Project

General

Profile

Actions

Feature #4174

open

tracking: app-layer frame inspection support

Added by Victor Julien over 3 years ago. Updated 6 months ago.

Status:
In Progress
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Effort to make it possible to avoid raw tcp data inspection. Many rules looking for application records make assumptions about pdu's aligning with packets.

Rules should be able to do something like alert ftp ... (frame:ftp.command; content:"USER"; ... ).

Frames should be defined by the app-layer parsers.


Subtasks 36 (26 open10 closed)

Task #4871: tracking: implement frames for all parsersNewActions
Feature #4872: nfs: add stream app-layer frame support ClosedSam MohammadActions
Feature #4904: dcerpc: add stream app-layer records supportIn ProgressShivani BhardwajActions
Feature #4905: smtp: add stream app-layer frame support In ProgressVictor JulienActions
Feature #4906: ftp: add stream app-layer frame support AssignedShivani BhardwajActions
Feature #4984: dns: add frames supportClosedJason IshActions
Feature #4985: quic: support framesRejectedPhilippe AntoineActions
Feature #4986: postgresql: support framesIn ProgressJuliana Fajardini ReichowActions
Feature #5036: sip: add frames supportClosedVictor JulienActions
Feature #5716: rdp: add app-layer frame supportNewOISF DevActions
Feature #5717: rfb: add frame supportClosedHaleema KhanActions
Feature #5726: ike: add frame supportNewOISF DevActions
Feature #5727: krb: add frame supportNewOISF DevActions
Feature #5728: modbus: add frame supportNewOISF DevActions
Feature #5729: bittorrent-dht: add frame supportNewOISF DevActions
Feature #5730: dhcp: add frame supportNewOISF DevActions
Feature #5731: mqtt: add frame supportClosedHaleema KhanActions
Feature #5732: ntp: add frame supportNewOISF DevActions
Feature #5733: snmp: add frame supportNewOISF DevActions
Feature #5734: ssh: add frame supportNewOISF DevActions
Feature #5743: http2: add frame supportNewPhilippe AntoineActions
Feature #4976: frames: implement/complete profiling supportNewActions
Optimization #4977: frames: gap handling in inspectionClosedVictor JulienActions
Feature #4979: frames: implement dynamic logic to disable frames of a typeClosedVictor JulienActions
Documentation #4980: doc/frames: document frame rule keywordIn ProgressOISF DevActions
Feature #4981: frames: add general <app_proto>.stream framesClosedVictor JulienActions
Feature #4983: frames: support UDPClosedVictor JulienActions
Optimization #4987: frames: unify handling of getting frame data, flagsAssignedVictor JulienActions
Feature #4988: frames: logging improvementsNewActions
Feature #4982: frames: selective frame loggingNewActions
Feature #4989: eve/alert: make frame logging configurableNewActions
Feature #4990: eve/frames: make payload logging configurableNewOISF DevActions
Feature #5051: output/frames: allow tx logging to reference framesNewOISF DevActions
Feature #5826: frames: logging of events set on framesNewOISF DevActions
Feature #5049: detect/frames: allow mixing with txsAssignedVictor JulienActions
Task #5050: rules/frames: settle on rule syntaxAssignedVictor JulienActions

Related issues 3 (2 open1 closed)

Related to Suricata - Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Suricata - Documentation #4697: devguide: document app-layer frame supportClosedJuliana Fajardini ReichowActions
Related to Suricata - Task #4772: tracking: parity between fields logged and fields available for detectionAssignedVictor JulienActions
Actions #1

Updated by Victor Julien over 3 years ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #2

Updated by Victor Julien over 2 years ago

Actions #3

Updated by Victor Julien over 2 years ago

  • Status changed from Assigned to In Progress
Actions #4

Updated by Victor Julien about 2 years ago

  • Related to Task #4871: tracking: implement frames for all parsers added
Actions #5

Updated by Victor Julien about 2 years ago

  • Subject changed from tracking: app_record / pdu inspection support to tracking: app-layer frame inspection support
  • Description updated (diff)
Actions #6

Updated by Victor Julien almost 2 years ago

  • Related to Task #4772: tracking: parity between fields logged and fields available for detection added
Actions #7

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions #8

Updated by Victor Julien about 1 year ago

  • Target version changed from 7.0.0-rc1 to 8.0.0-beta1
Actions

Also available in: Atom PDF