Project

General

Profile

Actions

Feature #4174

open

tracking: app-layer frame inspection support

Added by Victor Julien over 1 year ago. Updated 4 months ago.

Status:
In Progress
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Effort to make it possible to avoid raw tcp data inspection. Many rules looking for application records make assumptions about pdu's aligning with packets.

Rules should be able to do something like alert ftp ... (frame:ftp.command; content:"USER"; ... ).

Frames should be defined by the app-layer parsers.


Subtasks 23 (20 open3 closed)

Task #4871: tracking: implement frames for all parsersNewActions
Feature #4872: nfs: add stream app-layer frame support In ReviewSam MuhammedActions
Feature #4904: dcerpc: add stream app-layer records supportAssignedShivani BhardwajActions
Feature #4905: smtp: add stream app-layer frame support AssignedOISF DevActions
Feature #4906: ftp: add stream app-layer frame support AssignedShivani BhardwajActions
Feature #4984: dns: add frames supportClosedJason IshActions
Feature #4985: quic: support framesAssignedPhilippe AntoineActions
Feature #4986: postgresql: support framesIn ProgressJuliana Fajardini ReichowActions
Feature #5036: sip: add frames supportClosedVictor JulienActions
Feature #4976: frames: implement/complete profiling supportNewActions
Optimization #4977: frames: gap handling in inspectionIn ProgressVictor JulienActions
Feature #4979: frames: implement dynamic logic to disable frames of a typeNewActions
Feature #4980: doc/frames: document frame rule keywordIn ProgressJuliana Fajardini ReichowActions
Feature #4981: frames: add general <app_proto>.stream framesNewActions
Feature #4983: frames: support UDPClosedVictor JulienActions
Optimization #4987: frames: unify handling of getting frame data, flagsAssignedVictor JulienActions
Feature #4988: frames: logging improvementsNewActions
Feature #4982: frames: selective frame loggingNewActions
Feature #4989: eve/alert: make frame logging configurableNewActions
Feature #4990: eve/frames: make payload logging configurableNewJuliana Fajardini ReichowActions
Feature #5051: output/frames: allow tx logging to reference framesNewOISF DevActions
Feature #5049: detect/frames: allow mixing with txsAssignedVictor JulienActions
Task #5050: rules/frames: settle on rule syntaxAssignedVictor JulienActions

Related issues 3 (2 open1 closed)

Related to Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Documentation #4697: devguide: document app-layer frame supportClosedJuliana Fajardini ReichowActions
Related to Task #4772: tracking: parity between fields logged and fields available for detectionAssignedVictor JulienActions
Actions #1

Updated by Victor Julien over 1 year ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #2

Updated by Victor Julien 11 months ago

Actions #3

Updated by Victor Julien 10 months ago

  • Status changed from Assigned to In Progress
Actions #4

Updated by Victor Julien 8 months ago

  • Related to Task #4871: tracking: implement frames for all parsers added
Actions #5

Updated by Victor Julien 8 months ago

  • Subject changed from tracking: app_record / pdu inspection support to tracking: app-layer frame inspection support
  • Description updated (diff)
Actions #6

Updated by Victor Julien 4 months ago

  • Related to Task #4772: tracking: parity between fields logged and fields available for detection added
Actions

Also available in: Atom PDF