Commit Graph

6 Commits (69a0c467e05498592acc4bd95f79f51fd595f22f)

Author SHA1 Message Date
Shivani Bhardwaj 6436d8f28b detect: add dcerpc.flags keyword
This is a u16 keyword that matches on flags field derived from the
header of a DCERPC packet per transaction per direction.

Flags are stored in the tx to allow matches with dcerpc.flags keyword
later on. DCERPC/TCP exposes a u8 as PFC flags in its header however,
DCERPC/UDP stores two sets of flags flags1 and flags2 in its header.
Hence, the field is kept u16 to accommodate for both.

Feature 8734
2 months ago
Philippe Antoine 5f9e436c3f detect/dcerpc: support generic integer for opnum keyword
Ticket: 8179
6 months ago
Victor Julien 2480f8c038 doc: fix dcerpc.opnum documentation
Docs were claiming greater than, less than, etc. support even though this was never supported.

Fixes: 51be8f0238 ("doc/dcerpc: add proto keywords")

Ticket: #8330.
8 months ago
Victor Julien a1c4167d94 doc/userguide: add initial protocols overview
Explain per protocol mechanics for rule matching.
1 year ago
Victor Julien e2a5bc058c doc/userguide: fix DCERPC headings 1 year ago
Shivani Bhardwaj 51be8f0238 doc/dcerpc: add proto keywords 5 years ago