Actions
Feature #3494
open
JW
OD
rules: Keyword for determining if the http_host is an ip address
Feature #3494:
rules: Keyword for determining if the http_host is an ip address
Description
In the ET ruleset in order to express the fact that http communications are going to an IP address rather than a hostname we have to do pcre.
Some variation of this is all over the place, often not properly using the http_host buffer:
pcre:"/^?:\d{1,3}\.){3}.\d{1,3}(?:\x3a\d{1,5})?$/W";If it wouldn't be too taxing, it would be very useful to have a simple statement to express that the hostname in the http_header is an ip address. I don't know that a transform is the right place for it as we're not looking to do anything with the ip, but something like below:
http.host; is_ip;
Actions