You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Jeff Lucovsky c717cc1e9b doc/pcre: note that flow captures need a flow ... Add a note to the pcre extraction section stating that a flow: capture is dropped when the packet is inspected without a flow, and that such a packet still alerts. ICMPv4 error messages are one way to get such a packet: FlowCreateCheck returns false for them, while DecodeICMPV4 has already set p->payload, so they reach the detection engine with something to inspect and nowhere to store a flow variable. A packet the flow engine could not give a flow to once the memcap was reached and no used flow could be reclaimed is the other. The pkt: and alert: scopes described in the same section are unaffected, because a packet variable is stored on the packet and an alert variable on the alert. Issue: 8862		2 months ago
..
dataset-examples	…
dns-keywords	…
fast-pattern	…
flow-keywords	…
header-keywords	…
http-keywords	…
intro	…
normalized-buffers	…
payload-keywords	doc/userguide: fix within-distance pointer graphics in payload-keywords doc	9 months ago
pcre	…
rule-types	…
app-layer.rst	detect: extend app-layer-protocol to accept a pipe-separated value list	4 months ago
base64-keywords.rst	…
bypass-keyword.rst	detect/bypass: ban bypass keyword for firewall mode	5 months ago
config.rst	doc: move more rules to dedicated css container	6 months ago
datasets.rst	doc/userguide: add dataset match subdomain documentation	5 months ago
dcerpc-keywords.rst	detect/dcerpc: support generic integer for opnum keyword	6 months ago
decode-layer.rst	decode/etag: ETag 802.1BR decoder	1 year ago
dhcp-keywords.rst	doc: move more examples to container:: example-rule	6 months ago
differences-from-snort.rst	doc: move more rules to dedicated css container	6 months ago
dnp3-keywords.rst	detect: dnp3.func is now a generic integer	12 months ago
dns-keywords.rst	doc: move more rules to dedicated css container	6 months ago
email-keywords.rst	detect: add email.body_md5 keyword	1 year ago
enip-keyword.rst	detect/enip: cip_class and cip_instance are now a multi-integer	4 months ago
fast-pattern-explained.rst	…
file-keywords.rst	doc: move more rules to dedicated css container	6 months ago
flow-keywords.rst	detect: add tcp.session keyword for unified TCP lifecycle matching	2 months ago
ftp-keywords.rst	ftp: support STOU data transfers	4 months ago
header-keywords.rst	detect: add ether.hdr keyword	7 months ago
http-keywords.rst	doc: fix eol content in http rules	6 months ago
http2-keywords.rst	detect: http2.errorcode is now a generic integer	1 year ago
ike-keywords.rst	detect/ike: move ike.ike.chosen_sa_attribute keyword to rust	8 months ago
index.rst	doc/sctp: add sctp keywords	5 months ago
integer-keywords.rst	detect/integers: rename index all1 to all	12 months ago
intro.rst	doc: do not highlight bad transactional rule	6 months ago
ip-reputation-rules.rst	doc: move more rules to dedicated css container	6 months ago
ipaddr.rst	…
ja-keywords.rst	doc: move more rules to dedicated css container	6 months ago
kerberos-keywords.rst	detect/krb5: fix doc about cname and sname keywords	4 months ago
ldap-keywords.rst	doc: multi-integers section for rules	1 year ago
llmnr-keywords.rst	doc: add llmnr	5 months ago
lua-detection.rst	doc/lua-detection: fix example script; remove most buffers	1 year ago
mdns-keywords.rst	doc: move more rules to dedicated css container	6 months ago
meta.rst	doc: fix rules	6 months ago
modbus-keyword.rst	…
mqtt-keywords.rst	detect/mqtt: reason_code keyword is now a multi-integer	6 months ago
multi-buffer-matching.rst	doc: fix rules	6 months ago
nfs-keywords.rst	detect/nfs: move nfs_procedure to rust	1 year ago
noalert.rst	doc: fix rules	6 months ago
ntp-keywords.rst	ntp: convert reference_id to buffer and add keyword	6 months ago
payload-keywords.rst	doc/pcre: note that flow captures need a flow	2 months ago
pgsql-keywords.rst	doc: fix rules	6 months ago
prefilter-keywords.rst	doc: move more rules to dedicated css container	6 months ago
quic-keywords.rst	…
rfb-keywords.rst	…
rule-types.rst	doc: adjust for master to main rename	1 year ago
rules-internals.rst	doc/rules/internals: minor fixes	1 year ago
sctp-keywords.rst	decode/sctp: chunk_cnt can be a u16	4 months ago
sdp-keywords.rst	…
sip-keywords.rst	…
smb-keywords.rst	doc: fix rules	6 months ago
smtp-keywords.rst	doc: move more examples to container:: example-rule	6 months ago
snmp-keywords.rst	snmp/detect: add snmp.trap_address keyword	4 months ago
ssh-keywords.rst	doc: move more examples to container:: example-rule	6 months ago
tag.rst	…
thresholding.rst	detect/detection_filter: add unique_on option	9 months ago
tls-keywords.rst	doc: move more examples to container:: example-rule	6 months ago
transforms.rst	doc/fixup: Fixup usages of container-example	4 months ago
vlan-keywords.rst	…
websocket-keywords.rst	detect/integers: generalize support for bitflags modifier	1 year ago
xbits.rst	doc: move more rules to dedicated css container	6 months ago