Project

General

Profile

Actions

Feature #4174

open

tracking: app-layer frame inspection support

Added by Victor Julien about 2 years ago. Updated 4 days ago.

Status:
In Progress
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Effort to make it possible to avoid raw tcp data inspection. Many rules looking for application records make assumptions about pdu's aligning with packets.

Rules should be able to do something like alert ftp ... (frame:ftp.command; content:"USER"; ... ).

Frames should be defined by the app-layer parsers.


Subtasks 35 (30 open5 closed)

Task #4871: tracking: implement frames for all parsersNewActions
Feature #4872: nfs: add stream app-layer frame support ClosedSam MuhammedActions
Feature #4904: dcerpc: add stream app-layer records supportAssignedShivani BhardwajActions
Feature #4905: smtp: add stream app-layer frame support AssignedOISF DevActions
Feature #4906: ftp: add stream app-layer frame support AssignedShivani BhardwajActions
Feature #4984: dns: add frames supportClosedJason IshActions
Feature #4985: quic: support framesRejectedPhilippe AntoineActions
Feature #4986: postgresql: support framesIn ProgressJuliana Fajardini ReichowActions
Feature #5036: sip: add frames supportClosedVictor JulienActions
Feature #5716: rdp: add app-layer frame supportNewOISF DevActions
Feature #5717: rfb: add frame supportNewHaleema KhanActions
Feature #5726: ike: add frame supportNewOISF DevActions
Feature #5727: krb: add frame supportNewOISF DevActions
Feature #5728: modbus: add frame supportNewOISF DevActions
Feature #5729: bittorrent-dht: add frame supportNewOISF DevActions
Feature #5730: dhcp: add frame supportNewOISF DevActions
Feature #5731: mqtt: add frame supportNewHaleema KhanActions
Feature #5732: ntp: add frame supportNewOISF DevActions
Feature #5733: snmp: add frame supportNewOISF DevActions
Feature #5734: ssh: add frame supportNewOISF DevActions
Feature #5743: http2: add frame supportNewOISF DevActions
Feature #4976: frames: implement/complete profiling supportNewActions
Optimization #4977: frames: gap handling in inspectionIn ProgressVictor JulienActions
Feature #4979: frames: implement dynamic logic to disable frames of a typeNewActions
Feature #4980: doc/frames: document frame rule keywordIn ProgressVictor JulienActions
Feature #4981: frames: add general <app_proto>.stream framesNewActions
Feature #4983: frames: support UDPClosedVictor JulienActions
Optimization #4987: frames: unify handling of getting frame data, flagsAssignedVictor JulienActions
Feature #4988: frames: logging improvementsNewActions
Feature #4982: frames: selective frame loggingNewActions
Feature #4989: eve/alert: make frame logging configurableNewActions
Feature #4990: eve/frames: make payload logging configurableNewJuliana Fajardini ReichowActions
Feature #5051: output/frames: allow tx logging to reference framesNewOISF DevActions
Feature #5049: detect/frames: allow mixing with txsAssignedVictor JulienActions
Task #5050: rules/frames: settle on rule syntaxAssignedVictor JulienActions

Related issues 3 (2 open1 closed)

Related to Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Related to Documentation #4697: devguide: document app-layer frame supportClosedJuliana Fajardini ReichowActions
Related to Task #4772: tracking: parity between fields logged and fields available for detectionAssignedVictor JulienActions
Actions #1

Updated by Victor Julien about 2 years ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #2

Updated by Victor Julien about 1 year ago

Actions #3

Updated by Victor Julien about 1 year ago

  • Status changed from Assigned to In Progress
Actions #4

Updated by Victor Julien 12 months ago

  • Related to Task #4871: tracking: implement frames for all parsers added
Actions #5

Updated by Victor Julien 12 months ago

  • Subject changed from tracking: app_record / pdu inspection support to tracking: app-layer frame inspection support
  • Description updated (diff)
Actions #6

Updated by Victor Julien 8 months ago

  • Related to Task #4772: tracking: parity between fields logged and fields available for detection added
Actions #7

Updated by Victor Julien about 1 month ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions #8

Updated by Victor Julien 9 days ago

  • Target version changed from 7.0.0-rc1 to 8.0beta1
Actions

Also available in: Atom PDF