Project

General

Profile

Actions

Optimization #5047

open

sip: implement pattern based protocol detection

Added by Victor Julien about 2 years ago. Updated 4 months ago.

Status:
In Progress
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Beginner

Description

SIP looks a lot like HTTP, so we can use HTTP like protocol detection to match SIP independent of port and fall back to the existing probing parser logic if that fails.


Related issues 1 (0 open1 closed)

Related to Suricata - Feature #3351: sip: parse traffic over tcpClosedGiuseppe LongoActions
Actions #1

Updated by Victor Julien about 2 years ago

Actions #2

Updated by Philippe Antoine 11 months ago

I wonder if probing parser makes sense at all if we have pattern matching for protocol detection

Actions #3

Updated by Victor Julien 11 months ago

Based on my SIP knowledge I think pattern only should be enough.

Actions #4

Updated by Philippe Antoine 9 months ago

  • Assignee set to OISF Dev
  • Target version set to 8.0.0-beta1
Actions #5

Updated by Philippe Antoine 5 months ago

  • Label Beginner added
Actions

Also available in: Atom PDF