<div class="literalblock">\r
<div class="content">\r
<pre><code> ,,_ -*> Snort++ <*-\r
-o" )~ Version 3.0.0-a2 (Build 177) from 2.9.7-177\r
+o" )~ Version 3.0.0-a3 (Build 182) from 2.9.7-177\r
'''' By Martin Roesch & The Snort Team\r
http://snort.org/contact#team\r
Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-lzma >= 5.1.2 from <a href="http://tukaani.org/xz/">http://tukaani.org/xz/</a> for decompression of SWF fles\r
+lzma >= 5.1.2 from <a href="http://tukaani.org/xz/">http://tukaani.org/xz/</a> for decompression of SWF and\r
+ PDF files\r
</p>\r
</li>\r
<li>\r
EXTERNAL_NET = '!' .. MY_SERVERS</code></pre>\r
</div></div>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_bugs">Bugs</h3>\r
-<div class="sect3">\r
-<h4 id="_build">Build</h4>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-configure will use clang<code> by default if it is installed.\r
- To compile with g</code> instead:\r
+configure will use clang<code> by default if it is installed. To compile\r
+ with g</code> instead:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
</li>\r
<li>\r
<p>\r
-clang coughs up these warnings:\r
+If you build with hyperscan on OS X and see:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>Wunused-but-set-variable is not understood by clang\r
-clang: warning: argument unused during compilation: '-pthread'</code></pre>\r
+<pre><code>dyld: Library not loaded: @rpath/libhs.4.0.dylib</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>when you try to run src/snort, export DYLD_LIBRARY_PATH with the path to\r
+libhs. You can also do:</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>install_name_tool -change @rpath/libhs.4.0.dylib \\r
+ /path-to/libhs.4.0.dylib src/snort</code></pre>\r
</div></div>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_bugs">Bugs</h3>\r
+<div class="sect3">\r
+<h4 id="_build">Build</h4>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
With cmake, make install will rebuild the docs even though when already\r
</li>\r
<li>\r
<p>\r
-It is not possible to build unit tests w/o static plugins.\r
+g++ 4.9.2 with -O3 reports:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>src/service_inspectors/back_orifice/back_orifice.cc:231:25: warning:\r
+iteration 930u invokes undefined behavior [-Waggressive-loop-optimizations]</code></pre>\r
+</div></div>\r
</li>\r
</ul></div>\r
</div>\r
<p>\r
There is a bug in pps_stream_tcp.cc.. when stream_tcp: is\r
specified without any arguments, snort2lua doesn’t convert it.\r
+ Same for stream_udp.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-alert_fast and alert_full: output configuration includes "file = <em>foo.bar</em>", but file is a bool\r
- and you cannot specify an output file name in the configuration.\r
+alert_fast and alert_full: output configuration includes "file =\r
+ <em>foo.bar</em>", but file is a bool and you cannot specify an output file name\r
+ in the configuration.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+preprocessor ports option: ports <number> not supported.\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
--B <mask> feature does not work. It does ordinary IP address obfuscation instead of using the\r
- mask.\r
+-B <mask> feature does not work. It does ordinary IP address obfuscation\r
+ instead of using the mask.\r
</p>\r
</li>\r
<li>\r
lines as a workaround).\r
</p>\r
</li>\r
+<li>\r
+<p>\r
+Stream TCP alert squash mechanism incorrectly squashes alerts for\r
+ different TCP packets.\r
+</p>\r
+</li>\r
</ul></div>\r
</div>\r
</div>\r
</li>\r
<li>\r
<p>\r
+int <strong>file_id.file_policy[].when.file_type_id</strong> = 0: unique ID for file type in file magic rule { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_policy[].when.sha256</strong>: SHA 256\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>file_id.file_policy[].use.verdict</strong> = unknown: what to do with matching traffic { unknown | log | stop | block | reset }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>file_id.file_policy[].use.enable_file_type</strong> = false: true/false → enable/disable file type identification\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>file_id.file_policy[].use.enable_file_signature</strong> = false: true/false → enable/disable file signature\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>file_id.file_policy[].use.enable_file_capture</strong> = false: true/false → enable/disable file capture\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
bool <strong>file_id.trace_type</strong> = false: enable runtime dump of type info\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_profiler">profiler</h3>\r
+<div class="paragraph"><p>What: configure profiling of rules and/or modules</p></div>\r
+<div class="paragraph"><p>Type: basic</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+bool <strong>profiler.modules.show</strong> = true: show module time profile stats\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>profiler.modules.count</strong> = 0: print results to given level (0 = all) { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>profiler.modules.sort</strong> = total_time: sort by given field { none | checks | avg_check | total_time }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>profiler.memory.show</strong> = true: show module memory profile stats\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>profiler.memory.count</strong> = 0: print results to given level (0 = all) { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>profiler.memory.sort</strong> = total_used: sort by given field { none | allocations | total_used | avg_allocation }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>profiler.rules.show</strong> = true: show rule time profile stats\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>profiler.rules.count</strong> = 0: print results to given level (0 = all) { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>profiler.rules.sort</strong> = total_time: sort by given field { none | checks | avg_check | total_time | matches | no_matches | avg_match | avg_no_match }\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_rate_filter">rate_filter</h3>\r
<div class="paragraph"><p>What: configure rate filters (which change rule actions)</p></div>\r
<div class="paragraph"><p>Type: basic</p></div>\r
</li>\r
<li>\r
<p>\r
-dynamic <strong>search_engine.search_method</strong> = ac_bnfa_q: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_bnfa_q | ac_full | ac_full_q | ac_sparse | ac_sparse_bands | ac_std }\r
+dynamic <strong>search_engine.search_method</strong> = ac_bnfa: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan }\r
</p>\r
</li>\r
<li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_dnp3">dnp3</h3>\r
+<div class="paragraph"><p>What: dnp3 inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+bool <strong>dnp3.check_crc</strong> = false: validate checksums in DNP3 link layer frames\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>145:1</strong> (dnp3) DNP3 Link-Layer Frame contains bad CRC.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:2</strong> (dnp3) DNP3 Link-Layer Frame was dropped.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:3</strong> (dnp3) DNP3 Transport-Layer Segment was dropped during reassembly.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:4</strong> (dnp3) DNP3 Reassembly Buffer was cleared without reassembling a complete message.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:5</strong> (dnp3) DNP3 Link-Layer Frame uses a reserved address.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:6</strong> (dnp3) DNP3 Application-Layer Fragment uses a reserved function code.\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>dnp3.total packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.udp packets</strong>: total udp packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.tcp pdus</strong>: total tcp pdus\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.dnp3 link layer frames</strong>: total dnp3 link layer frames\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.dnp3 application pdus</strong>: total dnp3 application pdus\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_dns">dns</h3>\r
