aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

stream/rules: add example rule for pkt_spurious_retransmission

Browse Source
pull/7496/head
Victor Julien 3 years ago
parent cc4e8f0936
commit d8edea904c
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File

6
rules/stream-events.rules
Unescape Escape View File

@ -94,5 +94,9 @@ alert tcp any any -> any any (msg:"SURICATA STREAM pkt seen on wrong thread"; st
# Packet with FIN+SYN set # Packet with FIN+SYN set
alert tcp any any -> any any (msg:"SURICATA STREAM FIN SYN reuse"; stream-event:fin_syn; classtype:protocol-command-decode; sid:2210060; rev:1;) alert tcp any any -> any any (msg:"SURICATA STREAM FIN SYN reuse"; stream-event:fin_syn; classtype:protocol-command-decode; sid:2210060; rev:1;)
# next sid 2210061 # Packet is a spurious retransmission, so a retransmission of already ACK'd data.
# Disabled by default as this quite common and not malicious.
#alert tcp any any -> any any (msg:"SURICATA STREAM spurious retransmission"; stream-event:pkt_spurious_retransmission; classtype:protocol-command-decode; sid:2210061; rev:1;)
# next sid 2210062

Write Preview
Loading…
Cancel
Save