From c717cc1e9b2a1c8d961c39ade46b8c9fde3df675 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sun, 16 Aug 2026 10:03:39 -0400 Subject: [PATCH] doc/pcre: note that flow captures need a flow Add a note to the pcre extraction section stating that a flow: capture is dropped when the packet is inspected without a flow, and that such a packet still alerts. ICMPv4 error messages are one way to get such a packet: FlowCreateCheck returns false for them, while DecodeICMPV4 has already set p->payload, so they reach the detection engine with something to inspect and nowhere to store a flow variable. A packet the flow engine could not give a flow to once the memcap was reached and no used flow could be reclaimed is the other. The pkt: and alert: scopes described in the same section are unaffected, because a packet variable is stored on the packet and an alert variable on the alert. Issue: 8862 --- doc/userguide/rules/payload-keywords.rst | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst index 4b0db2cfca..583aea39c3 100644 --- a/doc/userguide/rules/payload-keywords.rst +++ b/doc/userguide/rules/payload-keywords.rst @@ -1032,6 +1032,11 @@ With that syntax, the result of the extraction will appear like :: A combination of the extraction scopes can be combined. +.. note:: A ``flow:`` capture needs a flow to store into. Some packets are + inspected without one -- ICMPv4 error messages, for example, or a packet + that could not be given a flow because the flow memcap was reached. Those + packets can still alert, but their ``flow:`` captures are dropped. + It is also possible to extract key/value pair in the ``pkt`` scope. One capture would be the key, the second the value. The notation is similar to the last ::