type
Data type: string, md5, sha256, ipv4, ip
data
- Data to add in serialized form (base64 for string, hex notation for md5/sha256, string representation for ipv4/ipv6)
+ Data to add in serialized form (base64 for string, hex notation for md5/sha256, string representation for ipv4/ip)
Example adding 'google.com' to set 'myset'::
type
Data type: string, md5, sha256, ipv4, ip
data
- Data to remove in serialized form (base64 for string, hex notation for md5/sha256, string representation for ipv4/ipv6)
+ Data to remove in serialized form (base64 for string, hex notation for md5/sha256, string representation for ipv4/ip)
dataset-clear
~~~~~~~~~~~~~
set name
Name of an already defined dataset
type
- Data type: string, md5, sha256
+ Data type: string, md5, sha256, ipv4, ip
dataset-lookup
~~~~~~~~~~~~~~
set name
Name of an already defined dataset
type
- Data type: string, md5, sha256
+ Data type: string, md5, sha256, ipv4, ip
data
- Data to test in serialized form (base64 for string, hex notation for md5/sha256)
+ Data to test in serialized form (base64 for string, hex notation for md5/sha256, string notation for ipv4/ip)
Example testing if 'google.com' is in the set 'myset'::
ipv4
in the file as string
ip
- in the file as string, it can be IPv6 or IPv4 address (in standard notation or in IPv4 in IPv6 one)
+ in the file as string, it can be IPv6 or IPv4 address (standard notation or IPv4 in IPv6 one)
dataset
{
sigmatch_table[DETECT_IPADDR_SRC].name = KEYWORD_NAME_SRC;
sigmatch_table[DETECT_IPADDR_SRC].desc = "Sticky buffer for src_ip";
+ sigmatch_table[DETECT_IPADDR_SRC].url = "/rules/ipaddr.html#ip-src";
sigmatch_table[DETECT_IPADDR_SRC].Setup = DetectSrcIPAddrBufferSetup;
#ifdef UNITTESTS
sigmatch_table[DETECT_IPADDR_SRC].RegisterTests = DetectIPAddrRegisterTests;
sigmatch_table[DETECT_IPADDR_DST].name = KEYWORD_NAME_DST;
sigmatch_table[DETECT_IPADDR_DST].desc = "Sticky buffer for dest_ip";
+ sigmatch_table[DETECT_IPADDR_DST].url = "/rules/ipaddr.html#ip-dst";
sigmatch_table[DETECT_IPADDR_DST].Setup = DetectDestIPAddrBufferSetup;
sigmatch_table[DETECT_IPADDR_DST].flags |= SIGMATCH_NOOPT | SIGMATCH_INFO_STICKY_BUFFER;