Project

General

Profile

Actions
Copy link

Feature #5646

closed
VJ SB

Task #5645: tracking: elephant flow detection

rules: allow matching on flow pkts and bytes in either direction

Feature #5646: rules: allow matching on flow pkts and bytes in either direction

Added by Victor Julien over 3 years ago. Updated 12 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Shivani Bhardwaj
Target version:
8.0.0-beta1
Effort:
Difficulty:
Label:

Description

Probably need some logic to express direction, e.g.

flow.pkts:toserver,>,10000;
flow.pkts:either,=,10000;
flow.bytes:both,>,1G;

Exact syntax TBD.

Related issues 2 (0 open — 2 closed)

Related to Suricata - Feature #6164: rules: allow matching on flow pkts and bytesClosedPhilippe AntoineActions
Related to Suricata - Feature #7097: Additions to flow detection - sizeClosedOISF DevActions
Actions
Copy link

Also available in: PDF Atom