From fe3cce895caf226eaae524cc668ee5df0a00ec8f Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 12 Feb 2026 16:03:16 +0100 Subject: [PATCH] doc/userguide: add igmp keyword docs --- doc/userguide/rules/header-keywords.rst | 56 +++++++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/doc/userguide/rules/header-keywords.rst b/doc/userguide/rules/header-keywords.rst index 1481165aa8..090fbdb157 100644 --- a/doc/userguide/rules/header-keywords.rst +++ b/doc/userguide/rules/header-keywords.rst @@ -796,3 +796,59 @@ Example rule: .. container:: example-rule alert ip $EXTERNAL_NET any -> $HOME_NET any (:example-rule-emphasis:`icmpv6.mtu:<1280;` sid:1234; rev:5;) + + +IGMP keywords +------------- + +The Internet Group Management Protocol (IGMP) is the protocol used by IPv4 +systems to report their IP multicast group memberships to neighboring +multicast routers [RFC 9776]. + +Additionally, the RGMP protocol is a dialect of IGMP. The keywords below +also apply to RGMP. RGMP is defined in RFC 3488. + +igmp.hdr +^^^^^^^^ + +Sticky buffer to match on the whole IGMP header. + +Example rule: + +.. container:: example-rule + + alert igmp any any -> any any (:example-rule-emphasis:`igmp.hdr; content:"|22|"; startswith;` sid:1234; rev:5;) + + +igmp.type +^^^^^^^^^ + +Match on the IGMP type field. + +``igmp.type`` uses an :ref:`unsigned 8-bit integer `. + +Format:: + + igmp.type:0x11; + + +Example rule: + +.. container:: example-rule + + alert igmp any any -> any any (:example-rule-emphasis:`igmp.type:0x22;` sid:1234; rev:5;) + + +igmp-csum +^^^^^^^^^ + +Match on the validity of the checksum field. + +Format:: + + igmp-csum:valid; + igmp-csum:invalid; + +.. container:: example-rule + + alert igmp any any -> any any (:example-rule-emphasis:`igmp-csum:invalid;` sid:1234; rev:5;)