Project

General

Profile

Actions

Feature #5646

open

Task #5645: tracking: elephant flow detection

rules: allow matching on flow pkts and bytes in either direction

Added by Victor Julien about 2 years ago. Updated 3 months ago.

Status:
In Review
Priority:
High
Target version:
Effort:
Difficulty:
Label:

Description

Probably need some logic to express direction, e.g.

flow.pkts:toserver,>,10000;
flow.pkts:either,=,10000;
flow.bytes:both,>,1G;

Exact syntax TBD.


Related issues 2 (0 open2 closed)

Related to Suricata - Feature #6164: rules: allow matching on flow pkts and bytesClosedPhilippe AntoineActions
Related to Suricata - Feature #7097: Additions to flow detection - sizeClosedOISF DevActions
Actions #1

Updated by Philippe Antoine about 1 year ago

  • Related to Feature #6164: rules: allow matching on flow pkts and bytes added
Actions #2

Updated by Philippe Antoine 12 months ago

@Victor Julien is there more to do here after https://redmine.openinfosecfoundation.org/issues/6164 ?
Maybe the sum of both directions ?

Actions #3

Updated by Victor Julien 5 months ago

Not sure if we need the "both" support. Would that be useful? And I guess an "either" option would make sense as well?

Actions #4

Updated by Peter Manev 5 months ago

"either" is good in my opinion.

Actions #5

Updated by Philippe Antoine 5 months ago

  • Related to Feature #7097: Additions to flow detection - size added
Actions #6

Updated by Shivani Bhardwaj 4 months ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Shivani Bhardwaj
  • Target version changed from TBD to 8.0.0-beta1
Actions #7

Updated by Victor Julien 4 months ago

  • Priority changed from Normal to High
Actions #8

Updated by Shivani Bhardwaj 4 months ago

Also need: elephant flow counter

Actions #9

Updated by Shivani Bhardwaj 3 months ago

  • Subject changed from rules: allow matching on flow pkts and bytes to rules: allow matching on flow pkts and bytes in either direction
Actions #10

Updated by Shivani Bhardwaj 3 months ago

  • Status changed from Assigned to In Review
Actions

Also available in: Atom PDF