw' reassembly enabled or disabled.
# raw is for content inspection by detection
# engine. #
segment-prealloc: 2048 # number of segments preallocated per thread #
check-overlap-different-data: true|false
# check if a segment contains different data
# than what we've already seen for that
# position in the stream.
# This is enabled automatically if inline mode
# is used or when stream-event:reassembly_overlap_different_data;
# is used in a rule. #
stream:
memcap: 64mb
checksum-validation: yes # reject wrong csums
inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
reassembly:
memcap: 256mb
depth: 1mb # reassemble 1mb into a stream
toserver-chunk-size: 2560
toclient-chunk-size: 2560
randomize-chunk-size: yes
#randomize-chunk-range: 10
#raw: yes
#segment-prealloc: 2048
#check-overlap-different-data: true
Host table: #
Host table is used by tagging and per host thresholding subsystems. #
host:
hash-size: 4096
prealloc: 1000
memcap: 32mb
IP Pair table: #
Used by xbits 'ippair' tracking. #
#ippair:
hash-size: 4096
prealloc: 1000
memcap: 32mb
Decoder settings
decoder: # Teredo decoder is known to not be completely accurate # it will sometimes detect non-teredo as teredo.
teredo:
enabled: true ##
Performance tuning and profiling ##
The detection engine builds internal groups of signatures. The engine
allow us to specify the profile to use for them, to manage memory on an
efficient way keeping a good performance. For the profile keyword you
can use the words "low", "medium", "high" or "custom". If you use custom
make sure to define the values at "- custom-values" as your convenience.
Usually you would prefer medium/high/low. #
"sgh mpm-context", indicates how the staging should allot mpm contexts for
the signature groups. "single" indicates the use of a single context for
all the signature group heads. "full" indicates a mpm-context for each
group head. "auto" lets the engine decide the distribution of contexts
based on the information the engine gathers on the patterns from each
group head. #
The option inspection-recursion-limit is used to limit the recursive calls
in the content inspection code. For certain payload-sig combinations, we
might end up taking too much time in the content inspection code.
If the argument specified is 0, the engine uses an internally defined
default limit. On not specifying a value, we use no limits on the recursion.
detect:
profile: medium
custom-values:
toclient-groups: 3
toserver-groups: 25
sgh-mpm-context: auto
inspection-recursion-limit: 3000 # If set to yes, the loading of signatures will be made after the capture # is started. This will limit the downtime in IPS mode.
#delayed-detect: yes
prefilter: # default prefiltering setting. "mpm" only creates MPM/fast_pattern # engines. "auto" also sets up prefilter engines for other keywords. # Use --list-keywords=all to see which keywords support prefiltering.
default: mpm # the grouping values above control how many groups are created per # direction. Port whitelisting forces that port to get it's own group. # Very common ports will benefit, as well as ports with many expensive # rules.
grouping:
#tcp-whitelist: 53, 80, 139, 443, 445, 1433, 3306, 3389, 6666, 6667, 8080
#udp-whitelist: 53, 135, 5060
profiling: # Log the rules that made it past the prefilter stage, per packet # default is off. The threshold setting determines how many rules # must have made it past pre-filter for that rule to trigger the # logging.
#inspect-logging-threshold: 200
grouping:
dump-to-disk: false
include-rules: false # very verbose
include-mpm-stats: false
Select the multi pattern algorithm you want to run for scan/search the
in the engine. #
The supported algorithms are:
"ac" - Aho-Corasick, default implementation
"ac-bs" - Aho-Corasick, reduced memory implementation
"ac-cuda" - Aho-Corasick, CUDA implementation
"ac-ks" - Aho-Corasick, "Ken Steele" variant
"hs" - Hyperscan, available when built with Hyperscan support #
The default mpm-algo value of "auto" will use "hs" if Hyperscan is
available, "ac" otherwise. #
The mpm you choose also decides the distribution of mpm contexts for
signature groups, specified by the conf - "detect.sgh-mpm-context".
Selecting "ac" as the mpm would require "detect.sgh-mpm-context" 
to be set to "single", because of ac's memory requirements, unless the
ruleset is small enough to fit in one's memory, in which case one can
use "full" with "ac". Rest of the mpms can be run in "full" mode. #
There is also a CUDA pattern matcher (only available if Suricata was
compiled with --enable-cuda: b2g_cuda. Make sure to update your
max-pending-packets setting above as well if you use b2g_cuda.
mpm-algo: auto
Select the matching algorithm you want to use for single-pattern searches. #
Supported algorithms are "bm" (Boyer-Moore) and "hs" (Hyperscan, only
available if Suricata has been built with Hyperscan support). #
The default of "auto" will use "hs" if available, otherwise "bm".
spm-algo: auto
Suricata is multi-threaded. Here the threading can be influenced.
threading:
set-cpu-affinity: no # Tune cpu affinity of threads. Each family of threads can be bound # on specific CPUs. # # These 2 apply to the all runmodes: # management-cpu-set is used for flow timeout handling, counters # worker-cpu-set is used for 'worker' threads # # Additionally, for autofp these apply: # receive-cpu-set is used for capture threads # verdict-cpu-set is used for IPS verdict threads #
cpu-affinity:
- management-cpu-set:
cpu: [ 0 ] # include only these cpus in affinity settings
- receive-cpu-set:
cpu: [ 0 ] # include only these cpus in affinity settings
- worker-cpu-set:
cpu: [ "all" ]
mode: "exclusive" # Use explicitely 3 threads and don't compute number by using # detect-thread-ratio variable: # threads: 3
prio:
low: [ 0 ]
medium: [ "1-2" ]
high: [ 3 ]
default: "medium" 
#- verdict-cpu-set: # cpu: [ 0 ] # prio: # default: "high" # # By default Suricata creates one "detect" thread per available CPU/CPU core. # This setting allows controlling this behaviour. A ratio setting of 2 will # create 2 detect threads for each CPU/CPU core. So for a dual core CPU this # will result in 4 detect threads. If values below 1 are used, less threads # are created. So on a dual core CPU a setting of 0.5 results in 1 detect # thread being created. Regardless of the setting at a minimum 1 detect # thread will always be created. #
detect-thread-ratio: 1.0
Luajit has a strange memory requirement, it's 'states' need to be in the
first 2G of the process' memory. #
'luajit.states' is used to control how many states are preallocated.
State use: per detect script: 1 per detect thread. Per output script: 1 per
script.
luajit:
states: 128
Profiling settings. Only effective if Suricata has been built with the
the --enable-profiling configure flag. #
profiling: # Run profiling for every xth packet. The default is 1, which means we # profile every packet. If set to 1000, one packet is profiled for every # 1000 received.
#sample-rate: 1000 # rule profiling
rules: # Profiling can be disabled here, but it will still have a # performance impact if compiled in.
enabled: yes
filename: rule_perf.log
append: yes # Sort options: ticks, avgticks, checks, matches, maxticks # If commented out all the sort options will be used.
#sort: avgticks # Limit the number of sids for which stats are shown at exit (per sort).
limit: 10 # output to json
json: yes # per keyword profiling
keywords:
enabled: yes
filename: keyword_perf.log
append: yes # per rulegroup profiling
rulegroups:
enabled: yes
filename: rule_group_perf.log
append: yes # packet profiling
packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in.
enabled: yes
filename: packet_stats.log
append: yes # per packet csv output
csv: # Output can be disabled here, but it will still have a # performance impact if compiled in.
enabled: no
filename: packet_stats.csv # profiling of locking. Only available when Suricata was built with # --enable-profiling-locks.
locks:
enabled: no
filename: lock_stats.log
append: yes
pcap-log:
enabled: no
filename: pcaplog_stats.log
append: yes ##
Netfilter integration ##
When running in NFQ inline mode, it is possible to use a simulated
non-terminal NFQUEUE verdict.
This permit to do send all needed packet to suricata via this a rule:
iptables -I FORWARD -m mark ! --mark $MARK/$MASK -j NFQUEUE
And below, you can have your standard filtering ruleset. To activate
this mode, you need to set mode to 'repeat'
If you want packet to be sent to another queue after an ACCEPT decision
set mode to 'route' and set next-queue value.
On linux >= 3.1, you can set batchcount to a value > 1 to improve performance
by processing several packets before sending a verdict (worker runmode only).
On linux >= 3.6, you can set the fail-open option to yes to have the kernel
accept the packet if suricata is not able to keep pace.
bypass mark and mask can be used to implement NFQ bypass. If bypass mark is
set then the NFQ bypass is activated. Suricata will set the bypass mark/mask
on packet of a flow that need to be bypassed. The Nefilter ruleset has to
directly accept all packets of a flow once a packet has been marked.
nfq:
mode: accept
repeat-mark: 1
repeat-mask: 1
bypass-mark: 1
bypass-mask: 1
route-queue: 2
batchcount: 20
fail-open: yes
#nflog support
nflog: # netlink multicast group # (the same as the iptables --nflog-group param) # Group 0 is used by the kernel, so you can't use it
- group: 2 # netlink buffer size
buffer-size: 18432 # put default value here
- group: default # set number of packet to queue inside kernel
qthreshold: 1 # set the delay before flushing packet in the queue inside kernel
qtimeout: 100 # netlink max buffer size
max-size: 20000 ##
Advanced Capture Options ##
general settings affecting packet capture
capture: # disable NIC offloading. It's restored when Suricata exists. # Enabled by default
#disable-offloading: false # # disable checksum validation. Same as setting '-k none' on the # commandline
#checksum-validation: none
Netmap support #
Netmap operates with NIC directly in driver, so you need FreeBSD wich have
built-in netmap support or compile and install netmap module and appropriate
NIC driver on your Linux system.
To reach maximum throughput disable all receive-, segmentation-,
checksum- offloadings on NIC.
Disabling Tx checksum offloading is required for connecting OS endpoint
with NIC endpoint.
You can find more information at https://github.com/luigirizzo/netmap #
netmap: # To specify OS endpoint add plus sign at the end (e.g. "eth0+")
- interface: eth2 # Number of receive threads. "auto" uses number of RSS queues on interface.
#threads: auto # You can use the following variables to activate netmap tap or IPS mode. # If copy-mode is set to ips or tap, the traffic coming to the current # interface will be copied to the copy-iface interface. If 'tap' is set, the # copy is complete. If 'ips' is set, the packet matching a 'drop' action # will not be copied. # To specify the OS as the copy-iface (so the OS can route packets, or forward # to a service running on the same machine) add a plus sign at the end # (e.g. "copy-iface: eth0+"). Don't forget to set up a symmetrical eth0+ -> eth0 # for return packets. Hardware checksumming must be off on the interface if # using an OS endpoint (e.g. 'ifconfig eth0 -rxcsum -txcsum -rxcsum6 -txcsum6' for FreeBSD # or 'ethtool -K eth0 tx off rx off' for Linux).
#copy-mode: tap
#copy-iface: eth3 # Set to yes to disable promiscuous mode # disable-promisc: no # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. # Warning: 'checksum-validation' must be set to yes to have any validation
#checksum-checks: auto # BPF filter to apply to this interface. The pcap filter syntax apply here.
#bpf-filter: port 80 or udp
#- interface: eth3
#threads: auto
#copy-mode: tap
#copy-iface: eth2 # Put default values here
- interface: default
PF_RING configuration. for use with native PF_RING support
for more info see http://www.ntop.org/products/pf_ring/
pfring:
- interface: eth0 # Number of receive threads (>1 will enable experimental flow pinned # runmode)
threads: 1 # Default clusterid. PF_RING will load balance packets based on flow. # All threads/processes that will participate need to have the same # clusterid.
cluster-id: 99 # Default PF_RING cluster type. PF_RING can load balance per flow. # Possible values are cluster_flow or cluster_round_robin.
cluster-type: cluster_flow # bpf filter for this interface
#bpf-filter: tcp # Choose checksum verification mode for the interface. At the moment # of the capture, some packets may be with an invalid checksum due to # offloading to the network card of the checksum computation. # Possible values are: # - rxonly: only compute checksum for packets received by network card. # - yes: checksum validation is forced # - no: checksum validation is disabled # - auto: suricata uses a statistical approach to detect when # checksum off-loading is used. (default) # Warning: 'checksum-validation' must be set to yes to have any validation
#checksum-checks: auto # Second interface
#- interface: eth1 # threads: 3 # cluster-id: 93 # cluster-type: cluster_flow # Put default values here
- interface: default
#threads: 2
For FreeBSD ipfw(8) divert(4) support.
Please make sure you have ipfw_load="YES" and ipdivert_load="YES" 
in /etc/loader.conf or kldload'ing the appropriate kernel modules.
Additionally, you need to have an ipfw rule for the engine to see
the packets from ipfw. For Example: #
ipfw add 100 divert 8000 ip from any to any #
The 8000 above should be the same number you passed on the command
line, i.e. -d 8000 #
ipfw: # Reinject packets at the specified ipfw rule number. This config # option is the ipfw rule number AT WHICH rule processing continues # in the ipfw processing system after the engine has finished # inspecting the packet for acceptance. If no rule number is specified, # accepted packets are reinjected at the divert rule which they entered # and IPFW rule processing continues. No check is done to verify # this will rule makes sense so care must be taken to avoid loops in ipfw. # ## The following example tells the engine to reinject packets # back into the ipfw firewall AT rule number 5500: # # ipfw-reinjection-rule-number: 5500
napatech: # The Host Buffer Allowance for all streams # (-1 = OFF, 1 - 100 = percentage of the host buffer that can be held back) # This may be enabled when sharing streams with another application. # Otherwise, it should be turned off.
hba: -1 # use_all_streams set to "yes" will query the Napatech service for all configured # streams and listen on all of them. When set to "no" the streams config array # will be used.
use-all-streams: yes # The streams to listen on. This can be either: # a list of individual streams (e.g. streams: [0,1,2,3]) # or # a range of streams (e.g. streams: ["0-3"])
streams: ["0-3"]
Tilera mpipe configuration. for use on Tilera TILE-Gx.
mpipe: # Load balancing modes: "static", "dynamic", "sticky", or "round-robin".
load-balance: dynamic # Number of Packets in each ingress packet queue. Must be 128, 512, 2028 or 65536
iqueue-packets: 2048 # List of interfaces we will listen on.
inputs:
- interface: xgbe2
- interface: xgbe3
- interface: xgbe4 # Relative weight of memory for packets of each mPipe buffer size.
stack:
size128: 0
size256: 9
size512: 0
size1024: 0
size1664: 7
size4096: 0
size10386: 0
size16384: 0 ##
Hardware accelaration ##
Cuda configuration.
cuda: # The "mpm" profile. On not specifying any of these parameters, the engine's # internal default values are used, which are same as the ones specified in # in the default conf file.
mpm: # The minimum length required to buffer data to the gpu. # Anything below this is MPM'ed on the CPU. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes. # A value of 0 indicates there's no limit.
data-buffer-size-min-limit: 0 # The maximum length for data that we would buffer to the gpu. # Anything over this is MPM'ed on the CPU. # Can be specified in kb, mb, gb. Just a number indicates it's in bytes.
data-buffer-size-max-limit: 1500 # The ring buffer size used by the CudaBuffer API to buffer data.
cudabuffer-buffer-size: 500mb # The max chunk size that can be sent to the gpu in a single go.
gpu-transfer-size: 50mb # The timeout limit for batching of packets in microseconds.
batching-timeout: 2000 # The device to use for the mpm. Currently we don't support load balancing # on multiple gpus. In case you have multiple devices on your system, you # can specify the device to use, using this conf. By default we hold 0, to # specify the first device cuda sees. To find out device-id associated with # the card(s) on the system run "suricata --list-cuda-cards".
device-id: 0 # No of Cuda streams used for asynchronous processing. All values > 0 are valid. # For this option you need a device with Compute Capability > 1.0.
cuda-streams: 2 ##
Include other configs ##
Includes. Files included here will be handled as if they were
inlined in this configuration file.
#include: include1.yaml
#include: include2.yaml