<div class="paragraph"><p>What: dns inspection</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>imap.packets</strong>: total packets\r
+<strong>imap.packets</strong>: total packets processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.sessions</strong>: total imap sessions\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.b64 attachments</strong>: total base64 attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.b64 decoded bytes</strong>: total base64 decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.qp attachments</strong>: total quoted-printable attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.qp decoded bytes</strong>: total quoted-printable decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.uu attachments</strong>: total uu attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.uu decoded bytes</strong>: total uu decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.non-encoded attachments</strong>: total non-encoded attachments extracted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.non-encoded bytes</strong>: total non-encoded extracted bytes\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 trim</strong>: During inline mode, would have eth packets trimmed to datagram size\r
+<strong>normalizer.test ip4 trim</strong>: test eth packets trimmed to datagram size\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 tos</strong>: During inline mode, would have type of service normalizations\r
+<strong>normalizer.test ip4 tos</strong>: test type of service normalizations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 df</strong>: During inline mode, would have don’t frag bit normalizations\r
+<strong>normalizer.test ip4 df</strong>: test don’t frag bit normalizations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 rf</strong>: During inline mode, would have reserved flag bit clears\r
+<strong>normalizer.test ip4 rf</strong>: test reserved flag bit clears\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 ttl</strong>: During inline mode, would have time-to-live normalizations\r
+<strong>normalizer.test ip4 ttl</strong>: test time-to-live normalizations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 opts</strong>: During inline mode, would have ip4 options cleared\r
+<strong>normalizer.test ip4 opts</strong>: test ip4 options cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test icmp4 echo</strong>: During inline mode, would have icmp4 ping normalizations\r
+<strong>normalizer.test icmp4 echo</strong>: test icmp4 ping normalizations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip6 hops</strong>: During inline mode, would have ip6 hop limit normalizations\r
+<strong>normalizer.test ip6 hops</strong>: test ip6 hop limit normalizations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip6 options</strong>: During inline mode, would have ip6 options cleared\r
+<strong>normalizer.test ip6 options</strong>: test ip6 options cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test icmp6 echo</strong>: During inline mode, would have icmp6 echo normalizations\r
+<strong>normalizer.test icmp6 echo</strong>: test icmp6 echo normalizations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp syn options</strong>: During inline mode, would have SYN only options cleared from non-SYN packets\r
+<strong>normalizer.test tcp syn options</strong>: test SYN only options cleared from non-SYN packets\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp options</strong>: During inline mode, would have packets with options cleared\r
+<strong>normalizer.test tcp options</strong>: test packets with options cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp paddding</strong>: During inline mode, would have packets with padding cleared\r
+<strong>normalizer.test tcp paddding</strong>: test packets with padding cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp reserved</strong>: During inline mode, would have packets with reserved bits cleared\r
+<strong>normalizer.test tcp reserved</strong>: test packets with reserved bits cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp nonce</strong>: During inline mode, would have packets with nonce bit cleared\r
+<strong>normalizer.test tcp nonce</strong>: test packets with nonce bit cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp urgent ptr</strong>: During inline mode, would have packets without data with urgent pointer cleared\r
+<strong>normalizer.test tcp urgent ptr</strong>: test packets without data with urgent pointer cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ecn pkt</strong>: During inline mode, would have packets with ECN bits cleared\r
+<strong>normalizer.test tcp ecn pkt</strong>: test packets with ECN bits cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ts ecr</strong>: During inline mode, would have timestamp cleared on non-ACKs\r
+<strong>normalizer.test tcp ts ecr</strong>: test timestamp cleared on non-ACKs\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp req urg</strong>: During inline mode, would have cleared urgent pointer when urgent flag is not set\r
+<strong>normalizer.test tcp req urg</strong>: test cleared urgent pointer when urgent flag is not set\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp req pay</strong>: During inline mode, would have cleared urgent pointer and urgent flag when there is no payload\r
+<strong>normalizer.test tcp req pay</strong>: test cleared urgent pointer and urgent flag when there is no payload\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp req urp</strong>: During inline mode, would have cleared the urgent flag if the urgent pointer is not set\r
+<strong>normalizer.test tcp req urp</strong>: test cleared the urgent flag if the urgent pointer is not set\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim syn</strong>: During inline mode, would have tcp segments trimmed on SYN\r
+<strong>normalizer.test tcp trim syn</strong>: test tcp segments trimmed on SYN\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim rst</strong>: During inline mode, would have RST packets with data trimmed\r
+<strong>normalizer.test tcp trim rst</strong>: test RST packets with data trimmed\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim win</strong>: During inline mode, would have data trimed to window\r
+<strong>normalizer.test tcp trim win</strong>: test data trimed to window\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim mss</strong>: During inline mode, would have data trimmed to MSS\r
+<strong>normalizer.test tcp trim mss</strong>: test data trimmed to MSS\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ecn session</strong>: During inline mode, would have ECN bits cleared\r
+<strong>normalizer.test tcp ecn session</strong>: test ECN bits cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ts nop</strong>: During inline mode, would have timestamp options cleared\r
+<strong>normalizer.test tcp ts nop</strong>: test timestamp options cleared\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ips data</strong>: During inline mode, would have normalized segments\r
+<strong>normalizer.test tcp ips data</strong>: test normalized segments\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp block</strong>: During inline mode, would have blocked segments\r
+<strong>normalizer.test tcp block</strong>: test blocked segments\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-int <strong>perf_monitor.max_file_size</strong> = 4294967295: files will be rolled over if they exceed this size { 4096: }\r
+int <strong>perf_monitor.max_file_size</strong> = 1073741824: files will be rolled over if they exceed this size { 4096: }\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>pop.packets</strong>: total packets\r
