Project

General

Profile

Actions

Feature #5657

open

byte_test: allow comparison with static value

Added by Juliana Fajardini Reichow over 1 year ago. Updated over 1 year ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

If one wants to compare two specific portions of the packet stream to a static value, after some byte_math operation, for instance,
that's not possible with the current state of the Suricata rules language.

It would be a nice addition to be able to do so.

Expected:

allow usage of 'value_compare: val1, val2, op' by the rule language, with byte_test.

Actions

Also available in: Atom PDF