Project

General

Profile

Actions
Copy link

Feature #5646

closed
VJ SB

Task #5645: tracking: elephant flow detection

rules: allow matching on flow pkts and bytes in either direction

Feature #5646: rules: allow matching on flow pkts and bytes in either direction

Added by Victor Julien over 3 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

Probably need some logic to express direction, e.g.

flow.pkts:toserver,>,10000;
flow.pkts:either,=,10000;
flow.bytes:both,>,1G;

Exact syntax TBD.

Related issues 2 (0 open — 2 closed)

Related to Suricata - Feature #6164: rules: allow matching on flow pkts and bytesClosedPhilippe AntoineActions
Related to Suricata - Feature #7097: Additions to flow detection - sizeClosedOISF DevActions

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #1

  • Related to Feature #6164: rules: allow matching on flow pkts and bytes added

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #2

@Victor Julien is there more to do here after https://redmine.openinfosecfoundation.org/issues/6164 ?
Maybe the sum of both directions ?

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
 #3

Not sure if we need the "both" support. Would that be useful? And I guess an "either" option would make sense as well?

PM Updated by Peter Manev almost 2 years ago Actions
Copy link
 #4

"either" is good in my opinion.

PA Updated by Philippe Antoine almost 2 years ago Actions
Copy link
 #5

  • Related to Feature #7097: Additions to flow detection - size added

SB Updated by Shivani Bhardwaj over 1 year ago Actions
Copy link
 #6

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from TBD to 8.0.0-beta1

VJ Updated by Victor Julien over 1 year ago Actions
Copy link
 #7

  • Priority changed from Normal to High

SB Updated by Shivani Bhardwaj over 1 year ago Actions
Copy link
 #8

Also need: elephant flow counter

SB Updated by Shivani Bhardwaj over 1 year ago Actions
Copy link
 #9

  • Subject changed from rules: allow matching on flow pkts and bytes to rules: allow matching on flow pkts and bytes in either direction

SB Updated by Shivani Bhardwaj over 1 year ago ยท Edited Actions
Copy link
 #10

  • Status changed from Assigned to In Review

SB Updated by Shivani Bhardwaj about 1 year ago Actions
Copy link
 #11

  • Status changed from In Review to Closed

VJ Updated by Victor Julien 12 months ago Actions
Copy link
 #12

  • Priority changed from High to Normal
Actions
Copy link

Also available in: PDF Atom