+<strong>pop.packets</strong>: total packets processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.sessions</strong>: total pop sessions\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.b64 attachments</strong>: total base64 attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.b64 decoded bytes</strong>: total base64 decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.qp attachments</strong>: total quoted-printable attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.qp decoded bytes</strong>: total quoted-printable decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.uu attachments</strong>: total uu attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.uu decoded bytes</strong>: total uu decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.non-encoded attachments</strong>: total non-encoded attachments extracted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>pop.non-encoded bytes</strong>: total non-encoded extracted bytes\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_rpc_decode">rpc_decode</h3>\r
-<div class="paragraph"><p>What: RPC inspector</p></div>\r
+<h3 id="_reputation">reputation</h3>\r
+<div class="paragraph"><p>What: reputation inspection</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>106:1</strong> (rpc_decode) fragmented RPC records\r
+string <strong>reputation.blacklist</strong>: blacklist file name with ip lists\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>106:2</strong> (rpc_decode) multiple RPC records\r
+int <strong>reputation.memcap</strong> = 500: maximum total memory allocated { 1:4095 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>106:3</strong> (rpc_decode) large RPC record fragment\r
+enum <strong>reputation.nested_ip</strong> = inner: ip to use when there is IP encapsulation { inner|outer|all }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>106:4</strong> (rpc_decode) incomplete RPC segment\r
+enum <strong>reputation.priority</strong> = whitelist: defines priority when there is a decision conflict during run-time { blacklist|whitelist }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>106:5</strong> (rpc_decode) zero-length RPC fragment\r
+bool <strong>reputation.scan_local</strong> = false: inspect local address defined in RFC 1918\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>rpc_decode.packets</strong>: total packets\r
+enum <strong>reputation.white</strong> = unblack: specify the meaning of whitelist { unblack|trust }\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_sip">sip</h3>\r
-<div class="paragraph"><p>What: sip inspection</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>sip.ignore_call_channel</strong> = false: enables the support for ignoring audio/video data channel\r
+string <strong>reputation.whitelist</strong>: whitelist file name with ip lists\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>sip.max_call_id_len</strong> = 256: maximum call id field size { 0:65535 }\r
+<strong>136:1</strong> (reputation) packets blacklisted\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>sip.max_contact_len</strong> = 256: maximum contact field size { 0:65535 }\r
+<strong>136:2</strong> (reputation) Packets whitelisted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>136:3</strong> (reputation) Packets monitored\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>reputation.packets</strong>: total packets processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>reputation.blacklisted</strong>: number of packets blacklisted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>reputation.whitelisted</strong>: number of packets whitelisted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>reputation.monitored</strong>: number of packets monitored\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>reputation.memory_allocated</strong>: total memory allocated\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_rpc_decode">rpc_decode</h3>\r
+<div class="paragraph"><p>What: RPC inspector</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>106:1</strong> (rpc_decode) fragmented RPC records\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>106:2</strong> (rpc_decode) multiple RPC records\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>106:3</strong> (rpc_decode) large RPC record fragment\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>106:4</strong> (rpc_decode) incomplete RPC segment\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>106:5</strong> (rpc_decode) zero-length RPC fragment\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>rpc_decode.packets</strong>: total packets\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_sip">sip</h3>\r
+<div class="paragraph"><p>What: sip inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+bool <strong>sip.ignore_call_channel</strong> = false: enables the support for ignoring audio/video data channel\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>sip.max_call_id_len</strong> = 256: maximum call id field size { 0:65535 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>sip.max_contact_len</strong> = 256: maximum contact field size { 0:65535 }\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
+<strong>sip.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>sip.sessions</strong>: total sessions\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.requests</strong>: total requests\r
+<strong>sip.total requests</strong>: total requests\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.invite</strong>: invite\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.cancel</strong>: cancel\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.ack</strong>: ack\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.bye</strong>: bye\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.register</strong>: register\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.options</strong>: options\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.refer</strong>: refer\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.subscribe</strong>: subscribe\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.update</strong>: update\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.join</strong>: join\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.info</strong>: info\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.message</strong>: message\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.notify</strong>: notify\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.prack</strong>: prack\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.total responses</strong>: total responses\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.1xx</strong>: 1xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.2xx</strong>: 2xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.3xx</strong>: 3xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.4xx</strong>: 4xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.5xx</strong>: 5xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.6xx</strong>: 6xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.7xx</strong>: 7xx\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>sip.8xx</strong>: 8xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.responses</strong>: total responses\r
+<strong>sip.9xx</strong>: 9xx\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>smtp.packets</strong>: total packets\r
