mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4a655053e8
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
|
1 year ago | |
|---|---|---|
| .. | ||
| 3rd-party-integration | ||
| _static | ||
| appendix | 2 years ago | |
| capture-hardware | 1 year ago | |
| configuration | 1 year ago | |
| devguide | 2 years ago | |
| file-extraction | 2 years ago | |
| firewall | 2 years ago | |
| licenses | ||
| lua | 1 year ago | |
| manpages | 2 years ago | |
| output | 1 year ago | |
| partials | 1 year ago | |
| performance | 2 years ago | |
| plugins | 2 years ago | |
| reputation | ||
| rule-management | 2 years ago | |
| rules | 1 year ago | |
| setting-up-ipsinline-for-linux | ||
| upgrade | 2 years ago | |
| .gitignore | 2 years ago | |
| Makefile.am | 2 years ago | |
| Makefile.sphinx | ||
| README.md | ||
| acknowledgements.rst | ||
| command-line-options.rst | ||
| conf.py | 2 years ago | |
| convert.py | ||
| docutils.conf | ||
| generate-evedoc.sh | 2 years ago | |
| index.rst | 2 years ago | |
| initscripts.rst | ||
| install.rst | 2 years ago | |
| make-sense-alerts.rst | ||
| public-data-sets.rst | 2 years ago | |
| quickstart.rst | 2 years ago | |
| requirements.txt | ||
| security.rst | ||
| setting-up-ipsinline-for-linux.rst | 2 years ago | |
| setting-up-ipsinline-for-windows.rst | ||
| support-status.rst | 3 years ago | |
| unix-socket.rst | 2 years ago | |
| upgrade.rst | 1 year ago | |
| verifying-source-files.rst | 2 years ago | |
| what-is-suricata.rst | ||
README.md
Suricata User Guide
This directory contains the Suricata Guide. The Suricata Developer's guide is included as a chapter of the Guide. The Sphinx Document Generator is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.
Verifying Changes
There are a number of output formats to choose from when making the source documentation locally (e.g. html, pdf, man).
The documentation source can be built with make -f Makefile.sphinx html. Substitute the 'html' word for desired output format.
There are different application dependencies based on the output desired.