From 8c9dfafc6d8406f373ad1578c1686735e9c23936 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 24 Mar 2025 13:25:25 +0100 Subject: [PATCH] doc/tls: add more detail on tls.random --- doc/userguide/rules/tls-keywords.rst | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index 0db3e1c049..f65689a067 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -261,7 +261,7 @@ You can specify several states with ``|`` (OR) to check for any of the specified tls.random ---------- -Matches on the 32 bytes of the TLS random field. +Matches on the 32 bytes of the TLS random field from the client hello or server hello records. Example:: @@ -273,7 +273,7 @@ Example:: tls.random_time --------------- -Matches on the first 4 bytes of the TLS random field. +Matches on the first 4 bytes of the TLS random field from the client hello or server hello records. Example:: @@ -285,7 +285,7 @@ Example:: tls.random_bytes ---------------- -Matches on the last 28 bytes of the TLS random field. +Matches on the last 28 bytes of the TLS random field from the client hello or server hello records. Example:: -- 2.47.3