what can i do to resolve this error.

Files

suricata.txt (79.1 KB) suricata.txt

this is my return

leonardo kasper, 03/12/2020 08:25 PM

Actions

Copy link

Updated by Victor Julien about 5 years ago

Description updated (diff)

Actions

Copy link

Updated by Victor Julien about 5 years ago

You probably don't have a proper classification.config loaded. You should have a warning about it. Can you post the full output of Suricata in this ticket?

Please don't open new tickets for the this issue.

Actions

Copy link

Updated by Victor Julien about 5 years ago

Status changed from New to Feedback

Actions

Copy link

Updated by leonardo kasper about 5 years ago

[1398] 11/2/2020 -- 16:25:56 - (suricata.c:1905) <Info> (ParseCommandLine) -- Running suricata under test mode
[1398] 11/2/2020 -- 16:25:56 - (suricata.c:1084) <Notice> (LogVersion) -- This is Suricata version 5.0.1 RELEASE running in SYSTEM mode
[1398] 11/2/2020 -- 16:25:56 - (runmodes.c:779) <Warning> (RunModeInitializeOutputs) -- [ERRCODE: SC_ERR_NOT_SUPPORTED(225)] - dns-log is not longer available as of Suricata 5.0
[1398] 11/2/2020 -- 16:25:56 - (log-droplog.c:142) <Warning> (LogDropLogInitCtx) -- [ERRCODE: SC_WARN_DEPRECATED(203)] - The drop log has been deprecated and will be removed by June 2020. Please use eve-log.
[1398] 11/2/2020 -- 16:25:56 - (detect-classtype.c:150) <Warning> (DetectClasstypeSetup) -- [ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - signature at /etc/suricata/rules/emerging-dns.rules:113 uses unknown classtype: "command-and-control", using default priority 3. This message won't be shown again for this classtype
[1398] 11/2/2020 -- 16:25:56 - (detect-classtype.c:150) <Warning> (DetectClasstypeSetup) -- [ERRCODE: SC_ERR_UNKNOWN_VALUE(129)] - signature at /etc/suricata/rules/emerging-dns.rules:133 uses unknown classtype: "targeted-activity", using default priority 3. This message won't be shown again for this classtype
[1398] 11/2/2020 -- 16:25:56 - (suricata.c:3060) <Notice> (main) -- Configuration provided was successfully loaded. Exiting.

is that what you are asking for?

thanks

Actions

Copy link

Updated by leonardo kasper about 5 years ago

how can i configure yaml well?

Actions

Copy link

Updated by Peter Manev about 5 years ago

You probably need to upgrade the classification.config used - https://github.com/OISF/suricata/blob/master/etc/classification.config

Actions

Copy link

Updated by leonardo kasper about 5 years ago

sorry to ask but what commands can i give to configure after downloading https://github.com/OISF/suricata/blob/master/etc/classification.config

can that be?

./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-geoip

Actions

Copy link

Updated by leonardo kasper about 5 years ago

I'm starting to use it now, I have no experience in Suricata

Actions

Copy link

Updated by leonardo kasper about 5 years ago

sorry to ask but what commands can i give to configure after downloading https://github.com/OISF/suricata/blob/master/etc/classification.config

can that be?

./configure --enable-nfqueue --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-geoip

help please

Actions

Copy link

#10

Updated by Andreas Herz about 5 years ago

You just need to download the current classification.config and place it in /etc/suricata/classification.config

Actions

Copy link

#11

Updated by leonardo kasper about 5 years ago

Andreas I downloaded it and put it in the folder but the error continues, what else can I do

Actions

Copy link

#12

Updated by Peter Manev about 5 years ago

Is that the expected place for the classification.conf ? Usually it is defined or adjusted in suricata.yaml , you should have a config line mentioning where the file is expected to be.

Actions

Copy link

#13

Updated by Peter Manev about 5 years ago

Just to be on the safe side - if you dump the config what would be the classification file location. For example:

sudo /opt/suritest/bin/suricata --dump-config |grep class 
classification-file = /opt/suritest/etc/suricata/classification.config

Actions

Copy link

#14

Updated by leonardo kasper about 5 years ago

File suricata.txt suricata.txt added

this is my return

Actions

Copy link

#15

Updated by Peter Manev about 5 years ago

It is unreadable at least on my end, sorry.
Can you please try to see the output of :

suricata --dump-config |grep class

Actions

Copy link

#16

Updated by leonardo kasper about 5 years ago

would that be what you need

suricata --dump-config | grep class classification-file = /etc/suricata/classification.config