+<strong>smtp.packets</strong>: total packets processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.sessions</strong>: total smtp sessions\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.concurrent sessions</strong>: total concurrent smtp sessions\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.max concurrent sessions</strong>: maximum concurrent smtp sessions\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.b64 attachments</strong>: total base64 attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.b64 decoded bytes</strong>: total base64 decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.qp attachments</strong>: total quoted-printable attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.qp decoded bytes</strong>: total quoted-printable decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.uu attachments</strong>: total uu attachments decoded\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.uu decoded bytes</strong>: total uu decoded bytes\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.non-encoded attachments</strong>: total non-encoded attachments extracted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>smtp.non-encoded bytes</strong>: total non-encoded extracted bytes\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_dsize">dsize</h3>\r
-<div class="paragraph"><p>What: rule option to test payload size</p></div>\r
+<h3 id="_dnp3_data">dnp3_data</h3>\r
+<div class="paragraph"><p>What: sets the cursor to dnp3 data</p></div>\r
+<div class="paragraph"><p>Type: ips_option</p></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_dnp3_func">dnp3_func</h3>\r
+<div class="paragraph"><p>What: detection option to check dnp3 function code</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-string <strong>dsize.~range</strong>: check if packet payload size is <em>size | min<>max | <max | >min</em>\r
+string <strong>dnp3_func.~</strong>: match dnp3 function code or name\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_file_data">file_data</h3>\r
-<div class="paragraph"><p>What: rule option to set detection cursor to file data</p></div>\r
+<h3 id="_dnp3_ind">dnp3_ind</h3>\r
+<div class="paragraph"><p>What: detection option to check dnp3 indicator flags</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+string <strong>dnp3_ind.~</strong>: match given dnp3 indicator flags\r
+</p>\r
+</li>\r
+</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_flags">flags</h3>\r
-<div class="paragraph"><p>What: rule option to test TCP control flags</p></div>\r
+<h3 id="_dnp3_obj">dnp3_obj</h3>\r
+<div class="paragraph"><p>What: detection option to check dnp3 object headers</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-string <strong>flags.~test_flags</strong>: these flags are tested\r
+int <strong>dnp3_obj.group</strong> = 0: match given dnp3 object header group { 0:255 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>flags.~mask_flags</strong>: these flags are don’t cares\r
+int <strong>dnp3_obj.var</strong> = 0: match given dnp3 object header var { 0:255 }\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_flow">flow</h3>\r
-<div class="paragraph"><p>What: rule option to check session properties</p></div>\r
+<h3 id="_dsize">dsize</h3>\r
+<div class="paragraph"><p>What: rule option to test payload size</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>flow.to_client</strong>: match on server responses\r
+string <strong>dsize.~range</strong>: check if packet payload size is <em>size | min<>max | <max | >min</em>\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_file_data">file_data</h3>\r
+<div class="paragraph"><p>What: rule option to set detection cursor to file data</p></div>\r
+<div class="paragraph"><p>Type: ips_option</p></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_flags">flags</h3>\r
+<div class="paragraph"><p>What: rule option to test TCP control flags</p></div>\r
+<div class="paragraph"><p>Type: ips_option</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+string <strong>flags.~test_flags</strong>: these flags are tested\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>flags.~mask_flags</strong>: these flags are don’t cares\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_flow">flow</h3>\r
+<div class="paragraph"><p>What: rule option to check session properties</p></div>\r
+<div class="paragraph"><p>Type: ips_option</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+implied <strong>flow.to_client</strong>: match on server responses\r
</p>\r
</li>\r
<li>\r
</div>\r
<div class="sect2">\r
<h3 id="_pcre">pcre</h3>\r
-<div class="paragraph"><p>What: rule option for matching payload data with regex</p></div>\r
+<div class="paragraph"><p>What: rule option for matching payload data with pcre</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-string <strong>pcre.~regex</strong>: Snort regular expression\r
+string <strong>pcre.~re</strong>: Snort regular expression\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
+<h3 id="_regex">regex</h3>\r
+<div class="paragraph"><p>What: rule option for matching payload data with hyperscan regex</p></div>\r
+<div class="paragraph"><p>Type: ips_option</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+string <strong>regex.~re</strong>: hyperscan regular expression\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.nocase</strong>: case insensitive match\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.dotall</strong>: matching a . will not exclude newlines\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.multiline</strong>: ^ and $ anchors match any newlines in data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.relative</strong>: start search from end of last match instead of start of buffer\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
<h3 id="_rem">rem</h3>\r
<div class="paragraph"><p>What: rule option to convey an arbitrary comment in the rule body</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
</li>\r
<li>\r
<p>\r
-multi <strong>alert_csv.fields</strong> = timestamp pkt_num proto pkt_gen dgm_len dir src_ap dst_ap rule action: selected fields will be output in given order left to right { action | dir | dgm_len | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len | msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr | src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp | tos | ttl | udp_len }\r
+multi <strong>alert_csv.fields</strong> = timestamp pkt_num proto pkt_gen dgm_len dir src_ap dst_ap rule action: selected fields will be output in given order left to right { action | dir | dgm_len | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid | icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id | ip_len | msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr | src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp | tos | ttl | udp_len }\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>--enable-ppm</strong>: enable packet and rule performance monitoring and coarse\r
- latency enforcement.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>--enable-perf-profiling</strong>: enable module and rule performance profiling.\r
+<strong>--enable-ppm</strong>: enable building packet and rule performance monitoring\r
+ and coarse latency enforcement.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>--enable-shell</strong>: enable local and remote command line shell support.\r
+<strong>--enable-shell</strong>: enable building local and remote command line shell\r
+ support.\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>lzma</strong>: from <a href="http://www.7-zip.org/sdk.html">http://www.7-zip.org/sdk.html</a> for decompression of SWF fles.\r
+<strong>lzma</strong>: for decompression of SWF and PDF files.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>openssl</strong>: from <a href="https://www.openssl.org">https://www.openssl.org</a> for SHA and MD5 file signatures and\r
- the protected_content rule option.\r
+<strong>openssl</strong>: for SHA and MD5 file signatures and the protected_content rule\r
+ option.\r
</p>\r
</li>\r
<li>\r
Intel.\r
</p>\r
</li>\r
+<li>\r
+<p>\r
+hyperscan for the regex rule option and hyperscan search engine.\r
+</p>\r
+</li>\r
</ul></div>\r
<div class="paragraph"><p>If you need to use headers and/or libraries in non-standard locations, you\r
can use these options:</p></div>\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>These can be use for pcap, luajit, pcre, dnet, daq, lzma, openssl, and\r
-intel-soft-cpm packages.</p></div>\r
