Bug #6304: schema.json : if protocol such as ENIP is detection only, we do not have _tcp suffix in stats - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #6304

closed

PA PA

schema.json : if protocol such as ENIP is detection only, we do not have _tcp suffix in stats

Bug #6304: schema.json : if protocol such as ENIP is detection only, we do not have _tcp suffix in stats

Added by Philippe Antoine over 2 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

8.0.0-beta1

Affected Versions:

7.0.1

Effort:

Difficulty:

Label:

Description

Meaning we get

1./stats/app_layer/error Additional properties are not allowed ('enip' was unexpected)
2./stats/app_layer/flow Additional properties are not allowed ('enip' was unexpected)
3./stats/app_layer/tx Additional properties are not allowed ('enip' was unexpected)

when running suricata-verify

Should we duplicate every protocol that can be over both TCP and UDP to have a third line in schema.json about it ?

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
#1

cf AppLayerSetupCounters

JI Updated by Jason Ish over 2 years ago Actions
Copy link
#2

Is there a valid reason why it doesn't have the suffix when in detection only mode? My feeling is there shouldn't be difference unless there is a good reason for it.

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
#3

I do not know of a reason but to have `_tcp` prefix, you need both detection and registration on both udp and tcp as per the code of `AppLayerSetupCounters`