|
|
|
|
@ -74,36 +74,53 @@ not be met.
|
|
|
|
|
Multiple buffer matching is currently enabled for use with the
|
|
|
|
|
following keywords:
|
|
|
|
|
|
|
|
|
|
* ``dns.additionals.rrname``
|
|
|
|
|
* ``dns.answer.name``
|
|
|
|
|
* ``dns.query.name``
|
|
|
|
|
* ``dns.answers.rrname``
|
|
|
|
|
* ``dns.authorities.rrname``
|
|
|
|
|
* ``dns.queries.rrname``
|
|
|
|
|
* ``dns.query``
|
|
|
|
|
* ``dns.query.name``
|
|
|
|
|
* ``email.received``
|
|
|
|
|
* ``email.url``
|
|
|
|
|
* ``file.data``
|
|
|
|
|
* ``file.magic``
|
|
|
|
|
* ``file.name``
|
|
|
|
|
* ``ftp.completion_code``
|
|
|
|
|
* ``ftp.reply``
|
|
|
|
|
* ``http.request_header``
|
|
|
|
|
* ``http.response_header``
|
|
|
|
|
* ``http2.header_name``
|
|
|
|
|
* ``ike.vendor``
|
|
|
|
|
* ``krb5_cname``
|
|
|
|
|
* ``krb5_sname``
|
|
|
|
|
* ``krb5.cname``
|
|
|
|
|
* ``krb5.sname``
|
|
|
|
|
* ``ldap.request.attribute_type``
|
|
|
|
|
* ``ldap.responses.attribute_type``
|
|
|
|
|
* ``ldap.responses.dn``
|
|
|
|
|
* ``ldap.responses.message``
|
|
|
|
|
* ``mdns.additionals.rrname``
|
|
|
|
|
* ``mdns.answers.rrname``
|
|
|
|
|
* ``mdns.authorities.rrname``
|
|
|
|
|
* ``mdns.queries.rrname``
|
|
|
|
|
* ``mqtt.subscribe.topic``
|
|
|
|
|
* ``mqtt.unsubscribe.topic``
|
|
|
|
|
* ``quic.cyu.hash``
|
|
|
|
|
* ``quic.cyu.string``
|
|
|
|
|
* ``sdp.attribute``
|
|
|
|
|
* ``sdp.bandwidth``
|
|
|
|
|
* ``sdp.media.connection_data``
|
|
|
|
|
* ``sdp.media.encryption_key``
|
|
|
|
|
* ``sdp.media.media``
|
|
|
|
|
* ``sdp.media.media_info``
|
|
|
|
|
* ``sdp.repeat_time``
|
|
|
|
|
* ``sdp.time``
|
|
|
|
|
* ``sip.content_length``
|
|
|
|
|
* ``sip.content_type``
|
|
|
|
|
* ``sip.from``
|
|
|
|
|
* ``sip.to``
|
|
|
|
|
* ``sip.ua``
|
|
|
|
|
* ``sip.user_agent``
|
|
|
|
|
* ``sip.via``
|
|
|
|
|
* ``smtp.rcpt_to``
|
|
|
|
|
* ``tls.alpn``
|
|
|
|
|
* ``tls.cert_subject``
|
|
|
|
|
* ``tls.certs``
|
|
|
|
|
* ``tls.subjectaltname``
|
|
|
|
|
|