/etc/suricata/classification.config: <title>suricata/classification.config at master · OISF/suricata · GitHub</title>
/etc/suricata/classification.config: <meta name="octolytics-host" content="collector.githubapp.com" /><meta name="octolytics-app-id" content="github" /><meta name="octolytics-event-url" content="https://collector.githubapp.com/github-external/browser_event" /><meta name="octolytics-dimension-ga_id" content="" class="js-octo-ga-id" />
/etc/suricata/classification.config:<meta class="js-ga-set" name="dimension1" content="Logged Out">
/etc/suricata/classification.config: <link rel="canonical" href="https://github.com/OISF/suricata/blob/master/etc/classification.config" data-pjax-transient>
/etc/suricata/classification.config: <link rel="icon" type="image/x-icon" class="js-site-favicon" href="https://github.githubassets.com/favicon.ico">
/etc/suricata/classification.config: <body class="logged-out env-production page-responsive page-blob">
/etc/suricata/classification.config: <div class="position-relative js-header-wrapper ">
/etc/suricata/classification.config: <a href="#start-of-content" class="px-2 py-4 bg-blue text-white show-on-focus js-skip-to-content">Skip to content</a>
/etc/suricata/classification.config: <span class="Progress progress-pjax-loader position-fixed width-full js-pjax-loader-bar">
/etc/suricata/classification.config: <span class="progress-pjax-loader-bar top-0 left-0" style="width: 0%;"></span>
/etc/suricata/classification.config: <header class="Header-old header-logged-out js-details-container Details position-relative f4 py-2" role="banner">
/etc/suricata/classification.config: <div class="container-lg d-lg-flex flex-items-center p-responsive">
/etc/suricata/classification.config: <div class="d-flex flex-justify-between flex-items-center">
/etc/suricata/classification.config: <a class="mr-4" href="https://github.com/" aria-label="Homepage" data-ga-click="(Logged out) Header, go to homepage, icon:logo-wordmark">
/etc/suricata/classification.config: <svg height="32" class="octicon octicon-mark-github text-white" viewBox="0 0 16 16" version="1.1" width="32" aria-hidden="true"><path fill-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>
/etc/suricata/classification.config: <div class="d-lg-none css-truncate css-truncate-target width-fit p-2">
/etc/suricata/classification.config: <svg class="octicon octicon-repo" viewBox="0 0 12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M4 9H3V8h1v1zm0-3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .55-.45 1-1 1H6v2l-1.5-1.5L3 16v-2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .45 1 1zm-1 10H1v2h2v-1h3v1h5v-2zm0-10H2v9h9V1z"/></svg>
/etc/suricata/classification.config: <a class="Header-link" href="/OISF">OISF</a>
/etc/suricata/classification.config: <a class="Header-link" href="/OISF/suricata">suricata</a>
/etc/suricata/classification.config: <div class="d-flex flex-items-center">
/etc/suricata/classification.config: class="d-inline-block d-lg-none f5 text-white no-underline border border-gray-dark rounded-2 px-2 py-1 mr-3 mr-sm-5"
/etc/suricata/classification.config: data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config","user_id":null}}" data-hydro-click-hmac="3d0f744b60a8ed3a9f948749e93dd5e56e58284ca8c31c50f22e358ab1e6c2e9"
/etc/suricata/classification.config: <button class="btn-link d-lg-none mt-1 js-details-target" type="button" aria-label="Toggle navigation" aria-expanded="false">
/etc/suricata/classification.config: <svg height="24" class="octicon octicon-three-bars text-white" viewBox="0 0 12 16" version="1.1" width="18" aria-hidden="true"><path fill-rule="evenodd" d="M11.41 9H.59C0 9 0 8.59 0 8c0-.59 0-1 .59-1H11.4c.59 0 .59.41.59 1 0 .59 0 1-.59 1h.01zm0-4H.59C0 5 0 4.59 0 4c0-.59 0-1 .59-1H11.4c.59 0 .59.41.59 1 0 .59 0 1-.59 1h.01zM.59 11H11.4c.59 0 .59.41.59 1 0 .59 0 1-.59 1H.59C0 13 0 12.59 0 12c0-.59 0-1 .59-1z"/></svg>
/etc/suricata/classification.config: <div class="HeaderMenu HeaderMenu--logged-out position-fixed top-0 right-0 bottom-0 height-fit position-lg-relative d-lg-flex flex-justify-between flex-items-center flex-auto">
/etc/suricata/classification.config: <div class="d-flex d-lg-none flex-justify-end border-bottom bg-gray-light p-3">
/etc/suricata/classification.config: <button class="btn-link js-details-target" type="button" aria-label="Toggle navigation" aria-expanded="false">
/etc/suricata/classification.config: <svg height="24" class="octicon octicon-x text-gray" viewBox="0 0 12 16" version="1.1" width="18" aria-hidden="true"><path fill-rule="evenodd" d="M7.48 8l3.75 3.75-1.48 1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48 1.48L7.48 8z"/></svg>
/etc/suricata/classification.config: <nav class="mt-0 px-3 px-lg-0 mb-5 mb-lg-0" aria-label="Global">
/etc/suricata/classification.config: <ul class="d-lg-flex list-style-none">
/etc/suricata/classification.config: <li class="d-block d-lg-flex flex-lg-nowrap flex-lg-items-center border-bottom border-lg-bottom-0 mr-0 mr-lg-3 edge-item-fix position-relative flex-wrap flex-justify-between d-flex flex-items-center ">
/etc/suricata/classification.config: <details class="HeaderMenu-details details-overlay details-reset width-full">
/etc/suricata/classification.config: <summary class="HeaderMenu-summary HeaderMenu-link px-0 py-3 border-0 no-wrap d-block d-lg-inline-block">
/etc/suricata/classification.config: <svg x="0px" y="0px" viewBox="0 0 14 8" xml:space="preserve" fill="none" class="icon-chevon-down-mktg position-absolute position-lg-relative">
/etc/suricata/classification.config: <div class="dropdown-menu flex-auto rounded-1 bg-white px-0 mt-0 pb-4 p-lg-4 position-relative position-lg-absolute left-0 left-lg-n4">
/etc/suricata/classification.config: <a href="/features" class="py-2 lh-condensed-ultra d-block link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Features">Features <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a>
/etc/suricata/classification.config: <ul class="list-style-none f5 pb-3">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features/code-review/" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Code review">Code review</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features/project-management/" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Project management">Project management</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features/integrations" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Integrations">Integrations</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features/actions" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Actions">Actions</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features/packages" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to GitHub Packages">Packages</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features/security" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Security">Security</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features#team-management" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Team management">Team management</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/features#hosting" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Code hosting">Hosting</a></li>
/etc/suricata/classification.config: <ul class="list-style-none mb-0 border-lg-top pt-lg-3">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/customer-stories" class="py-2 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Customer stories">Customer stories <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/security" class="py-2 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Security">Security <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
/etc/suricata/classification.config: <li class="border-bottom border-lg-bottom-0 mr-0 mr-lg-3">
/etc/suricata/classification.config: <a href="/enterprise" class="HeaderMenu-link no-underline py-3 d-block d-lg-inline-block" data-ga-click="(Logged out) Header, go to Enterprise">Enterprise</a>
/etc/suricata/classification.config: <li class="d-block d-lg-flex flex-lg-nowrap flex-lg-items-center border-bottom border-lg-bottom-0 mr-0 mr-lg-3 edge-item-fix position-relative flex-wrap flex-justify-between d-flex flex-items-center ">
/etc/suricata/classification.config: <details class="HeaderMenu-details details-overlay details-reset width-full">
/etc/suricata/classification.config: <summary class="HeaderMenu-summary HeaderMenu-link px-0 py-3 border-0 no-wrap d-block d-lg-inline-block">
/etc/suricata/classification.config: <svg x="0px" y="0px" viewBox="0 0 14 8" xml:space="preserve" fill="none" class="icon-chevon-down-mktg position-absolute position-lg-relative">
/etc/suricata/classification.config: <div class="dropdown-menu flex-auto rounded-1 bg-white px-0 pt-2 pb-0 mt-0 pb-4 p-lg-4 position-relative position-lg-absolute left-0 left-lg-n4">
/etc/suricata/classification.config: <ul class="list-style-none mb-3">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/explore" class="py-2 lh-condensed-ultra d-block link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Explore">Explore GitHub <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
/etc/suricata/classification.config: <h4 class="text-gray-light text-normal text-mono f5 mb-2 border-lg-top pt-lg-3">Learn & contribute</h4>
/etc/suricata/classification.config: <ul class="list-style-none mb-3">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/topics" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Topics">Topics</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/collections" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Collections">Collections</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/trending" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Trending">Trending</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://lab.github.com/" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Learning lab">Learning Lab</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://opensource.guide" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Open source guides">Open source guides</a></li>
/etc/suricata/classification.config: <h4 class="text-gray-light text-normal text-mono f5 mb-2 border-lg-top pt-lg-3">Connect with others</h4>
/etc/suricata/classification.config: <ul class="list-style-none mb-0">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://github.com/events" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Events">Events</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://github.community" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Community forum">Community forum</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://education.github.com" class="py-2 pb-0 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to GitHub Education">GitHub Education</a></li>
/etc/suricata/classification.config: <li class="border-bottom border-lg-bottom-0 mr-0 mr-lg-3">
/etc/suricata/classification.config: <a href="/marketplace" class="HeaderMenu-link no-underline py-3 d-block d-lg-inline-block" data-ga-click="(Logged out) Header, go to Marketplace">Marketplace</a>
/etc/suricata/classification.config: <li class="d-block d-lg-flex flex-lg-nowrap flex-lg-items-center border-bottom border-lg-bottom-0 mr-0 mr-lg-3 edge-item-fix position-relative flex-wrap flex-justify-between d-flex flex-items-center ">
/etc/suricata/classification.config: <details class="HeaderMenu-details details-overlay details-reset width-full">
/etc/suricata/classification.config: <summary class="HeaderMenu-summary HeaderMenu-link px-0 py-3 border-0 no-wrap d-block d-lg-inline-block">
/etc/suricata/classification.config: <svg x="0px" y="0px" viewBox="0 0 14 8" xml:space="preserve" fill="none" class="icon-chevon-down-mktg position-absolute position-lg-relative">
/etc/suricata/classification.config: <div class="dropdown-menu flex-auto rounded-1 bg-white px-0 pt-2 pb-4 mt-0 p-lg-4 position-relative position-lg-absolute left-0 left-lg-n4">
/etc/suricata/classification.config: <a href="/pricing" class="pb-2 lh-condensed-ultra d-block link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Pricing">Plans <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a>
/etc/suricata/classification.config: <ul class="list-style-none mb-3">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/pricing#feature-comparison" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Compare plans">Compare plans</a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://enterprise.github.com/contact" class="py-2 lh-condensed-ultra d-block link-gray no-underline f5" data-ga-click="(Logged out) Header, go to Contact Sales">Contact Sales</a></li>
/etc/suricata/classification.config: <ul class="list-style-none mb-0 border-lg-top pt-lg-3">
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="/nonprofit" class="py-2 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Nonprofits">Nonprofit <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
/etc/suricata/classification.config: <li class="edge-item-fix"><a href="https://education.github.com" class="py-2 pb-0 lh-condensed-ultra d-block no-underline link-gray-dark no-underline h5 Bump-link--hover" data-ga-click="(Logged out) Header, go to Education">Education <span class="Bump-link-symbol float-right text-normal text-gray-light">→</span></a></li>
/etc/suricata/classification.config: <div class="d-lg-flex flex-items-center px-3 px-lg-0 text-center text-lg-left">
/etc/suricata/classification.config: <div class="d-lg-flex mb-3 mb-lg-0">
/etc/suricata/classification.config: <div class="header-search flex-self-stretch flex-lg-self-auto mr-0 mr-lg-3 mb-3 mb-lg-0 scoped-search site-scoped-search js-site-search position-relative js-jump-to"
/etc/suricata/classification.config: <div class="position-relative">
/etc/suricata/classification.config: </option></form><form class="js-site-search-form" role="search" aria-label="Site" data-scope-type="Repository" data-scope-id="5410234" data-scoped-search-url="/OISF/suricata/search" data-unscoped-search-url="/search" action="/OISF/suricata/search" accept-charset="UTF-8" method="get">
