Project

General

Profile

Actions
Copy link

Task #5678

open
PA VJ

tracking: improve handling of non-IP protocols

Task #5678: tracking: improve handling of non-IP protocols

Added by Philippe Antoine almost 4 years ago. Updated 7 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Victor Julien
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Like like LLDP directly over Ethernet.

This will require various lower level things to happen:
- "flow" tracking for ethernet addresses with some protocol specific identifiers?
- app layer API support
- output API support

This work will depend on an actual protocol being developed & contributed.

Related issues 5 (4 open — 1 closed)

Related to Suricata - Task #5488: Suricon 2022 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4151: Research: New protocol supportTriagedCommunity TicketActions
Related to Suricata - Task #8123: Suricon 2025 BrainstormAssignedVictor JulienActions
Related to Suricata - Bug #8313: firewall: rule language can't accept ARPResolvedVictor JulienActions
Related to Suricata - Feature #8327: detect: add eth.hdr keyword for inspecting ethernet headerClosedVictor JulienActions

PA Updated by Philippe Antoine almost 4 years ago Actions
Copy link
 #1

  • Related to Task #5488: Suricon 2022 brainstorm added

VJ Updated by Victor Julien almost 4 years ago Actions
Copy link
 #2

  • Tracker changed from Feature to Task
  • Subject changed from Parse protocols that are not over TCP/UDP like LLDP directly over Ethernet to tracking: Parse protocols that are not over TCP/UDP
  • Description updated (diff)
  • Assignee changed from OISF Dev to Community Ticket

PA Updated by Philippe Antoine almost 3 years ago Actions
Copy link
 #3

  • Related to Task #4151: Research: New protocol support added

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #4

  • Related to Task #8123: Suricon 2025 Brainstorm added

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #5

LLDP mentionne at suricata 2025

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #6

CDP, HP Heartbeat

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #7

Also tunneled protocols : CAPWAP / Mobile IP

VJ Updated by Victor Julien 9 months ago Actions
Copy link
 #8

  • Subject changed from tracking: Parse protocols that are not over TCP/UDP to tracking: improve handling of non-IP protocols

VJ Updated by Victor Julien 9 months ago Actions
Copy link
 #9

  • Assignee changed from Community Ticket to Victor Julien

VJ Updated by Victor Julien 9 months ago Actions
Copy link
 #10

  • Target version changed from TBD to 9.0.0-beta1

PA Updated by Philippe Antoine 7 months ago Actions
Copy link
 #11

  • Status changed from New to Assigned

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #12

  • Related to Bug #8313: firewall: rule language can't accept ARP added

VJ Updated by Victor Julien 6 months ago Actions
Copy link
 #13

  • Related to Feature #8327: detect: add eth.hdr keyword for inspecting ethernet header added
Actions
Copy link

Also available in: PDF Atom