dhcp: add dhcp app-layer rules file

7 years ago · c052e23348
parent 9210d8743b
commit c052e23348
1 changed files with 7 additions and 0 deletions
--- a/rules/dhcp-events.rules
+++ b/rules/dhcp-events.rules
@ -0,0 +1,7 @@
+# DHCP app-layer event rules.  See
+#
+# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer
+# for SID allocation.
+
+alert dhcp any any -> any any (msg:"SURICATA DHCP malformed options"; app-layer-event:dhcp.malformed_options; classtype:protocol-command-decode; sid:2227000; rev:1;)
+alert dhcp any any -> any any (msg:"SURICATA DHCP truncated options"; app-layer-event:dhcp.truncated_options; classtype:protocol-command-decode; sid:2227001; rev:1;)