/etc/suricata/classification.config: <label class="form-control input-sm header-search-wrapper p-0 header-search-wrapper-jump-to position-relative d-flex flex-justify-between flex-items-center js-chromeless-input-container">
/etc/suricata/classification.config: class="form-control input-sm header-search-input jump-to-field js-jump-to-field js-site-search-focus js-site-search-field is-clearable"
/etc/suricata/classification.config: <input type="hidden" data-csrf="true" class="js-data-jump-to-suggestions-path-csrf" value="18OU+7tyoKqbviL6tk6U0y67/+k44nUCICSqQBzLyJIpDujnTxownVKLef1w7ObVrdIgaWxYq9iAe2Au4yiOMQ==" />
/etc/suricata/classification.config: <input type="hidden" class="js-site-search-type-field" name="type" >
/etc/suricata/classification.config: <img src="https://github.githubassets.com/images/search-key-slash.svg" alt="" class="mr-2 header-search-key-slash">
/etc/suricata/classification.config: <div class="Box position-absolute overflow-hidden d-none jump-to-suggestions js-jump-to-suggestions-container">
/etc/suricata/classification.config:<ul class="d-none js-jump-to-suggestions-template-container">
/etc/suricata/classification.config:<li class="d-flex flex-justify-start flex-items-center p-0 f5 navigation-item js-navigation-item js-jump-to-suggestion" role="option">
/etc/suricata/classification.config: <a tabindex="-1" class="no-underline d-flex flex-auto flex-items-center jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open p-2" href="">
/etc/suricata/classification.config: <div class="jump-to-octicon js-jump-to-octicon flex-shrink-0 mr-2 text-center d-none">
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-repo flex-shrink-0 js-jump-to-octicon-repo d-none" title="Repository" aria-label="Repository" viewBox="0 0 12 16" version="1.1" role="img"><path fill-rule="evenodd" d="M4 9H3V8h1v1zm0-3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .55-.45 1-1 1H6v2l-1.5-1.5L3 16v-2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .45 1 1zm-1 10H1v2h2v-1h3v1h5v-2zm0-10H2v9h9V1z"/></svg>
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-project flex-shrink-0 js-jump-to-octicon-project d-none" title="Project" aria-label="Project" viewBox="0 0 15 16" version="1.1" role="img"><path fill-rule="evenodd" d="M10 12h3V2h-3v10zm-4-2h3V2H6v8zm-4 4h3V2H2v12zm-1 1h13V1H1v14zM14 0H1a1 1 0 00-1 1v14a1 1 0 001 1h13a1 1 0 001-1V1a1 1 0 00-1-1z"/></svg>
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-search flex-shrink-0 js-jump-to-octicon-search d-none" title="Search" aria-label="Search" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M15.7 13.3l-3.81-3.83A5.93 5.93 0 0013 6c0-3.31-2.69-6-6-6S1 2.69 1 6s2.69 6 6 6c1.3 0 2.48-.41 3.47-1.11l3.83 3.81c.19.2.45.3.7.3.25 0 .52-.09.7-.3a.996.996 0 000-1.41v.01zM7 10.7c-2.59 0-4.7-2.11-4.7-4.7 0-2.59 2.11-4.7 4.7-4.7 2.59 0 4.7 2.11 4.7 4.7 0 2.59-2.11 4.7-4.7 4.7z"/></svg>
/etc/suricata/classification.config: <img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-avatar d-none" alt="" aria-label="Team" src="" width="28" height="28">
/etc/suricata/classification.config: <div class="jump-to-suggestion-name js-jump-to-suggestion-name flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
/etc/suricata/classification.config: <div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none js-jump-to-badge-search">
/etc/suricata/classification.config: <span class="js-jump-to-badge-search-text-default d-none" aria-label="in this repository">
/etc/suricata/classification.config: <span class="js-jump-to-badge-search-text-global d-none" aria-label="in all of GitHub">
/etc/suricata/classification.config: <span aria-hidden="true" class="d-inline-block ml-1 v-align-middle">↵</span>
/etc/suricata/classification.config: <div aria-hidden="true" class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
/etc/suricata/classification.config: <span class="d-inline-block ml-1 v-align-middle">↵</span>
/etc/suricata/classification.config:<ul class="d-none js-jump-to-no-results-template-container">
/etc/suricata/classification.config: <li class="d-flex flex-justify-center flex-items-center f5 d-none js-jump-to-suggestion p-2">
/etc/suricata/classification.config: <span class="text-gray">No suggested jump to results</span>
/etc/suricata/classification.config:<ul id="jump-to-results" role="listbox" class="p-0 m-0 js-navigation-container jump-to-suggestions-results-container js-jump-to-suggestions-results-container">
/etc/suricata/classification.config:<li class="d-flex flex-justify-start flex-items-center p-0 f5 navigation-item js-navigation-item js-jump-to-scoped-search d-none" role="option">
/etc/suricata/classification.config: <a tabindex="-1" class="no-underline d-flex flex-auto flex-items-center jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open p-2" href="">
/etc/suricata/classification.config: <div class="jump-to-octicon js-jump-to-octicon flex-shrink-0 mr-2 text-center d-none">
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-repo flex-shrink-0 js-jump-to-octicon-repo d-none" title="Repository" aria-label="Repository" viewBox="0 0 12 16" version="1.1" role="img"><path fill-rule="evenodd" d="M4 9H3V8h1v1zm0-3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .55-.45 1-1 1H6v2l-1.5-1.5L3 16v-2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .45 1 1zm-1 10H1v2h2v-1h3v1h5v-2zm0-10H2v9h9V1z"/></svg>
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-project flex-shrink-0 js-jump-to-octicon-project d-none" title="Project" aria-label="Project" viewBox="0 0 15 16" version="1.1" role="img"><path fill-rule="evenodd" d="M10 12h3V2h-3v10zm-4-2h3V2H6v8zm-4 4h3V2H2v12zm-1 1h13V1H1v14zM14 0H1a1 1 0 00-1 1v14a1 1 0 001 1h13a1 1 0 001-1V1a1 1 0 00-1-1z"/></svg>
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-search flex-shrink-0 js-jump-to-octicon-search d-none" title="Search" aria-label="Search" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M15.7 13.3l-3.81-3.83A5.93 5.93 0 0013 6c0-3.31-2.69-6-6-6S1 2.69 1 6s2.69 6 6 6c1.3 0 2.48-.41 3.47-1.11l3.83 3.81c.19.2.45.3.7.3.25 0 .52-.09.7-.3a.996.996 0 000-1.41v.01zM7 10.7c-2.59 0-4.7-2.11-4.7-4.7 0-2.59 2.11-4.7 4.7-4.7 2.59 0 4.7 2.11 4.7 4.7 0 2.59-2.11 4.7-4.7 4.7z"/></svg>
/etc/suricata/classification.config: <img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-avatar d-none" alt="" aria-label="Team" src="" width="28" height="28">
/etc/suricata/classification.config: <div class="jump-to-suggestion-name js-jump-to-suggestion-name flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
/etc/suricata/classification.config: <div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none js-jump-to-badge-search">
/etc/suricata/classification.config: <span class="js-jump-to-badge-search-text-default d-none" aria-label="in this repository">
/etc/suricata/classification.config: <span class="js-jump-to-badge-search-text-global d-none" aria-label="in all of GitHub">
/etc/suricata/classification.config: <span aria-hidden="true" class="d-inline-block ml-1 v-align-middle">↵</span>
/etc/suricata/classification.config: <div aria-hidden="true" class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
/etc/suricata/classification.config: <span class="d-inline-block ml-1 v-align-middle">↵</span>
/etc/suricata/classification.config:<li class="d-flex flex-justify-start flex-items-center p-0 f5 navigation-item js-navigation-item js-jump-to-global-search d-none" role="option">
/etc/suricata/classification.config: <a tabindex="-1" class="no-underline d-flex flex-auto flex-items-center jump-to-suggestions-path js-jump-to-suggestion-path js-navigation-open p-2" href="">
/etc/suricata/classification.config: <div class="jump-to-octicon js-jump-to-octicon flex-shrink-0 mr-2 text-center d-none">
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-repo flex-shrink-0 js-jump-to-octicon-repo d-none" title="Repository" aria-label="Repository" viewBox="0 0 12 16" version="1.1" role="img"><path fill-rule="evenodd" d="M4 9H3V8h1v1zm0-3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .55-.45 1-1 1H6v2l-1.5-1.5L3 16v-2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .45 1 1zm-1 10H1v2h2v-1h3v1h5v-2zm0-10H2v9h9V1z"/></svg>
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-project flex-shrink-0 js-jump-to-octicon-project d-none" title="Project" aria-label="Project" viewBox="0 0 15 16" version="1.1" role="img"><path fill-rule="evenodd" d="M10 12h3V2h-3v10zm-4-2h3V2H6v8zm-4 4h3V2H2v12zm-1 1h13V1H1v14zM14 0H1a1 1 0 00-1 1v14a1 1 0 001 1h13a1 1 0 001-1V1a1 1 0 00-1-1z"/></svg>
/etc/suricata/classification.config: <svg height="16" width="16" class="octicon octicon-search flex-shrink-0 js-jump-to-octicon-search d-none" title="Search" aria-label="Search" viewBox="0 0 16 16" version="1.1" role="img"><path fill-rule="evenodd" d="M15.7 13.3l-3.81-3.83A5.93 5.93 0 0013 6c0-3.31-2.69-6-6-6S1 2.69 1 6s2.69 6 6 6c1.3 0 2.48-.41 3.47-1.11l3.83 3.81c.19.2.45.3.7.3.25 0 .52-.09.7-.3a.996.996 0 000-1.41v.01zM7 10.7c-2.59 0-4.7-2.11-4.7-4.7 0-2.59 2.11-4.7 4.7-4.7 2.59 0 4.7 2.11 4.7 4.7 0 2.59-2.11 4.7-4.7 4.7z"/></svg>
/etc/suricata/classification.config: <img class="avatar mr-2 flex-shrink-0 js-jump-to-suggestion-avatar d-none" alt="" aria-label="Team" src="" width="28" height="28">
/etc/suricata/classification.config: <div class="jump-to-suggestion-name js-jump-to-suggestion-name flex-auto overflow-hidden text-left no-wrap css-truncate css-truncate-target">
/etc/suricata/classification.config: <div class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none js-jump-to-badge-search">
/etc/suricata/classification.config: <span class="js-jump-to-badge-search-text-default d-none" aria-label="in this repository">
/etc/suricata/classification.config: <span class="js-jump-to-badge-search-text-global d-none" aria-label="in all of GitHub">
/etc/suricata/classification.config: <span aria-hidden="true" class="d-inline-block ml-1 v-align-middle">↵</span>
/etc/suricata/classification.config: <div aria-hidden="true" class="border rounded-1 flex-shrink-0 bg-gray px-1 text-gray-light ml-1 f6 d-none d-on-nav-focus js-jump-to-badge-jump">
/etc/suricata/classification.config: <span class="d-inline-block ml-1 v-align-middle">↵</span>
/etc/suricata/classification.config: <a href="/login?return_to=%2FOISF%2Fsuricata%2Fblob%2Fmaster%2Fetc%2Fclassification.config"
/etc/suricata/classification.config: class="HeaderMenu-link no-underline mr-3"
/etc/suricata/classification.config: data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header menu","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config","user_id":null}}" data-hydro-click-hmac="c6b11c1346acff4e8bdc8aed7e762ac4536e9f8cae538e875765f34e92ac38ba"
/etc/suricata/classification.config: class="HeaderMenu-link d-inline-block no-underline border border-gray-dark rounded-1 px-2 py-1"
/etc/suricata/classification.config: data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header menu","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config","user_id":null}}" data-hydro-click-hmac="c6b11c1346acff4e8bdc8aed7e762ac4536e9f8cae538e875765f34e92ac38ba"
/etc/suricata/classification.config: <div id="start-of-content" class="show-on-focus"></div>
/etc/suricata/classification.config: <include-fragment class="js-notification-shelf-include-fragment" data-base-src="https://github.com/notifications/beta/shelf"></include-fragment>
/etc/suricata/classification.config: <div class="application-main " data-commit-hovercards-enabled>
/etc/suricata/classification.config: <div itemscope itemtype="http://schema.org/SoftwareSourceCode" class="">
/etc/suricata/classification.config: <div class="pagehead repohead hx_repohead readability-menu bg-gray-light pb-0 pt-0 pt-lg-3">
/etc/suricata/classification.config: <div class="d-flex container-lg mb-4 p-responsive d-none d-lg-flex">
/etc/suricata/classification.config: <div class="flex-auto min-width-0 width-fit mr-3">
/etc/suricata/classification.config: <h1 class="public d-flex flex-wrap flex-items-center break-word float-none ">
/etc/suricata/classification.config: <svg class="octicon octicon-repo" viewBox="0 0 12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M4 9H3V8h1v1zm0-3H3v1h1V6zm0-2H3v1h1V4zm0-2H3v1h1V2zm8-1v12c0 .55-.45 1-1 1H6v2l-1.5-1.5L3 16v-2H1c-.55 0-1-.45-1-1V1c0-.55.45-1 1-1h10c.55 0 1 .45 1 1zm-1 10H1v2h2v-1h3v1h5v-2zm0-10H2v9h9V1z"/></svg>
/etc/suricata/classification.config: <span class="author ml-1 flex-self-stretch" itemprop="author">
/etc/suricata/classification.config: <a class="url fn" rel="author" data-hovercard-type="organization" data-hovercard-url="/orgs/OISF/hovercard" href="/OISF">OISF</a>
/etc/suricata/classification.config: <span class="path-divider flex-self-stretch">/</span>
/etc/suricata/classification.config: <strong itemprop="name" class="mr-2 flex-self-stretch">
/etc/suricata/classification.config: <ul class="pagehead-actions flex-shrink-0 " >
/etc/suricata/classification.config: <a class="tooltipped tooltipped-s btn btn-sm btn-with-count" aria-label="You must be signed in to watch a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"notification subscription menu watch","repository_id":null,"auth_type":"LOG_IN","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="f3c991b12dba0efb4b16a70c94a832f0534a86bbd4917ef087422b59a0769cab" href="/login?return_to=%2FOISF%2Fsuricata">
/etc/suricata/classification.config: <svg class="octicon octicon-eye v-align-text-bottom" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.06 2C3 2 0 8 0 8s3 6 8.06 6C13 14 16 8 16 8s-3-6-7.94-6zM8 12c-2.2 0-4-1.78-4-4 0-2.2 1.8-4 4-4 2.22 0 4 1.8 4 4 0 2.22-1.78 4-4 4zm2-4c0 1.11-.89 2-2 2-1.11 0-2-.89-2-2 0-1.11.89-2 2-2 1.11 0 2 .89 2 2z"/></svg>
/etc/suricata/classification.config:</a> <a class="social-count" href="/OISF/suricata/watchers"
/etc/suricata/classification.config: <a class="btn btn-sm btn-with-count tooltipped tooltipped-s" aria-label="You must be signed in to star a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"star button","repository_id":5410234,"auth_type":"LOG_IN","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="e9a7fd9791602c31d84b0637d1ef502a309e23b93351d09d38bb5c08bf673681" href="/login?return_to=%2FOISF%2Fsuricata">
