From af3abf100eee5107b72c667ae7a2ac3775ea6586 Mon Sep 17 00:00:00 2001 From: Samaresh Kumar Singh Date: Wed, 13 May 2026 08:40:20 -0500 Subject: [PATCH] doc: dhcp eve note for option 52 overload Document that DHCP options carried in the overloaded BOOTP sname or file fields are now merged into the EVE log option set alongside the main options area. Bug: #8538. --- doc/userguide/output/eve/eve-json-format.rst | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/doc/userguide/output/eve/eve-json-format.rst b/doc/userguide/output/eve/eve-json-format.rst index 27ceed012d..fed1da8e9e 100644 --- a/doc/userguide/output/eve/eve-json-format.rst +++ b/doc/userguide/output/eve/eve-json-format.rst @@ -3202,6 +3202,12 @@ The default DHCP logging level only logs enough information to map a MAC address to an IP address. Enable extended mode to log all DHCP message types in full detail. +When a DHCP message carries the Option Overload entry (option 52, +RFC 2132), the BOOTP ``sname`` and ``file`` header fields are used as +extra option storage. Suricata parses any options found in those +continuation areas alongside the standard options block, so values +carried in either area show up in the same EVE fields below. + Fields ~~~~~~