+<div class="paragraph"><p>These can be use for pcap, luajit, pcre, dnet, daq, lzma, openssl,\r
+intel-soft-cpm, and hyperscan packages. For more information on these\r
+libraries see the Getting Started section of the manual.</p></div>\r
</div>\r
<div class="sect2">\r
<h3 id="_environment_variables">Environment Variables</h3>\r
</li>\r
<li>\r
<p>\r
-multi <strong>alert_csv.fields</strong> = timestamp pkt_num proto pkt_gen dgm_len dir src_ap dst_ap rule action: selected fields will be output in given order left to right { action | dir | dgm_len | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len | msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr | src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp | tos | ttl | udp_len }\r
+multi <strong>alert_csv.fields</strong> = timestamp pkt_num proto pkt_gen dgm_len dir src_ap dst_ap rule action: selected fields will be output in given order left to right { action | dir | dgm_len | dst_addr | dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid | icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id | ip_len | msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr | src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq | tcp_win | timestamp | tos | ttl | udp_len }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+bool <strong>dnp3.check_crc</strong> = false: validate checksums in DNP3 link layer frames\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>dnp3_func.~</strong>: match dnp3 function code or name\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>dnp3_ind.~</strong>: match given dnp3 indicator flags\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>dnp3_obj.group</strong> = 0: match given dnp3 object header group { 0:255 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>dnp3_obj.var</strong> = 0: match given dnp3 object header var { 0:255 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>dpx.max</strong> = 0: maximum payload before alert { 0:65535 }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+bool <strong>file_id.file_policy[].use.enable_file_capture</strong> = false: true/false → enable/disable file capture\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>file_id.file_policy[].use.enable_file_signature</strong> = false: true/false → enable/disable file signature\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>file_id.file_policy[].use.enable_file_type</strong> = false: true/false → enable/disable file type identification\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>file_id.file_policy[].use.verdict</strong> = unknown: what to do with matching traffic { unknown | log | stop | block | reset }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>file_id.file_policy[].when.file_type_id</strong> = 0: unique ID for file type in file magic rule { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>file_id.file_policy[].when.sha256</strong>: SHA 256\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
string <strong>file_id.file_rules[].category</strong>: file type category\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>lowmem_q.var</strong>: additional print text\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>md5.length</strong>: number of octets in plain text { 1:65535 }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>pcre.~regex</strong>: Snort regular expression\r
+string <strong>pcre.~re</strong>: Snort regular expression\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>perf_monitor.max_file_size</strong> = 4294967295: files will be rolled over if they exceed this size { 4096: }\r
+int <strong>perf_monitor.max_file_size</strong> = 1073741824: files will be rolled over if they exceed this size { 4096: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+int <strong>profiler.memory.count</strong> = 0: print results to given level (0 = all) { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>profiler.memory.show</strong> = true: show module memory profile stats\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>profiler.memory.sort</strong> = total_used: sort by given field { none | allocations | total_used | avg_allocation }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>profiler.modules.count</strong> = 0: print results to given level (0 = all) { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>profiler.modules.show</strong> = true: show module time profile stats\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>profiler.modules.sort</strong> = total_time: sort by given field { none | checks | avg_check | total_time }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>profiler.rules.count</strong> = 0: print results to given level (0 = all) { 0: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>profiler.rules.show</strong> = true: show rule time profile stats\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>profiler.rules.sort</strong> = total_time: sort by given field { none | checks | avg_check | total_time | matches | no_matches | avg_match | avg_no_match }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
string <strong>rate_filter[].apply_to</strong>: restrict filter to these addresses according to track\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+implied <strong>regex.dotall</strong>: matching a . will not exclude newlines\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.multiline</strong>: ^ and $ anchors match any newlines in data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.nocase</strong>: case insensitive match\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+implied <strong>regex.relative</strong>: start search from end of last match instead of start of buffer\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>regex.~re</strong>: hyperscan regular expression\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
enum <strong>reject.control</strong>: send icmp unreachable(s) { network|host|port|all }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+string <strong>reputation.blacklist</strong>: blacklist file name with ip lists\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>reputation.memcap</strong> = 500: maximum total memory allocated { 1:4095 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>reputation.nested_ip</strong> = inner: ip to use when there is IP encapsulation { inner|outer|all }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>reputation.priority</strong> = whitelist: defines priority when there is a decision conflict during run-time { blacklist|whitelist }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bool <strong>reputation.scan_local</strong> = false: inspect local address defined in RFC 1918\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>reputation.white</strong> = unblack: specify the meaning of whitelist { unblack|trust }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+string <strong>reputation.whitelist</strong>: whitelist file name with ip lists\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>rev.~</strong>: revision { 1: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-dynamic <strong>search_engine.search_method</strong> = ac_bnfa_q: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_bnfa_q | ac_full | ac_full_q | ac_sparse | ac_sparse_bands | ac_std | lowmem | lowmem_q }\r
+dynamic <strong>search_engine.search_method</strong> = ac_bnfa: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan | lowmem }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.internal blacklist</strong>: packets blacklisted internally due to lack of DAQ support\r