/etc/suricata/classification.config: <svg height="16" class="octicon octicon-star v-align-text-bottom" vertical_align="text_bottom" viewBox="0 0 14 16" version="1.1" width="14" aria-hidden="true"><path fill-rule="evenodd" d="M14 6l-4.9-.64L7 1 4.9 5.36 0 6l3.6 3.26L2.67 14 7 11.67 11.33 14l-.93-4.74L14 6z"/></svg>
/etc/suricata/classification.config: <a class="social-count js-social-count" href="/OISF/suricata/stargazers"
/etc/suricata/classification.config: <a class="btn btn-sm btn-with-count tooltipped tooltipped-s" aria-label="You must be signed in to fork a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"repo details fork button","repository_id":5410234,"auth_type":"LOG_IN","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="71be2748aa6be232a32bb4395efa0e166e31935aeb6b312d910ceeffaca40453" href="/login?return_to=%2FOISF%2Fsuricata">
/etc/suricata/classification.config: <svg class="octicon octicon-repo-forked v-align-text-bottom" viewBox="0 0 10 16" version="1.1" width="10" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8 1a1.993 1.993 0 00-1 3.72V6L5 8 3 6V4.72A1.993 1.993 0 002 1a1.993 1.993 0 00-1 3.72V6.5l3 3v1.78A1.993 1.993 0 005 15a1.993 1.993 0 001-3.72V9.5l3-3V4.72A1.993 1.993 0 008 1zM2 4.2C1.34 4.2.8 3.65.8 3c0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2zm3 10c-.66 0-1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2zm3-10c-.66 0-1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2z"/></svg>
/etc/suricata/classification.config: <a href="/OISF/suricata/network/members" class="social-count"
/etc/suricata/classification.config:<nav class="hx_reponav reponav js-repo-nav js-sidenav-container-pjax clearfix container-lg p-responsive d-none d-lg-block"
/etc/suricata/classification.config: <a class="js-selected-navigation-item selected reponav-item" itemprop="url" data-hotkey="g c" aria-current="page" data-selected-links="repo_source repo_downloads repo_commits repo_releases repo_tags repo_branches repo_packages /OISF/suricata" href="/OISF/suricata">
/etc/suricata/classification.config: <div class="d-inline"><svg class="octicon octicon-code" viewBox="0 0 14 16" version="1.1" width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M9.5 3L8 4.5 11.5 8 8 11.5 9.5 13 14 8 9.5 3zm-5 0L0 8l4.5 5L6 11.5 2.5 8 6 4.5 4.5 3z"/></svg></div>
/etc/suricata/classification.config: <a data-hotkey="g p" data-skip-pjax="true" itemprop="url" class="js-selected-navigation-item reponav-item" data-selected-links="repo_pulls checks /OISF/suricata/pulls" href="/OISF/suricata/pulls">
/etc/suricata/classification.config: <div class="d-inline"><svg class="octicon octicon-git-pull-request" viewBox="0 0 12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M11 11.28V5c-.03-.78-.34-1.47-.94-2.06C9.46 2.35 8.78 2.03 8 2H7V0L4 3l3 3V4h1c.27.02.48.11.69.31.21.2.3.42.31.69v6.28A1.993 1.993 0 0010 15a1.993 1.993 0 001-3.72zm-1 2.92c-.66 0-1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2zM4 3c0-1.11-.89-2-2-2a1.993 1.993 0 00-1 3.72v6.56A1.993 1.993 0 002 15a1.993 1.993 0 001-3.72V4.72c.59-.34 1-.98 1-1.72zm-.8 10c0 .66-.55 1.2-1.2 1.2-.65 0-1.2-.55-1.2-1.2 0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2zM2 4.2C1.34 4.2.8 3.65.8 3c0-.65.55-1.2 1.2-1.2.65 0 1.2.55 1.2 1.2 0 .65-.55 1.2-1.2 1.2z"/></svg></div>
/etc/suricata/classification.config: <span class="Counter">64</span>
/etc/suricata/classification.config: <span itemscope itemtype="http://schema.org/ListItem" itemprop="itemListElement" class="position-relative float-left">
/etc/suricata/classification.config: <a data-hotkey="g w" data-skip-pjax="true" class="js-selected-navigation-item reponav-item" data-selected-links="repo_actions /OISF/suricata/actions" href="/OISF/suricata/actions">
/etc/suricata/classification.config: <div class="d-inline"><svg class="octicon octicon-play" viewBox="0 0 14 16" version="1.1" width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M14 8A7 7 0 110 8a7 7 0 0114 0zm-8.223 3.482l4.599-3.066a.5.5 0 000-.832L5.777 4.518A.5.5 0 005 4.934v6.132a.5.5 0 00.777.416z"/></svg></div>
/etc/suricata/classification.config: <a data-skip-pjax="true" class="js-selected-navigation-item reponav-item" data-selected-links="security alerts policy token_scanning code_scanning /OISF/suricata/security/advisories" href="/OISF/suricata/security/advisories">
/etc/suricata/classification.config: <div class="d-inline"><svg class="octicon octicon-shield" viewBox="0 0 14 16" version="1.1" width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M0 2l7-2 7 2v6.02C14 12.69 8.69 16 7 16c-1.69 0-7-3.31-7-7.98V2zm1 .75L7 1l6 1.75v5.268C13 12.104 8.449 15 7 15c-1.449 0-6-2.896-6-6.982V2.75zm1 .75L7 2v12c-1.207 0-5-2.482-5-5.985V3.5z"/></svg></div>
/etc/suricata/classification.config: <a class="js-selected-navigation-item reponav-item" data-selected-links="repo_graphs repo_contributors dependency_graph pulse people /OISF/suricata/pulse" href="/OISF/suricata/pulse">
/etc/suricata/classification.config: <div class="d-inline"><svg class="octicon octicon-graph" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M16 14v1H0V0h1v14h15zM5 13H3V8h2v5zm4 0H7V3h2v10zm4 0h-2V6h2v7z"/></svg></div>
/etc/suricata/classification.config: <div class="reponav-wrapper reponav-small d-lg-none">
/etc/suricata/classification.config: <nav class="reponav js-reponav text-center no-wrap"
/etc/suricata/classification.config: <a class="js-selected-navigation-item selected reponav-item" itemprop="url" aria-current="page" data-selected-links="repo_source repo_downloads repo_commits repo_releases repo_tags repo_branches repo_packages /OISF/suricata" href="/OISF/suricata">
/etc/suricata/classification.config: <a itemprop="url" class="js-selected-navigation-item reponav-item" data-selected-links="repo_pulls checks /OISF/suricata/pulls" href="/OISF/suricata/pulls">
/etc/suricata/classification.config: <span class="Counter">64</span>
/etc/suricata/classification.config: <a itemprop="url" class="js-selected-navigation-item reponav-item" data-selected-links="repo_actions /OISF/suricata/actions" href="/OISF/suricata/actions">
/etc/suricata/classification.config: <a itemprop="url" class="js-selected-navigation-item reponav-item" data-selected-links="security alerts policy token_scanning code_scanning /OISF/suricata/security/advisories" href="/OISF/suricata/security/advisories">
/etc/suricata/classification.config: <a class="js-selected-navigation-item reponav-item" data-selected-links="pulse /OISF/suricata/pulse" href="/OISF/suricata/pulse">
/etc/suricata/classification.config: <include-fragment class="js-notification-shelf-include-fragment" data-base-src="https://github.com/notifications/beta/shelf"></include-fragment>
/etc/suricata/classification.config:<div class="container-lg clearfix new-discussion-timeline p-responsive">
/etc/suricata/classification.config: <div class="repository-content ">
/etc/suricata/classification.config: <a class="d-none js-permalink-shortcut" data-hotkey="y" href="/OISF/suricata/blob/c5cee05169fd27a2f685a9224e067760e1ed6af3/etc/classification.config">Permalink</a>
/etc/suricata/classification.config: <div class="signup-prompt-bg rounded-1 js-signup-prompt" data-prompt="signup" hidden>
/etc/suricata/classification.config: <div class="signup-prompt p-4 text-center mb-4 rounded-1">
/etc/suricata/classification.config: <div class="position-relative">
/etc/suricata/classification.config: <button type="button" class="position-absolute top-0 right-0 btn-link link-gray js-signup-prompt-button" data-ga-click="(Logged out) Sign up prompt, clicked Dismiss, text:dismiss">
/etc/suricata/classification.config: <h3 class="pt-2">Join GitHub today</h3>
/etc/suricata/classification.config: <p class="col-6 mx-auto">GitHub is home to over 40 million developers working together to host and review code, manage projects, and build software together.</p>
/etc/suricata/classification.config: <a class="btn btn-primary" data-ga-click="(Logged out) Sign up prompt, clicked Sign up, text:sign-up" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"files signup prompt","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="feab0f845d3fe644b1d387f9234079cfb84f44b0d61888d6b37e21467211e174" href="/join?source=prompt-blob-show&source_repo=OISF%2Fsuricata">Sign up</a>
/etc/suricata/classification.config: <div class="d-flex flex-items-start flex-shrink-0 flex-column flex-md-row pb-3">
/etc/suricata/classification.config: <span class="d-flex flex-justify-between width-full width-md-auto">
/etc/suricata/classification.config:<details class="details-reset details-overlay branch-select-menu " id="branch-select-menu">
/etc/suricata/classification.config: <summary class="btn btn-sm css-truncate"
/etc/suricata/classification.config: <span class="css-truncate-target" data-menu-button>master</span>
/etc/suricata/classification.config: <span class="dropdown-caret"></span>
/etc/suricata/classification.config: <details-menu class="SelectMenu SelectMenu--hasFilter" src="/OISF/suricata/refs/master/etc/classification.config?source_action=show&source_controller=blob" preload>
/etc/suricata/classification.config: <div class="SelectMenu-modal">
/etc/suricata/classification.config: <include-fragment class="SelectMenu-loading" aria-label="Menu is loading">
/etc/suricata/classification.config: <svg class="octicon octicon-octoface anim-pulse" height="32" viewBox="0 0 16 16" version="1.1" width="32" aria-hidden="true"><path fill-rule="evenodd" d="M14.7 5.34c.13-.32.55-1.59-.13-3.31 0 0-1.05-.33-3.44 1.3-1-.28-2.07-.32-3.13-.32s-2.13.04-3.13.32c-2.39-1.64-3.44-1.3-3.44-1.3-.68 1.72-.26 2.99-.13 3.31C.49 6.21 0 7.33 0 8.69 0 13.84 3.33 15 7.98 15S16 13.84 16 8.69c0-1.36-.49-2.48-1.3-3.35zM8 14.02c-3.3 0-5.98-.15-5.98-3.35 0-.76.38-1.48 1.02-2.07 1.07-.98 2.9-.46 4.96-.46 2.07 0 3.88-.52 4.96.46.65.59 1.02 1.3 1.02 2.07 0 3.19-2.68 3.35-5.98 3.35zM5.49 9.01c-.66 0-1.2.8-1.2 1.78s.54 1.79 1.2 1.79c.66 0 1.2-.8 1.2-1.79s-.54-1.78-1.2-1.78zm5.02 0c-.66 0-1.2.79-1.2 1.78s.54 1.79 1.2 1.79c.66 0 1.2-.8 1.2-1.79s-.53-1.78-1.2-1.78z"/></svg>
/etc/suricata/classification.config: <div class="BtnGroup flex-shrink-0 d-md-none">
/etc/suricata/classification.config: class="js-pjax-capture-input btn btn-sm BtnGroup-item"
/etc/suricata/classification.config: <clipboard-copy value="etc/classification.config" class="btn btn-sm BtnGroup-item">
/etc/suricata/classification.config: <h2 id="blob-path" class="breadcrumb flex-auto min-width-0 text-normal flex-md-self-center ml-md-2 mr-md-3 my-2 my-md-0">
/etc/suricata/classification.config: <span class="js-repo-root text-bold"><span class="js-path-segment"><a data-pjax="true" href="/OISF/suricata"><span>suricata</span></a></span></span><span class="separator">/</span><span class="js-path-segment"><a data-pjax="true" href="/OISF/suricata/tree/master/etc"><span>etc</span></a></span><span class="separator">/</span><strong class="final-path">classification.config</strong>
/etc/suricata/classification.config: <div class="BtnGroup flex-shrink-0 d-none d-md-inline-block">
/etc/suricata/classification.config: class="js-pjax-capture-input btn btn-sm BtnGroup-item"
/etc/suricata/classification.config: <clipboard-copy value="etc/classification.config" class="btn btn-sm BtnGroup-item">
/etc/suricata/classification.config: <include-fragment src="/OISF/suricata/contributors/master/etc/classification.config" class="Box Box--condensed commit-loader">
/etc/suricata/classification.config: <div class="Box-body bg-blue-light f6">
/etc/suricata/classification.config: <div class="Box-body d-flex flex-items-center" >
/etc/suricata/classification.config: <img alt="" class="loader-loading mr-2" src="https://github.githubassets.com/images/spinners/octocat-spinner-32-EAF2F5.gif" width="16" height="16" />
/etc/suricata/classification.config: <span class="text-red h6 loader-error">Cannot retrieve contributors at this time</span>
/etc/suricata/classification.config: <div class="Box mt-3 position-relative
/etc/suricata/classification.config:<div class="Box-header py-2 d-flex flex-column flex-shrink-0 flex-md-row flex-md-items-center">
/etc/suricata/classification.config: <div class="text-mono f6 flex-auto pr-3 flex-order-2 flex-md-order-1 mt-2 mt-md-0">
/etc/suricata/classification.config: <include-fragment src="/OISF/suricata/codeowners/master/etc/classification.config"></include-fragment>
/etc/suricata/classification.config: <span class="file-info-divider"></span>
/etc/suricata/classification.config: <div class="d-flex py-1 py-md-0 flex-auto flex-order-1 flex-md-order-2 flex-sm-grow-0 flex-justify-between">
/etc/suricata/classification.config: <div class="BtnGroup">
/etc/suricata/classification.config: <a id="raw-url" class="btn btn-sm BtnGroup-item" href="/OISF/suricata/raw/master/etc/classification.config">Raw</a>
/etc/suricata/classification.config: <a class="btn btn-sm js-update-url-with-hash BtnGroup-item" data-hotkey="b" href="/OISF/suricata/blame/master/etc/classification.config">Blame</a>
/etc/suricata/classification.config: <a rel="nofollow" class="btn btn-sm BtnGroup-item" href="/OISF/suricata/commits/master/etc/classification.config">History</a>
/etc/suricata/classification.config: <a class="btn-octicon tooltipped tooltipped-nw js-remove-unless-platform"
/etc/suricata/classification.config: <svg class="octicon octicon-device-desktop" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M15 2H1c-.55 0-1 .45-1 1v9c0 .55.45 1 1 1h5.34c-.25.61-.86 1.39-2.34 2h8c-1.48-.61-2.09-1.39-2.34-2H15c.55 0 1-.45 1-1V3c0-.55-.45-1-1-1zm0 9H1V3h14v8z"/></svg>
/etc/suricata/classification.config: <button type="button" class="btn-octicon disabled tooltipped tooltipped-nw"
/etc/suricata/classification.config: <svg class="octicon octicon-pencil" viewBox="0 0 14 16" version="1.1" width="14" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M0 12v3h3l8-8-3-3-8 8zm3 2H1v-2h1v1h1v1zm10.3-9.3L12 6 9 3l1.3-1.3a.996.996 0 011.41 0l1.59 1.59c.39.39.39 1.02 0 1.41z"/></svg>
/etc/suricata/classification.config: <button type="button" class="btn-octicon btn-octicon-danger disabled tooltipped tooltipped-nw"
