mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
4a655053e8
The mDNS support is based heavily on the DNS support, reusing the
existing DNS parser where possible. This meant adding variations on
DNS, as mDNS is a little different. Mainly being that *all* mDNS
traffic is to_server, yet there is still the concept of request and
responses.
Keywords added are:
- mdns.queries.rrname
- mdns.answers.rrname
- mdns.additionals.rrname
- mdns.authorities.rrname
- mdns.response.rrname
They are mostly in-line with the DNS keywords, except
mdns.answers.rdata which is a better than that mdns.response.rrname,
as its actually looking at the rdata, and not rrnames.
mDNS has its own logger that differs from the DNS logger:
- No grouped logging
- In answers/additionals/authorities, the rdata is logged in a field
that is named after the rdata type. For example, "txt" data is no
longer logged in the "rdata" field, but instead a "txt" field. We
currently already did this in DNS for fields that were not a single
buffer, like SOA, SRV, etc. So this makes things more consistent. And
gives query like semantics that the "grouped" object was trying to
provide.
- Types are logged in lower case ("txt" instead of "TXT")
- Flags are logged as an array: "flags": ["aa", "z"]
Ticket: #3952
|
1 year ago | |
|---|---|---|
| .. | ||
| dataset-examples | ||
| dns-keywords | ||
| fast-pattern | ||
| flow-keywords | ||
| header-keywords | ||
| http-keywords | ||
| intro | ||
| normalized-buffers | ||
| payload-keywords | ||
| pcre | ||
| rule-types | ||
| app-layer.rst | 2 years ago | |
| base64-keywords.rst | ||
| bypass-keyword.rst | 2 years ago | |
| config.rst | ||
| datasets.rst | ||
| dcerpc-keywords.rst | ||
| decode-layer.rst | ||
| dhcp-keywords.rst | ||
| differences-from-snort.rst | ||
| dnp3-keywords.rst | ||
| dns-keywords.rst | 2 years ago | |
| email-keywords.rst | 2 years ago | |
| enip-keyword.rst | ||
| fast-pattern-explained.rst | ||
| file-keywords.rst | ||
| flow-keywords.rst | ||
| ftp-keywords.rst | 1 year ago | |
| header-keywords.rst | ||
| http-keywords.rst | 1 year ago | |
| http2-keywords.rst | ||
| ike-keywords.rst | ||
| index.rst | 1 year ago | |
| integer-keywords.rst | ||
| intro.rst | 2 years ago | |
| ip-reputation-rules.rst | ||
| ipaddr.rst | ||
| ja-keywords.rst | ||
| kerberos-keywords.rst | ||
| ldap-keywords.rst | 2 years ago | |
| lua-detection.rst | 1 year ago | |
| mdns-keywords.rst | 1 year ago | |
| meta.rst | ||
| modbus-keyword.rst | ||
| mqtt-keywords.rst | ||
| multi-buffer-matching.rst | 2 years ago | |
| nfs-keywords.rst | ||
| noalert.rst | ||
| payload-keywords.rst | 2 years ago | |
| pgsql-keywords.rst | 1 year ago | |
| prefilter-keywords.rst | ||
| quic-keywords.rst | ||
| rfb-keywords.rst | ||
| rule-types.rst | ||
| sdp-keywords.rst | 2 years ago | |
| sip-keywords.rst | ||
| smb-keywords.rst | ||
| smtp-keywords.rst | ||
| snmp-keywords.rst | ||
| ssh-keywords.rst | 2 years ago | |
| tag.rst | ||
| thresholding.rst | ||
| tls-keywords.rst | 2 years ago | |
| transforms.rst | 1 year ago | |
| vlan-keywords.rst | ||
| websocket-keywords.rst | ||
| xbits.rst | ||