+<strong>daq.internal blacklist</strong>: packets blacklisted internally due to lack of DAQ support\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.internal whitelist</strong>: packets whitelisted internally due to lack of DAQ support\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.outstanding</strong>: packets unprocessed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.pcaps</strong>: total files and interfaces processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.received</strong>: total packets received from DAQ\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.replace</strong>: total replace verdicts\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.skipped</strong>: packets skipped at startup\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>daq.whitelist</strong>: total whitelist verdicts\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>data_log.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.alert limit</strong>: events previously triggered on same PDU\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.alerts</strong>: alerts not including IP reputation\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.alt searches</strong>: alt fast pattern searches in packet data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.analyzed</strong>: packets sent to detection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.body searches</strong>: fast pattern searches in body buffer\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.cooked searches</strong>: fast pattern searches in cooked packet data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.event limit</strong>: events filtered\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.file searches</strong>: fast pattern searches in file buffer\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.header searches</strong>: fast pattern searches in header buffer\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.key searches</strong>: fast pattern searches in key buffer\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.log limit</strong>: events queued but not logged\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.logged</strong>: logged packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.match limit</strong>: fast pattern matches not processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.passed</strong>: passed packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.pkt searches</strong>: fast pattern searches in packet data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.queue limit</strong>: events not queued because queue full\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.raw searches</strong>: fast pattern searches in raw packet data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.slow searches</strong>: non-fast pattern rule evaluations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>detection.total alerts</strong>: alerts including IP reputation\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.dnp3 application pdus</strong>: total dnp3 application pdus\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.dnp3 link layer frames</strong>: total dnp3 link layer frames\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.tcp pdus</strong>: total tcp pdus\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.total packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3.udp packets</strong>: total udp packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dns.packets</strong>: total packets processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dns.requests</strong>: total dns requests\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dns.responses</strong>: total dns responses\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dpx.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>ftp_data.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>ftp_server.packets</strong>: total packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>gtp_inspect.events</strong>: requests\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>gtp_inspect.sessions</strong>: total sessions processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>gtp_inspect.unknown infos</strong>: unknown information elements\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>gtp_inspect.unknown types</strong>: unknown message types\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.compressed bytes</strong>: total comparessed bytes processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.decompressed bytes</strong>: total bytes decompressed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.double unicode</strong>: double unicode normalizations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.gets</strong>: GET requests\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.gzip packets</strong>: packets with gzip compression\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.non-ascii</strong>: non-ascii normalizations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.packets</strong>: total packets processed\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.paths with ../</strong>: directory traversal normalizations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.paths with ./</strong>: relative directory normalizations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.paths with //</strong>: double slash normalizations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.post params</strong>: POST parameters extracted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.posts</strong>: POST requests\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.request cookies</strong>: requests with Cookie\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.request headers</strong>: total requests\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.response cookies</strong>: responses with Set-Cookie\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.response headers</strong>: total responses\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>http_global.unicode</strong>: unicode normalizations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>icmp4.bad checksum</strong>: non-zero icmp checksums\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>icmp6.bad checksum (ip4)</strong>: nonzero ipcm4 checksums\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>icmp6.bad checksum (ip6)</strong>: nonzero ipcm6 checksums\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>imap.b64 attachments</strong>: total base64 attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.internal whitelist</strong>: packets whitelisted internally due to lack of DAQ support\r
+<strong>imap.b64 decoded bytes</strong>: total base64 decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.outstanding</strong>: packets unprocessed\r
+<strong>imap.non-encoded attachments</strong>: total non-encoded attachments extracted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.pcaps</strong>: total files and interfaces processed\r
+<strong>imap.non-encoded bytes</strong>: total non-encoded extracted bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.received</strong>: total packets received from DAQ\r
+<strong>imap.packets</strong>: total packets processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.replace</strong>: total replace verdicts\r
+<strong>imap.qp attachments</strong>: total quoted-printable attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.skipped</strong>: packets skipped at startup\r
+<strong>imap.qp decoded bytes</strong>: total quoted-printable decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>daq.whitelist</strong>: total whitelist verdicts\r
+<strong>imap.sessions</strong>: total imap sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>data_log.packets</strong>: total packets\r
+<strong>imap.uu attachments</strong>: total uu attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.alert limit</strong>: events previously triggered on same PDU\r
+<strong>imap.uu decoded bytes</strong>: total uu decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.alerts</strong>: alerts not including IP reputation\r
+<strong>ipv4.bad checksum</strong>: nonzero ip checksums\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.alt searches</strong>: alt fast pattern searches in packet data\r
+<strong>modbus.frames</strong>: total Modbus messages\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.analyzed</strong>: packets sent to detection\r