/etc/suricata/classification.config: <svg class="octicon octicon-trashcan" viewBox="0 0 12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M11 2H9c0-.55-.45-1-1-1H5c-.55 0-1 .45-1 1H2c-.55 0-1 .45-1 1v1c0 .55.45 1 1 1v9c0 .55.45 1 1 1h7c.55 0 1-.45 1-1V5c.55 0 1-.45 1-1V3c0-.55-.45-1-1-1zm-1 12H3V5h1v8h1V5h1v8h1V5h1v8h1V5h1v9zm1-10H2V3h9v1z"/></svg>
/etc/suricata/classification.config: <div itemprop="text" class="Box-body p-0 blob-wrapper data type-text ">
/etc/suricata/classification.config:<table class="highlight tab-size js-file-line-container" data-tab-size="8" data-paste-markdown-skip>
/etc/suricata/classification.config: <td id="L1" class="blob-num js-line-number" data-line-number="1"></td>
/etc/suricata/classification.config: <td id="LC1" class="blob-code blob-code-inner js-file-line"># $Id$</td>
/etc/suricata/classification.config: <td id="L2" class="blob-num js-line-number" data-line-number="2"></td>
/etc/suricata/classification.config: <td id="LC2" class="blob-code blob-code-inner js-file-line"># classification.config taken from Snort 2.8.5.3. Snort is governed by the GPLv2</td>
/etc/suricata/classification.config: <td id="L3" class="blob-num js-line-number" data-line-number="3"></td>
/etc/suricata/classification.config: <td id="LC3" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L4" class="blob-num js-line-number" data-line-number="4"></td>
/etc/suricata/classification.config: <td id="LC4" class="blob-code blob-code-inner js-file-line"># The following includes information for prioritizing rules</td>
/etc/suricata/classification.config: <td id="L5" class="blob-num js-line-number" data-line-number="5"></td>
/etc/suricata/classification.config: <td id="LC5" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L6" class="blob-num js-line-number" data-line-number="6"></td>
/etc/suricata/classification.config: <td id="LC6" class="blob-code blob-code-inner js-file-line"># Each classification includes a shortname, a description, and a default</td>
/etc/suricata/classification.config: <td id="L7" class="blob-num js-line-number" data-line-number="7"></td>
/etc/suricata/classification.config: <td id="LC7" class="blob-code blob-code-inner js-file-line"># priority for that classification.</td>
/etc/suricata/classification.config: <td id="L8" class="blob-num js-line-number" data-line-number="8"></td>
/etc/suricata/classification.config: <td id="LC8" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L9" class="blob-num js-line-number" data-line-number="9"></td>
/etc/suricata/classification.config: <td id="LC9" class="blob-code blob-code-inner js-file-line"># This allows alerts to be classified and prioritized. You can specify</td>
/etc/suricata/classification.config: <td id="L10" class="blob-num js-line-number" data-line-number="10"></td>
/etc/suricata/classification.config: <td id="LC10" class="blob-code blob-code-inner js-file-line"># what priority each classification has. Any rule can override the default</td>
/etc/suricata/classification.config: <td id="L11" class="blob-num js-line-number" data-line-number="11"></td>
/etc/suricata/classification.config: <td id="LC11" class="blob-code blob-code-inner js-file-line"># priority for that rule.</td>
/etc/suricata/classification.config: <td id="L12" class="blob-num js-line-number" data-line-number="12"></td>
/etc/suricata/classification.config: <td id="LC12" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L13" class="blob-num js-line-number" data-line-number="13"></td>
/etc/suricata/classification.config: <td id="LC13" class="blob-code blob-code-inner js-file-line"># Here are a few example rules:</td>
/etc/suricata/classification.config: <td id="L14" class="blob-num js-line-number" data-line-number="14"></td>
/etc/suricata/classification.config: <td id="LC14" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L15" class="blob-num js-line-number" data-line-number="15"></td>
/etc/suricata/classification.config: <td id="LC15" class="blob-code blob-code-inner js-file-line"># alert TCP any any > any 80 (msg: "EXPLOIT ntpdx overflow";</td>
/etc/suricata/classification.config: <td id="L16" class="blob-num js-line-number" data-line-number="16"></td>
/etc/suricata/classification.config: <td id="LC16" class="blob-code blob-code-inner js-file-line"># dsize: > 128; classtype:attempted-admin; priority:10;</td>
/etc/suricata/classification.config: <td id="L17" class="blob-num js-line-number" data-line-number="17"></td>
/etc/suricata/classification.config: <td id="LC17" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L18" class="blob-num js-line-number" data-line-number="18"></td>
/etc/suricata/classification.config: <td id="LC18" class="blob-code blob-code-inner js-file-line"># alert TCP any any -> any 25 (msg:"SMTP expn root"; flags:A+; \</td>
/etc/suricata/classification.config: <td id="L19" class="blob-num js-line-number" data-line-number="19"></td>
/etc/suricata/classification.config: <td id="LC19" class="blob-code blob-code-inner js-file-line"># content:"expn root"; nocase; classtype:attempted-recon;)</td>
/etc/suricata/classification.config: <td id="L20" class="blob-num js-line-number" data-line-number="20"></td>
/etc/suricata/classification.config: <td id="LC20" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L21" class="blob-num js-line-number" data-line-number="21"></td>
/etc/suricata/classification.config: <td id="LC21" class="blob-code blob-code-inner js-file-line"># The first rule will set its type to "attempted-admin" and override</td>
/etc/suricata/classification.config: <td id="L22" class="blob-num js-line-number" data-line-number="22"></td>
/etc/suricata/classification.config: <td id="LC22" class="blob-code blob-code-inner js-file-line"># the default priority for that type to 10.</td>
/etc/suricata/classification.config: <td id="L23" class="blob-num js-line-number" data-line-number="23"></td>
/etc/suricata/classification.config: <td id="LC23" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L24" class="blob-num js-line-number" data-line-number="24"></td>
/etc/suricata/classification.config: <td id="LC24" class="blob-code blob-code-inner js-file-line"># The second rule set its type to "attempted-recon" and set its</td>
/etc/suricata/classification.config: <td id="L25" class="blob-num js-line-number" data-line-number="25"></td>
/etc/suricata/classification.config: <td id="LC25" class="blob-code blob-code-inner js-file-line"># priority to the default for that type.</td>
/etc/suricata/classification.config: <td id="L26" class="blob-num js-line-number" data-line-number="26"></td>
/etc/suricata/classification.config: <td id="LC26" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L27" class="blob-num js-line-number" data-line-number="27"></td>
/etc/suricata/classification.config: <td id="LC27" class="blob-code blob-code-inner js-file-line">
/etc/suricata/classification.config: <td id="L28" class="blob-num js-line-number" data-line-number="28"></td>
/etc/suricata/classification.config: <td id="LC28" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L29" class="blob-num js-line-number" data-line-number="29"></td>
/etc/suricata/classification.config: <td id="LC29" class="blob-code blob-code-inner js-file-line"># config classification:shortname,short description,priority</td>
/etc/suricata/classification.config: <td id="L30" class="blob-num js-line-number" data-line-number="30"></td>
/etc/suricata/classification.config: <td id="LC30" class="blob-code blob-code-inner js-file-line">#</td>
/etc/suricata/classification.config: <td id="L31" class="blob-num js-line-number" data-line-number="31"></td>
/etc/suricata/classification.config: <td id="LC31" class="blob-code blob-code-inner js-file-line">
/etc/suricata/classification.config: <td id="L32" class="blob-num js-line-number" data-line-number="32"></td>
/etc/suricata/classification.config: <td id="LC32" class="blob-code blob-code-inner js-file-line">config classification: not-suspicious,Not Suspicious Traffic,3</td>
/etc/suricata/classification.config: <td id="L33" class="blob-num js-line-number" data-line-number="33"></td>
/etc/suricata/classification.config: <td id="LC33" class="blob-code blob-code-inner js-file-line">config classification: unknown,Unknown Traffic,3</td>
/etc/suricata/classification.config: <td id="L34" class="blob-num js-line-number" data-line-number="34"></td>
/etc/suricata/classification.config: <td id="LC34" class="blob-code blob-code-inner js-file-line">config classification: bad-unknown,Potentially Bad Traffic, 2</td>
/etc/suricata/classification.config: <td id="L35" class="blob-num js-line-number" data-line-number="35"></td>
/etc/suricata/classification.config: <td id="LC35" class="blob-code blob-code-inner js-file-line">config classification: attempted-recon,Attempted Information Leak,2</td>
/etc/suricata/classification.config: <td id="L36" class="blob-num js-line-number" data-line-number="36"></td>
/etc/suricata/classification.config: <td id="LC36" class="blob-code blob-code-inner js-file-line">config classification: successful-recon-limited,Information Leak,2</td>
/etc/suricata/classification.config: <td id="L37" class="blob-num js-line-number" data-line-number="37"></td>
/etc/suricata/classification.config: <td id="LC37" class="blob-code blob-code-inner js-file-line">config classification: successful-recon-largescale,Large Scale Information Leak,2</td>
/etc/suricata/classification.config: <td id="L38" class="blob-num js-line-number" data-line-number="38"></td>
/etc/suricata/classification.config: <td id="LC38" class="blob-code blob-code-inner js-file-line">config classification: attempted-dos,Attempted Denial of Service,2</td>
/etc/suricata/classification.config: <td id="L39" class="blob-num js-line-number" data-line-number="39"></td>
/etc/suricata/classification.config: <td id="LC39" class="blob-code blob-code-inner js-file-line">config classification: successful-dos,Denial of Service,2</td>
/etc/suricata/classification.config: <td id="L40" class="blob-num js-line-number" data-line-number="40"></td>
/etc/suricata/classification.config: <td id="LC40" class="blob-code blob-code-inner js-file-line">config classification: attempted-user,Attempted User Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="L41" class="blob-num js-line-number" data-line-number="41"></td>
/etc/suricata/classification.config: <td id="LC41" class="blob-code blob-code-inner js-file-line">config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="L42" class="blob-num js-line-number" data-line-number="42"></td>
/etc/suricata/classification.config: <td id="LC42" class="blob-code blob-code-inner js-file-line">config classification: successful-user,Successful User Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="L43" class="blob-num js-line-number" data-line-number="43"></td>
/etc/suricata/classification.config: <td id="LC43" class="blob-code blob-code-inner js-file-line">config classification: attempted-admin,Attempted Administrator Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="L44" class="blob-num js-line-number" data-line-number="44"></td>
/etc/suricata/classification.config: <td id="LC44" class="blob-code blob-code-inner js-file-line">config classification: successful-admin,Successful Administrator Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="L45" class="blob-num js-line-number" data-line-number="45"></td>
/etc/suricata/classification.config: <td id="LC45" class="blob-code blob-code-inner js-file-line">
/etc/suricata/classification.config: <td id="L46" class="blob-num js-line-number" data-line-number="46"></td>
/etc/suricata/classification.config: <td id="LC46" class="blob-code blob-code-inner js-file-line"># NEW CLASSIFICATIONS</td>
/etc/suricata/classification.config: <td id="L47" class="blob-num js-line-number" data-line-number="47"></td>
/etc/suricata/classification.config: <td id="LC47" class="blob-code blob-code-inner js-file-line">config classification: rpc-portmap-decode,Decode of an RPC Query,2</td>
/etc/suricata/classification.config: <td id="L48" class="blob-num js-line-number" data-line-number="48"></td>
/etc/suricata/classification.config: <td id="LC48" class="blob-code blob-code-inner js-file-line">config classification: shellcode-detect,Executable code was detected,1</td>
/etc/suricata/classification.config: <td id="L49" class="blob-num js-line-number" data-line-number="49"></td>
/etc/suricata/classification.config: <td id="LC49" class="blob-code blob-code-inner js-file-line">config classification: string-detect,A suspicious string was detected,3</td>
/etc/suricata/classification.config: <td id="L50" class="blob-num js-line-number" data-line-number="50"></td>
/etc/suricata/classification.config: <td id="LC50" class="blob-code blob-code-inner js-file-line">config classification: suspicious-filename-detect,A suspicious filename was detected,2</td>
/etc/suricata/classification.config: <td id="L51" class="blob-num js-line-number" data-line-number="51"></td>
/etc/suricata/classification.config: <td id="LC51" class="blob-code blob-code-inner js-file-line">config classification: suspicious-login,An attempted login using a suspicious username was detected,2</td>
/etc/suricata/classification.config: <td id="L52" class="blob-num js-line-number" data-line-number="52"></td>
/etc/suricata/classification.config: <td id="LC52" class="blob-code blob-code-inner js-file-line">config classification: system-call-detect,A system call was detected,2</td>
/etc/suricata/classification.config: <td id="L53" class="blob-num js-line-number" data-line-number="53"></td>
/etc/suricata/classification.config: <td id="LC53" class="blob-code blob-code-inner js-file-line">config classification: tcp-connection,A TCP connection was detected,4</td>
/etc/suricata/classification.config: <td id="L54" class="blob-num js-line-number" data-line-number="54"></td>
/etc/suricata/classification.config: <td id="LC54" class="blob-code blob-code-inner js-file-line">config classification: trojan-activity,A Network Trojan was detected, 1</td>
/etc/suricata/classification.config: <td id="L55" class="blob-num js-line-number" data-line-number="55"></td>
