From 0c534c9ccd549378b24d86daddc76b94954f2821 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Thu, 8 Oct 2026 18:28:22 +0530 Subject: [PATCH] detect/iponly: warn on threshold track by flow IP Only rules are only evaluated once per direction per flow for a standard rule and twice at the most for a bidirectional rule. Using threshold or detection_filter with track by_flow does not make much sense for higher count as the rule may never fire. Issue a warning for this case in engine analysis mode for now. Ticket: 9170 --- src/detect-engine-analyzer.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 44faa77005..387fc76f6f 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -42,6 +42,7 @@ #include "detect-isdataat.h" #include "detect-flow.h" #include "detect-ttl.h" +#include "detect-threshold.h" #include "detect-tcp-flags.h" #include "detect-tcp-ack.h" #include "detect-ipopts.h" @@ -1783,6 +1784,7 @@ void EngineAnalysisRules(const DetectEngineCtx *de_ctx, uint32_t warn_non_alproto_fp_for_alproto_sig = 0; uint32_t warn_no_direction = 0; uint32_t warn_both_direction = 0; + uint32_t warn_threshold_by_flow_iponly = 0; EngineAnalysisItemsInit(de_ctx->ea); @@ -1874,6 +1876,13 @@ void EngineAnalysisRules(const DetectEngineCtx *de_ctx, rule_flags = 1; } } + if (sm->type == DETECT_THRESHOLD || sm->type == DETECT_DETECTION_FILTER) { + if ((s->type == SIG_TYPE_IPONLY) && + ((DetectThresholdData *)sm->ctx)->track == TRACK_FLOW) { + warn_threshold_by_flow_iponly = 1; + rule_warning += 1; + } + } } /* for (sm = s->init_data->smlists[list_id]; sm != NULL; sm = sm->next) */ } /* for ( ; list_id < DETECT_SM_LIST_MAX; list_id++) */ @@ -2139,6 +2148,10 @@ void EngineAnalysisRules(const DetectEngineCtx *de_ctx, fprintf(fp, " Warning: Rule requires file-store but the output file-store is not " "enabled.\n"); } + if (warn_threshold_by_flow_iponly) { + fprintf(fp, " Warning: Rule uses threshold by_flow with an IP Only rule which " + "is ineffective for higher counts.\n"); + } if (rule_warning == 0) { fprintf(fp, " No warnings for this rule.\n"); }