+<strong>modbus.sessions</strong>: total sessions processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.body searches</strong>: fast pattern searches in body buffer\r
+<strong>normalizer.icmp4 echo</strong>: icmp4 ping normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.cooked searches</strong>: fast pattern searches in cooked packet data\r
+<strong>normalizer.icmp6 echo</strong>: icmp6 echo normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.event limit</strong>: events filtered\r
+<strong>normalizer.ip4 df</strong>: don’t frag bit normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.file searches</strong>: fast pattern searches in file buffer\r
+<strong>normalizer.ip4 opts</strong>: ip4 options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.header searches</strong>: fast pattern searches in header buffer\r
+<strong>normalizer.ip4 rf</strong>: reserved flag bit clears\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.key searches</strong>: fast pattern searches in key buffer\r
+<strong>normalizer.ip4 tos</strong>: type of service normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.log limit</strong>: events queued but not logged\r
+<strong>normalizer.ip4 trim</strong>: eth packets trimmed to datagram size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.logged</strong>: logged packets\r
+<strong>normalizer.ip4 ttl</strong>: time-to-live normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.match limit</strong>: fast pattern matches not processed\r
+<strong>normalizer.ip6 hops</strong>: ip6 hop limit normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.passed</strong>: passed packets\r
+<strong>normalizer.ip6 options</strong>: ip6 options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.pkt searches</strong>: fast pattern searches in packet data\r
+<strong>normalizer.tcp block</strong>: blocked segments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.queue limit</strong>: events not queued because queue full\r
+<strong>normalizer.tcp ecn pkt</strong>: packets with ECN bits cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.raw searches</strong>: fast pattern searches in raw packet data\r
+<strong>normalizer.tcp ecn session</strong>: ECN bits cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.slow searches</strong>: non-fast pattern rule evaluations\r
+<strong>normalizer.tcp ips data</strong>: normalized segments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.total alerts</strong>: alerts including IP reputation\r
+<strong>normalizer.tcp nonce</strong>: packets with nonce bit cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dns.packets</strong>: total packets processed\r
+<strong>normalizer.tcp options</strong>: packets with options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dns.requests</strong>: total dns requests\r
+<strong>normalizer.tcp paddding</strong>: packets with padding cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dns.responses</strong>: total dns responses\r
+<strong>normalizer.tcp req pay</strong>: cleared urgent pointer and urgent flag when there is no payload\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dpx.packets</strong>: total packets\r
+<strong>normalizer.tcp req urg</strong>: cleared urgent pointer when urgent flag is not set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>ftp_data.packets</strong>: total packets\r
+<strong>normalizer.tcp req urp</strong>: cleared the urgent flag if the urgent pointer is not set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>ftp_server.packets</strong>: total packets\r
+<strong>normalizer.tcp reserved</strong>: packets with reserved bits cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>gtp_inspect.events</strong>: requests\r
+<strong>normalizer.tcp syn options</strong>: SYN only options cleared from non-SYN packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>gtp_inspect.sessions</strong>: total sessions processed\r
+<strong>normalizer.tcp trim mss</strong>: data trimmed to MSS\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>gtp_inspect.unknown infos</strong>: unknown information elements\r
+<strong>normalizer.tcp trim rst</strong>: RST packets with data trimmed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>gtp_inspect.unknown types</strong>: unknown message types\r
+<strong>normalizer.tcp trim syn</strong>: tcp segments trimmed on SYN\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.compressed bytes</strong>: total comparessed bytes processed\r
+<strong>normalizer.tcp trim win</strong>: data trimed to window\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.decompressed bytes</strong>: total bytes decompressed\r
+<strong>normalizer.tcp ts ecr</strong>: timestamp cleared on non-ACKs\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.double unicode</strong>: double unicode normalizations\r
+<strong>normalizer.tcp ts nop</strong>: timestamp options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.gets</strong>: GET requests\r
+<strong>normalizer.tcp urgent ptr</strong>: packets without data with urgent pointer cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.gzip packets</strong>: packets with gzip compression\r
+<strong>normalizer.test icmp4 echo</strong>: test icmp4 ping normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.non-ascii</strong>: non-ascii normalizations\r
+<strong>normalizer.test icmp6 echo</strong>: test icmp6 echo normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.packets</strong>: total packets processed\r
+<strong>normalizer.test ip4 df</strong>: test don’t frag bit normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.paths with ../</strong>: directory traversal normalizations\r
+<strong>normalizer.test ip4 opts</strong>: test ip4 options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.paths with ./</strong>: relative directory normalizations\r
+<strong>normalizer.test ip4 rf</strong>: test reserved flag bit clears\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.paths with //</strong>: double slash normalizations\r
+<strong>normalizer.test ip4 tos</strong>: test type of service normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.post params</strong>: POST parameters extracted\r
+<strong>normalizer.test ip4 trim</strong>: test eth packets trimmed to datagram size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.posts</strong>: POST requests\r
+<strong>normalizer.test ip4 ttl</strong>: test time-to-live normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.request cookies</strong>: requests with Cookie\r
+<strong>normalizer.test ip6 hops</strong>: test ip6 hop limit normalizations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.request headers</strong>: total requests\r
+<strong>normalizer.test ip6 options</strong>: test ip6 options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.response cookies</strong>: responses with Set-Cookie\r
+<strong>normalizer.test tcp block</strong>: test blocked segments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.response headers</strong>: total responses\r
+<strong>normalizer.test tcp ecn pkt</strong>: test packets with ECN bits cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>http_global.unicode</strong>: unicode normalizations\r
+<strong>normalizer.test tcp ecn session</strong>: test ECN bits cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>icmp4.bad checksum</strong>: non-zero icmp checksums\r
+<strong>normalizer.test tcp ips data</strong>: test normalized segments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>icmp6.bad checksum (ip4)</strong>: nonzero ipcm4 checksums\r
+<strong>normalizer.test tcp nonce</strong>: test packets with nonce bit cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>icmp6.bad checksum (ip6)</strong>: nonzero ipcm6 checksums\r
+<strong>normalizer.test tcp options</strong>: test packets with options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>imap.packets</strong>: total packets\r
