Project

General

Profile

Actions

Feature #3494

open

rules: Keyword for determining if the http_host is an ip address

Added by Jason Williams over 1 year ago. Updated 10 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

In the ET ruleset in order to express the fact that http communications are going to an IP address rather than a hostname we have to do pcre.

Some variation of this is all over the place, often not properly using the http_host buffer:

pcre:"/^?:\d{1,3}\.){3}.\d{1,3}(?:\x3a\d{1,5})?$/W";

If it wouldn't be too taxing, it would be very useful to have a simple statement to express that the hostname in the http_header is an ip address. I don't know that a transform is the right place for it as we're not looking to do anything with the ip, but something like below:

http.host; is_ip;

Related issues

Related to Task #4097: Suricon 2020 brainstormNewVictor JulienActions
Actions #1

Updated by Jason Williams over 1 year ago

I typo'd the pcre from memory, but you know what i mean...

pcre:"/^(?:\d{1,3}\.){3}\d{1,3}(?:\x3a\d{1,5})?$/W";

Actions #2

Updated by Jeff Lucovsky 11 months ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #3

Updated by Victor Julien 10 months ago

  • Subject changed from Keyword for determining if the http_host is an ip address to rules: Keyword for determining if the http_host is an ip address
Actions

Also available in: Atom PDF