/etc/suricata/classification.config: <td id="LC55" class="blob-code blob-code-inner js-file-line">config classification: unusual-client-port-connection,A client was using an unusual port,2</td>
/etc/suricata/classification.config: <td id="L56" class="blob-num js-line-number" data-line-number="56"></td>
/etc/suricata/classification.config: <td id="LC56" class="blob-code blob-code-inner js-file-line">config classification: network-scan,Detection of a Network Scan,3</td>
/etc/suricata/classification.config: <td id="L57" class="blob-num js-line-number" data-line-number="57"></td>
/etc/suricata/classification.config: <td id="LC57" class="blob-code blob-code-inner js-file-line">config classification: denial-of-service,Detection of a Denial of Service Attack,2</td>
/etc/suricata/classification.config: <td id="L58" class="blob-num js-line-number" data-line-number="58"></td>
/etc/suricata/classification.config: <td id="LC58" class="blob-code blob-code-inner js-file-line">config classification: non-standard-protocol,Detection of a non-standard protocol or event,2</td>
/etc/suricata/classification.config: <td id="L59" class="blob-num js-line-number" data-line-number="59"></td>
/etc/suricata/classification.config: <td id="LC59" class="blob-code blob-code-inner js-file-line">config classification: protocol-command-decode,Generic Protocol Command Decode,3</td>
/etc/suricata/classification.config: <td id="L60" class="blob-num js-line-number" data-line-number="60"></td>
/etc/suricata/classification.config: <td id="LC60" class="blob-code blob-code-inner js-file-line">config classification: web-application-activity,access to a potentially vulnerable web application,2</td>
/etc/suricata/classification.config: <td id="L61" class="blob-num js-line-number" data-line-number="61"></td>
/etc/suricata/classification.config: <td id="LC61" class="blob-code blob-code-inner js-file-line">config classification: web-application-attack,Web Application Attack,1</td>
/etc/suricata/classification.config: <td id="L62" class="blob-num js-line-number" data-line-number="62"></td>
/etc/suricata/classification.config: <td id="LC62" class="blob-code blob-code-inner js-file-line">config classification: misc-activity,Misc activity,3</td>
/etc/suricata/classification.config: <td id="L63" class="blob-num js-line-number" data-line-number="63"></td>
/etc/suricata/classification.config: <td id="LC63" class="blob-code blob-code-inner js-file-line">config classification: misc-attack,Misc Attack,2</td>
/etc/suricata/classification.config: <td id="L64" class="blob-num js-line-number" data-line-number="64"></td>
/etc/suricata/classification.config: <td id="LC64" class="blob-code blob-code-inner js-file-line">config classification: icmp-event,Generic ICMP event,3</td>
/etc/suricata/classification.config: <td id="L65" class="blob-num js-line-number" data-line-number="65"></td>
/etc/suricata/classification.config: <td id="LC65" class="blob-code blob-code-inner js-file-line">config classification: kickass-porn,SCORE! Get the lotion!,1</td>
/etc/suricata/classification.config: <td id="L66" class="blob-num js-line-number" data-line-number="66"></td>
/etc/suricata/classification.config: <td id="LC66" class="blob-code blob-code-inner js-file-line">config classification: policy-violation,Potential Corporate Privacy Violation,1</td>
/etc/suricata/classification.config: <td id="L67" class="blob-num js-line-number" data-line-number="67"></td>
/etc/suricata/classification.config: <td id="LC67" class="blob-code blob-code-inner js-file-line">config classification: default-login-attempt,Attempt to login by a default username and password,2</td>
/etc/suricata/classification.config: <td id="L68" class="blob-num js-line-number" data-line-number="68"></td>
/etc/suricata/classification.config: <td id="LC68" class="blob-code blob-code-inner js-file-line">
/etc/suricata/classification.config: <td id="L69" class="blob-num js-line-number" data-line-number="69"></td>
/etc/suricata/classification.config: <td id="LC69" class="blob-code blob-code-inner js-file-line"># Update</td>
/etc/suricata/classification.config: <td id="L70" class="blob-num js-line-number" data-line-number="70"></td>
/etc/suricata/classification.config: <td id="LC70" class="blob-code blob-code-inner js-file-line">config classification: targeted-activity,Targeted Malicious Activity was Detected,1</td>
/etc/suricata/classification.config: <td id="L71" class="blob-num js-line-number" data-line-number="71"></td>
/etc/suricata/classification.config: <td id="LC71" class="blob-code blob-code-inner js-file-line">config classification: exploit-kit,Exploit Kit Activity Detected,1</td>
/etc/suricata/classification.config: <td id="L72" class="blob-num js-line-number" data-line-number="72"></td>
/etc/suricata/classification.config: <td id="LC72" class="blob-code blob-code-inner js-file-line">config classification: external-ip-check,Device Retrieving External IP Address Detected,2</td>
/etc/suricata/classification.config: <td id="L73" class="blob-num js-line-number" data-line-number="73"></td>
/etc/suricata/classification.config: <td id="LC73" class="blob-code blob-code-inner js-file-line">config classification: domain-c2,Domain Observed Used for C2 Detected,1</td>
/etc/suricata/classification.config: <td id="L74" class="blob-num js-line-number" data-line-number="74"></td>
/etc/suricata/classification.config: <td id="LC74" class="blob-code blob-code-inner js-file-line">config classification: pup-activity,Possibly Unwanted Program Detected,2</td>
/etc/suricata/classification.config: <td id="L75" class="blob-num js-line-number" data-line-number="75"></td>
/etc/suricata/classification.config: <td id="LC75" class="blob-code blob-code-inner js-file-line">config classification: credential-theft,Successful Credential Theft Detected,1</td>
/etc/suricata/classification.config: <td id="L76" class="blob-num js-line-number" data-line-number="76"></td>
/etc/suricata/classification.config: <td id="LC76" class="blob-code blob-code-inner js-file-line">config classification: social-engineering,Possible Social Engineering Attempted,2</td>
/etc/suricata/classification.config: <td id="L77" class="blob-num js-line-number" data-line-number="77"></td>
/etc/suricata/classification.config: <td id="LC77" class="blob-code blob-code-inner js-file-line">config classification: coin-mining,Crypto Currency Mining Activity Detected,2</td>
/etc/suricata/classification.config: <td id="L78" class="blob-num js-line-number" data-line-number="78"></td>
/etc/suricata/classification.config: <td id="LC78" class="blob-code blob-code-inner js-file-line">config classification: command-and-control,Malware Command and Control Activity Detected,1</td>
/etc/suricata/classification.config: <details class="details-reset details-overlay BlobToolbar position-absolute js-file-line-actions dropdown d-none" aria-hidden="true">
/etc/suricata/classification.config: <summary class="btn-octicon ml-0 px-2 p-0 bg-white border border-gray-dark rounded-1" aria-label="Inline file action toolbar">
/etc/suricata/classification.config: <svg class="octicon octicon-kebab-horizontal" viewBox="0 0 13 16" version="1.1" width="13" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M1.5 9a1.5 1.5 0 100-3 1.5 1.5 0 000 3zm5 0a1.5 1.5 0 100-3 1.5 1.5 0 000 3zM13 7.5a1.5 1.5 0 11-3 0 1.5 1.5 0 013 0z"/></svg>
/etc/suricata/classification.config: <ul class="BlobToolbar-dropdown dropdown-menu dropdown-menu-se mt-2" style="width:185px">
/etc/suricata/classification.config: <clipboard-copy role="menuitem" class="dropdown-item" id="js-copy-lines" style="cursor:pointer;">
/etc/suricata/classification.config: <clipboard-copy role="menuitem" class="dropdown-item" id="js-copy-permalink" style="cursor:pointer;">
/etc/suricata/classification.config: <li><a class="dropdown-item js-update-url-with-hash" id="js-view-git-blame" role="menuitem" href="/OISF/suricata/blame/c5cee05169fd27a2f685a9224e067760e1ed6af3/etc/classification.config">View git blame</a></li>
/etc/suricata/classification.config: <details class="details-reset details-overlay details-overlay-dark">
/etc/suricata/classification.config: <details-dialog class="Box Box--overlay d-flex flex-column anim-fade-in fast linejump" aria-label="Jump to line">
/etc/suricata/classification.config: </option></form><form class="js-jump-to-line-form Box-body d-flex" action="" accept-charset="UTF-8" method="get">
/etc/suricata/classification.config: <input class="form-control flex-auto mr-3 linejump-input js-jump-to-line-field" type="text" placeholder="Jump to line…" aria-label="Jump to line" autofocus>
/etc/suricata/classification.config: <button type="submit" class="btn" data-close-dialog>Go</button>
/etc/suricata/classification.config:<div class="footer container-lg width-full p-responsive" role="contentinfo">
/etc/suricata/classification.config: <div class="position-relative d-flex flex-row-reverse flex-lg-row flex-wrap flex-lg-nowrap flex-justify-center flex-lg-justify-between pt-6 pb-2 mt-6 f6 text-gray border-top border-gray-light ">
/etc/suricata/classification.config: <ul class="list-style-none d-flex flex-wrap col-12 col-lg-5 flex-justify-center flex-lg-justify-between mb-2 mb-lg-0">
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0">© 2020 GitHub, Inc.</li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to terms, text:terms" href="https://github.com/site/terms">Terms</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to privacy, text:privacy" href="https://github.com/site/privacy">Privacy</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to security, text:security" href="https://github.com/security">Security</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a href="https://githubstatus.com/" data-ga-click="Footer, go to status, text:status">Status</a></li>
/etc/suricata/classification.config: <a aria-label="Homepage" title="GitHub" class="footer-octicon d-none d-lg-block mx-lg-4" href="https://github.com">
/etc/suricata/classification.config: <svg height="24" class="octicon octicon-mark-github" viewBox="0 0 16 16" version="1.1" width="24" aria-hidden="true"><path fill-rule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z"/></svg>
/etc/suricata/classification.config: <ul class="list-style-none d-flex flex-wrap col-12 col-lg-5 flex-justify-center flex-lg-justify-between mb-2 mb-lg-0">
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a data-ga-click="Footer, go to contact, text:contact" href="https://github.com/contact">Contact GitHub</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a href="https://github.com/pricing" data-ga-click="Footer, go to Pricing, text:Pricing">Pricing</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a href="https://developer.github.com" data-ga-click="Footer, go to api, text:api">API</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a href="https://training.github.com" data-ga-click="Footer, go to training, text:training">Training</a></li>
/etc/suricata/classification.config: <li class="mr-3 mr-lg-0"><a href="https://github.blog" data-ga-click="Footer, go to blog, text:blog">Blog</a></li>
/etc/suricata/classification.config: <div class="d-flex flex-justify-center pb-6">
/etc/suricata/classification.config: <span class="f6 text-gray-light"></span>
/etc/suricata/classification.config: <div id="ajax-error-message" class="ajax-error-message flash flash-error">
/etc/suricata/classification.config: <svg class="octicon octicon-alert" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 000 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 00.01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"/></svg>
/etc/suricata/classification.config: <button type="button" class="flash-close js-ajax-error-dismiss" aria-label="Dismiss error">
/etc/suricata/classification.config: <svg class="octicon octicon-x" viewBox="0 0 12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M7.48 8l3.75 3.75-1.48 1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48 1.48L7.48 8z"/></svg>
/etc/suricata/classification.config: <div class="js-stale-session-flash flash flash-warn flash-banner" hidden
/etc/suricata/classification.config: <svg class="octicon octicon-alert" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M8.893 1.5c-.183-.31-.52-.5-.887-.5s-.703.19-.886.5L.138 13.499a.98.98 0 000 1.001c.193.31.53.501.886.501h13.964c.367 0 .704-.19.877-.5a1.03 1.03 0 00.01-1.002L8.893 1.5zm.133 11.497H6.987v-2.003h2.039v2.003zm0-3.004H6.987V5.987h2.039v4.006z"/></svg>
/etc/suricata/classification.config: <span class="js-stale-session-flash-signed-in" hidden>You signed in with another tab or window. <a href="">Reload</a> to refresh your session.</span>
/etc/suricata/classification.config: <span class="js-stale-session-flash-signed-out" hidden>You signed out in another tab or window. <a href="">Reload</a> to refresh your session.</span>
/etc/suricata/classification.config: <details class="details-reset details-overlay details-overlay-dark lh-default text-gray-dark hx_rsm" open>
/etc/suricata/classification.config: <details-dialog class="Box Box--overlay d-flex flex-column anim-fade-in fast hx_rsm-dialog hx_rsm-modal">
/etc/suricata/classification.config: <button class="Box-btn-octicon m-0 btn-octicon position-absolute right-0 top-0" type="button" aria-label="Close dialog" data-close-dialog>
/etc/suricata/classification.config: <svg class="octicon octicon-x" viewBox="0 0 12 16" version="1.1" width="12" height="16" aria-hidden="true"><path fill-rule="evenodd" d="M7.48 8l3.75 3.75-1.48 1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48 1.48L7.48 8z"/></svg>
/etc/suricata/classification.config: <div class="octocat-spinner my-6 js-details-dialog-spinner"></div>
/etc/suricata/classification.config: <div class="Popover js-hovercard-content position-absolute" style="display: none; outline: none;" tabindex="0">
/etc/suricata/classification.config: <div class="Popover-message Popover-message--bottom-left Popover-message--large Box box-shadow-large" style="width:360px;">
/etc/suricata/classification.config: <div aria-live="polite" class="js-global-screen-reader-notice sr-only"></div>

