From c052e23348e71e4fef27204642eee56ac476ea42 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Thu, 31 May 2018 17:05:52 -0600 Subject: [PATCH] dhcp: add dhcp app-layer rules file --- rules/dhcp-events.rules | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 rules/dhcp-events.rules diff --git a/rules/dhcp-events.rules b/rules/dhcp-events.rules new file mode 100644 index 0000000000..c99d9816e8 --- /dev/null +++ b/rules/dhcp-events.rules @@ -0,0 +1,7 @@ +# DHCP app-layer event rules. See +# +# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# for SID allocation. + +alert dhcp any any -> any any (msg:"SURICATA DHCP malformed options"; app-layer-event:dhcp.malformed_options; classtype:protocol-command-decode; sid:2227000; rev:1;) +alert dhcp any any -> any any (msg:"SURICATA DHCP truncated options"; app-layer-event:dhcp.truncated_options; classtype:protocol-command-decode; sid:2227001; rev:1;)