Project

General

Profile

Actions
Copy link

Feature #5446

closed
JT PA

rules: allow ranges in dns.opcode value

Feature #5446: rules: allow ranges in dns.opcode value

Added by Jason Taylor over 3 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

It would be nice to be able to write a single rule looking for a range of opcodes or not looking (excluding) a range of opcodes.

examples:

alert dns any any -> any any (msg:"dns unassigned opcodes in dns query"; dns.opcode:7-15; sid:123; rev:1;)

alert dns any any -> any any (msg:"dns opcode other than assigned opcode in dns query"; dns.opcode:!1-6; sid:123; rev:1;)

Related issues 3 (1 open — 2 closed)

Related to Suricata - Feature #6646: detect: integer: support negated rangesClosedPhilippe AntoineActions
Related to Suricata - Task #6644: tracking: detect: integer as first-class supportIn ProgressPhilippe AntoineActions
Related to Suricata - Feature #6723: detect: review existing keywords for usage of enumerationsClosedPhilippe AntoineActions

VJ Updated by Victor Julien over 3 years ago Actions
Copy link
 #1

@Philippe Antoine could this somehow be implemented as part of the general detect int work?

PA Updated by Philippe Antoine almost 3 years ago Actions
Copy link
 #2

  • Assignee changed from OISF Dev to Philippe Antoine

PA Updated by Philippe Antoine almost 3 years ago Actions
Copy link
 #3

  • Target version changed from TBD to 8.0.0-beta1

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #4

  • Status changed from New to In Review

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #5

  • Related to Feature #6646: detect: integer: support negated ranges added

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #6

  • Related to Task #6644: tracking: detect: integer as first-class support added

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #7

  • Related to Feature #6723: detect: review existing keywords for usage of enumerations added

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #8

  • Status changed from In Review to Closed

VJ Updated by Victor Julien 12 months ago Actions
Copy link
 #9

  • Subject changed from allow ranges in dns.opcode value to rules: allow ranges in dns.opcode value
Actions
Copy link

Also available in: PDF Atom