Actions

Copy link

#17

Updated by Peter Manev about 5 years ago

If you could just share

suricata --dump-config | grep classification

This would not work

suricata --dump-config | grep class classification-file = /etc/suricata/classification.config

Actions

Copy link

#18

Updated by leonardo kasper about 5 years ago

suricata --dump-config | grep classification

classification-file = /etc/suricata/classification.config

suricata --dump-config | grep classification classification = /etc/suricata/classification.config

/etc/suricata/classification.config: <title>suricata/classification.config at master · OISF/suricata · GitHub</title>
/etc/suricata/classification.config: <link rel="canonical" href="https://github.com/OISF/suricata/blob/master/etc/classification.config" data-pjax-transient>
/etc/suricata/classification.config: data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config","user_id":null}}" data-hydro-click-hmac="3d0f744b60a8ed3a9f948749e93dd5e56e58284ca8c31c50f22e358ab1e6c2e9"
/etc/suricata/classification.config: <a href="/login?return_to=%2FOISF%2Fsuricata%2Fblob%2Fmaster%2Fetc%2Fclassification.config"
/etc/suricata/classification.config: data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header menu","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config","user_id":null}}" data-hydro-click-hmac="c6b11c1346acff4e8bdc8aed7e762ac4536e9f8cae538e875765f34e92ac38ba"
/etc/suricata/classification.config: data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"site header menu","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config","user_id":null}}" data-hydro-click-hmac="c6b11c1346acff4e8bdc8aed7e762ac4536e9f8cae538e875765f34e92ac38ba"
/etc/suricata/classification.config: <a class="tooltipped tooltipped-s btn btn-sm btn-with-count" aria-label="You must be signed in to watch a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"notification subscription menu watch","repository_id":null,"auth_type":"LOG_IN","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="f3c991b12dba0efb4b16a70c94a832f0534a86bbd4917ef087422b59a0769cab" href="/login?return_to=%2FOISF%2Fsuricata">
/etc/suricata/classification.config: <a class="btn btn-sm btn-with-count tooltipped tooltipped-s" aria-label="You must be signed in to star a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"star button","repository_id":5410234,"auth_type":"LOG_IN","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="e9a7fd9791602c31d84b0637d1ef502a309e23b93351d09d38bb5c08bf673681" href="/login?return_to=%2FOISF%2Fsuricata">
/etc/suricata/classification.config: <a class="btn btn-sm btn-with-count tooltipped tooltipped-s" aria-label="You must be signed in to fork a repository" rel="nofollow" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"repo details fork button","repository_id":5410234,"auth_type":"LOG_IN","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="71be2748aa6be232a32bb4395efa0e166e31935aeb6b312d910ceeffaca40453" href="/login?return_to=%2FOISF%2Fsuricata">
/etc/suricata/classification.config: <a class="d-none js-permalink-shortcut" data-hotkey="y" href="/OISF/suricata/blob/c5cee05169fd27a2f685a9224e067760e1ed6af3/etc/classification.config">Permalink</a>
/etc/suricata/classification.config: <a class="btn btn-primary" data-ga-click="(Logged out) Sign up prompt, clicked Sign up, text:sign-up" data-hydro-click="{"event_type":"authentication.click","payload":{"location_in_page":"files signup prompt","repository_id":null,"auth_type":"SIGN_UP","originating_url":"https://github.com/OISF/suricata/blob/master/etc/classification.config&quot;,&quot;user_id&quot;:null}}" data-hydro-click-hmac="feab0f845d3fe644b1d387f9234079cfb84f44b0d61888d6b37e21467211e174" href="/join?source=prompt-blob-show&source_repo=OISF%2Fsuricata">Sign up</a>
/etc/suricata/classification.config: <details-menu class="SelectMenu SelectMenu--hasFilter" src="/OISF/suricata/refs/master/etc/classification.config?source_action=show&source_controller=blob" preload>
/etc/suricata/classification.config: <clipboard-copy value="etc/classification.config" class="btn btn-sm BtnGroup-item">
/etc/suricata/classification.config: <span class="js-repo-root text-bold"><span class="js-path-segment"><a data-pjax="true" href="/OISF/suricata"><span>suricata</span></a></span></span><span class="separator">/</span><span class="js-path-segment"><a data-pjax="true" href="/OISF/suricata/tree/master/etc"><span>etc</span></a></span><span class="separator">/</span><strong class="final-path">classification.config</strong>
/etc/suricata/classification.config: <clipboard-copy value="etc/classification.config" class="btn btn-sm BtnGroup-item">
/etc/suricata/classification.config: <include-fragment src="/OISF/suricata/contributors/master/etc/classification.config" class="Box Box--condensed commit-loader">
/etc/suricata/classification.config: <include-fragment src="/OISF/suricata/codeowners/master/etc/classification.config"></include-fragment>
/etc/suricata/classification.config: <a id="raw-url" class="btn btn-sm BtnGroup-item" href="/OISF/suricata/raw/master/etc/classification.config">Raw</a>
/etc/suricata/classification.config: <a class="btn btn-sm js-update-url-with-hash BtnGroup-item" data-hotkey="b" href="/OISF/suricata/blame/master/etc/classification.config">Blame</a>
/etc/suricata/classification.config: <a rel="nofollow" class="btn btn-sm BtnGroup-item" href="/OISF/suricata/commits/master/etc/classification.config">History</a>
/etc/suricata/classification.config: <td id="LC2" class="blob-code blob-code-inner js-file-line"># classification.config taken from Snort 2.8.5.3. Snort is governed by the GPLv2</td>
/etc/suricata/classification.config: <td id="LC6" class="blob-code blob-code-inner js-file-line"># Each classification includes a shortname, a description, and a default</td>
/etc/suricata/classification.config: <td id="LC7" class="blob-code blob-code-inner js-file-line"># priority for that classification.</td>
/etc/suricata/classification.config: <td id="LC10" class="blob-code blob-code-inner js-file-line"># what priority each classification has. Any rule can override the default</td>
/etc/suricata/classification.config: <td id="LC29" class="blob-code blob-code-inner js-file-line"># config classification:shortname,short description,priority</td>
/etc/suricata/classification.config: <td id="LC32" class="blob-code blob-code-inner js-file-line">config classification: not-suspicious,Not Suspicious Traffic,3</td>
/etc/suricata/classification.config: <td id="LC33" class="blob-code blob-code-inner js-file-line">config classification: unknown,Unknown Traffic,3</td>
/etc/suricata/classification.config: <td id="LC34" class="blob-code blob-code-inner js-file-line">config classification: bad-unknown,Potentially Bad Traffic, 2</td>
/etc/suricata/classification.config: <td id="LC35" class="blob-code blob-code-inner js-file-line">config classification: attempted-recon,Attempted Information Leak,2</td>
/etc/suricata/classification.config: <td id="LC36" class="blob-code blob-code-inner js-file-line">config classification: successful-recon-limited,Information Leak,2</td>
/etc/suricata/classification.config: <td id="LC37" class="blob-code blob-code-inner js-file-line">config classification: successful-recon-largescale,Large Scale Information Leak,2</td>
/etc/suricata/classification.config: <td id="LC38" class="blob-code blob-code-inner js-file-line">config classification: attempted-dos,Attempted Denial of Service,2</td>
/etc/suricata/classification.config: <td id="LC39" class="blob-code blob-code-inner js-file-line">config classification: successful-dos,Denial of Service,2</td>
/etc/suricata/classification.config: <td id="LC40" class="blob-code blob-code-inner js-file-line">config classification: attempted-user,Attempted User Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="LC41" class="blob-code blob-code-inner js-file-line">config classification: unsuccessful-user,Unsuccessful User Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="LC42" class="blob-code blob-code-inner js-file-line">config classification: successful-user,Successful User Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="LC43" class="blob-code blob-code-inner js-file-line">config classification: attempted-admin,Attempted Administrator Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="LC44" class="blob-code blob-code-inner js-file-line">config classification: successful-admin,Successful Administrator Privilege Gain,1</td>
/etc/suricata/classification.config: <td id="LC47" class="blob-code blob-code-inner js-file-line">config classification: rpc-portmap-decode,Decode of an RPC Query,2</td>
/etc/suricata/classification.config: <td id="LC48" class="blob-code blob-code-inner js-file-line">config classification: shellcode-detect,Executable code was detected,1</td>
/etc/suricata/classification.config: <td id="LC49" class="blob-code blob-code-inner js-file-line">config classification: string-detect,A suspicious string was detected,3</td>
/etc/suricata/classification.config: <td id="LC50" class="blob-code blob-code-inner js-file-line">config classification: suspicious-filename-detect,A suspicious filename was detected,2</td>
/etc/suricata/classification.config: <td id="LC51" class="blob-code blob-code-inner js-file-line">config classification: suspicious-login,An attempted login using a suspicious username was detected,2</td>
/etc/suricata/classification.config: <td id="LC52" class="blob-code blob-code-inner js-file-line">config classification: system-call-detect,A system call was detected,2</td>
/etc/suricata/classification.config: <td id="LC53" class="blob-code blob-code-inner js-file-line">config classification: tcp-connection,A TCP connection was detected,4</td>
/etc/suricata/classification.config: <td id="LC54" class="blob-code blob-code-inner js-file-line">config classification: trojan-activity,A Network Trojan was detected, 1</td>
/etc/suricata/classification.config: <td id="LC55" class="blob-code blob-code-inner js-file-line">config classification: unusual-client-port-connection,A client was using an unusual port,2</td>
/etc/suricata/classification.config: <td id="LC56" class="blob-code blob-code-inner js-file-line">config classification: network-scan,Detection of a Network Scan,3</td>
/etc/suricata/classification.config: <td id="LC57" class="blob-code blob-code-inner js-file-line">config classification: denial-of-service,Detection of a Denial of Service Attack,2</td>
/etc/suricata/classification.config: <td id="LC58" class="blob-code blob-code-inner js-file-line">config classification: non-standard-protocol,Detection of a non-standard protocol or event,2</td>
/etc/suricata/classification.config: <td id="LC59" class="blob-code blob-code-inner js-file-line">config classification: protocol-command-decode,Generic Protocol Command Decode,3</td>
/etc/suricata/classification.config: <td id="LC60" class="blob-code blob-code-inner js-file-line">config classification: web-application-activity,access to a potentially vulnerable web application,2</td>
/etc/suricata/classification.config: <td id="LC61" class="blob-code blob-code-inner js-file-line">config classification: web-application-attack,Web Application Attack,1</td>
/etc/suricata/classification.config: <td id="LC62" class="blob-code blob-code-inner js-file-line">config classification: misc-activity,Misc activity,3</td>
/etc/suricata/classification.config: <td id="LC63" class="blob-code blob-code-inner js-file-line">config classification: misc-attack,Misc Attack,2</td>
/etc/suricata/classification.config: <td id="LC64" class="blob-code blob-code-inner js-file-line">config classification: icmp-event,Generic ICMP event,3</td>
/etc/suricata/classification.config: <td id="LC65" class="blob-code blob-code-inner js-file-line">config classification: kickass-porn,SCORE! Get the lotion!,1</td>
/etc/suricata/classification.config: <td id="LC66" class="blob-code blob-code-inner js-file-line">config classification: policy-violation,Potential Corporate Privacy Violation,1</td>
/etc/suricata/classification.config: <td id="LC67" class="blob-code blob-code-inner js-file-line">config classification: default-login-attempt,Attempt to login by a default username and password,2</td>
/etc/suricata/classification.config: <td id="LC70" class="blob-code blob-code-inner js-file-line">config classification: targeted-activity,Targeted Malicious Activity was Detected,1</td>
/etc/suricata/classification.config: <td id="LC71" class="blob-code blob-code-inner js-file-line">config classification: exploit-kit,Exploit Kit Activity Detected,1</td>
/etc/suricata/classification.config: <td id="LC72" class="blob-code blob-code-inner js-file-line">config classification: external-ip-check,Device Retrieving External IP Address Detected,2</td>
/etc/suricata/classification.config: <td id="LC73" class="blob-code blob-code-inner js-file-line">config classification: domain-c2,Domain Observed Used for C2 Detected,1</td>
/etc/suricata/classification.config: <td id="LC74" class="blob-code blob-code-inner js-file-line">config classification: pup-activity,Possibly Unwanted Program Detected,2</td>
/etc/suricata/classification.config: <td id="LC75" class="blob-code blob-code-inner js-file-line">config classification: credential-theft,Successful Credential Theft Detected,1</td>
/etc/suricata/classification.config: <td id="LC76" class="blob-code blob-code-inner js-file-line">config classification: social-engineering,Possible Social Engineering Attempted,2</td>
/etc/suricata/classification.config: <td id="LC77" class="blob-code blob-code-inner js-file-line">config classification: coin-mining,Crypto Currency Mining Activity Detected,2</td>
/etc/suricata/classification.config: <td id="LC78" class="blob-code blob-code-inner js-file-line">config classification: command-and-control,Malware Command and Control Activity Detected,1</td>
/etc/suricata/classification.config: <li><a class="dropdown-item js-update-url-with-hash" id="js-view-git-blame" role="menuitem" href="/OISF/suricata/blame/c5cee05169fd27a2f685a9224e067760e1ed6af3/etc/classification.config">View git blame</a></li>