Project

General

Profile

Actions

Feature #5446

closed

allow ranges in dns.opcode value

Added by Jason Taylor over 2 years ago. Updated 9 months ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

It would be nice to be able to write a single rule looking for a range of opcodes or not looking (excluding) a range of opcodes.

examples:

alert dns any any -> any any (msg:"dns unassigned opcodes in dns query"; dns.opcode:7-15; sid:123; rev:1;)

alert dns any any -> any any (msg:"dns opcode other than assigned opcode in dns query"; dns.opcode:!1-6; sid:123; rev:1;)


Related issues 3 (2 open1 closed)

Related to Suricata - Feature #6646: detect: integer: support negated rangesClosedPhilippe AntoineActions
Related to Suricata - Task #6644: tracking: detect: integer as first-class supportIn ProgressPhilippe AntoineActions
Related to Suricata - Feature #6723: detect: review existing keywords for usage of enumerationsIn ProgressPhilippe AntoineActions
Actions

Also available in: Atom PDF