rules: Keyword for determining if the http_host is an ip address
In the ET ruleset in order to express the fact that http communications are going to an IP address rather than a hostname we have to do pcre.
Some variation of this is all over the place, often not properly using the http_host buffer:
If it wouldn't be too taxing, it would be very useful to have a simple statement to express that the hostname in the http_header is an ip address. I don't know that a transform is the right place for it as we're not looking to do anything with the ip, but something like below: