Project

General

Profile

Actions

Feature #3494

open

rules: Keyword for determining if the http_host is an ip address

Added by Jason Williams about 4 years ago. Updated 14 days ago.

Status:
New
Priority:
Normal
Assignee:
-
Target version:
-
Effort:
Difficulty:
Label:

Description

In the ET ruleset in order to express the fact that http communications are going to an IP address rather than a hostname we have to do pcre.

Some variation of this is all over the place, often not properly using the http_host buffer:

pcre:"/^?:\d{1,3}\.){3}.\d{1,3}(?:\x3a\d{1,5})?$/W";

If it wouldn't be too taxing, it would be very useful to have a simple statement to express that the hostname in the http_header is an ip address. I don't know that a transform is the right place for it as we're not looking to do anything with the ip, but something like below:

http.host; is_ip;

Related issues 1 (1 open0 closed)

Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Actions

Also available in: Atom PDF