+<strong>normalizer.test tcp paddding</strong>: test packets with padding cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>ipv4.bad checksum</strong>: nonzero ip checksums\r
+<strong>normalizer.test tcp req pay</strong>: test cleared urgent pointer and urgent flag when there is no payload\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>modbus.frames</strong>: total Modbus messages\r
+<strong>normalizer.test tcp req urg</strong>: test cleared urgent pointer when urgent flag is not set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>modbus.sessions</strong>: total sessions processed\r
+<strong>normalizer.test tcp req urp</strong>: test cleared the urgent flag if the urgent pointer is not set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.icmp4 echo</strong>: icmp4 ping normalizations\r
+<strong>normalizer.test tcp reserved</strong>: test packets with reserved bits cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.icmp6 echo</strong>: icmp6 echo normalizations\r
+<strong>normalizer.test tcp syn options</strong>: test SYN only options cleared from non-SYN packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip4 df</strong>: don’t frag bit normalizations\r
+<strong>normalizer.test tcp trim mss</strong>: test data trimmed to MSS\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip4 opts</strong>: ip4 options cleared\r
+<strong>normalizer.test tcp trim rst</strong>: test RST packets with data trimmed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip4 rf</strong>: reserved flag bit clears\r
+<strong>normalizer.test tcp trim syn</strong>: test tcp segments trimmed on SYN\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip4 tos</strong>: type of service normalizations\r
+<strong>normalizer.test tcp trim win</strong>: test data trimed to window\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip4 trim</strong>: eth packets trimmed to datagram size\r
+<strong>normalizer.test tcp ts ecr</strong>: test timestamp cleared on non-ACKs\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip4 ttl</strong>: time-to-live normalizations\r
+<strong>normalizer.test tcp ts nop</strong>: test timestamp options cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip6 hops</strong>: ip6 hop limit normalizations\r
+<strong>normalizer.test tcp urgent ptr</strong>: test packets without data with urgent pointer cleared\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.ip6 options</strong>: ip6 options cleared\r
+<strong>perf_monitor.packets</strong>: total packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp block</strong>: blocked segments\r
+<strong>pop.b64 attachments</strong>: total base64 attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp ecn pkt</strong>: packets with ECN bits cleared\r
+<strong>pop.b64 decoded bytes</strong>: total base64 decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp ecn session</strong>: ECN bits cleared\r
+<strong>pop.non-encoded attachments</strong>: total non-encoded attachments extracted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp ips data</strong>: normalized segments\r
+<strong>pop.non-encoded bytes</strong>: total non-encoded extracted bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp nonce</strong>: packets with nonce bit cleared\r
+<strong>pop.packets</strong>: total packets processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp options</strong>: packets with options cleared\r
+<strong>pop.qp attachments</strong>: total quoted-printable attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp paddding</strong>: packets with padding cleared\r
+<strong>pop.qp decoded bytes</strong>: total quoted-printable decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp req pay</strong>: cleared urgent pointer and urgent flag when there is no payload\r
+<strong>pop.sessions</strong>: total pop sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp req urg</strong>: cleared urgent pointer when urgent flag is not set\r
+<strong>pop.uu attachments</strong>: total uu attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp req urp</strong>: cleared the urgent flag if the urgent pointer is not set\r
+<strong>pop.uu decoded bytes</strong>: total uu decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp reserved</strong>: packets with reserved bits cleared\r
+<strong>port_scan_global.packets</strong>: total packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp syn options</strong>: SYN only options cleared from non-SYN packets\r
+<strong>reputation.blacklisted</strong>: number of packets blacklisted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp trim mss</strong>: data trimmed to MSS\r
+<strong>reputation.memory_allocated</strong>: total memory allocated\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp trim rst</strong>: RST packets with data trimmed\r
+<strong>reputation.monitored</strong>: number of packets monitored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp trim syn</strong>: tcp segments trimmed on SYN\r
+<strong>reputation.packets</strong>: total packets processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp trim win</strong>: data trimed to window\r
+<strong>reputation.whitelisted</strong>: number of packets whitelisted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp ts ecr</strong>: timestamp cleared on non-ACKs\r
+<strong>rpc_decode.packets</strong>: total packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp ts nop</strong>: timestamp options cleared\r
+<strong>sip.1xx</strong>: 1xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.tcp urgent ptr</strong>: packets without data with urgent pointer cleared\r
+<strong>sip.2xx</strong>: 2xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test icmp4 echo</strong>: During inline mode, would have icmp4 ping normalizations\r
+<strong>sip.3xx</strong>: 3xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test icmp6 echo</strong>: During inline mode, would have icmp6 echo normalizations\r
+<strong>sip.4xx</strong>: 4xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 df</strong>: During inline mode, would have don’t frag bit normalizations\r
+<strong>sip.5xx</strong>: 5xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 opts</strong>: During inline mode, would have ip4 options cleared\r
+<strong>sip.6xx</strong>: 6xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 rf</strong>: During inline mode, would have reserved flag bit clears\r
+<strong>sip.7xx</strong>: 7xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 tos</strong>: During inline mode, would have type of service normalizations\r
+<strong>sip.8xx</strong>: 8xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 trim</strong>: During inline mode, would have eth packets trimmed to datagram size\r
+<strong>sip.9xx</strong>: 9xx\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip4 ttl</strong>: During inline mode, would have time-to-live normalizations\r
+<strong>sip.ack</strong>: ack\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip6 hops</strong>: During inline mode, would have ip6 hop limit normalizations\r
+<strong>sip.bye</strong>: bye\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test ip6 options</strong>: During inline mode, would have ip6 options cleared\r
+<strong>sip.cancel</strong>: cancel\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp block</strong>: During inline mode, would have blocked segments\r
+<strong>sip.dialogs</strong>: total dialogs\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ecn pkt</strong>: During inline mode, would have packets with ECN bits cleared\r
+<strong>sip.events</strong>: events generated\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ecn session</strong>: During inline mode, would have ECN bits cleared\r
+<strong>sip.ignored channels</strong>: total channels ignored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ips data</strong>: During inline mode, would have normalized segments\r
+<strong>sip.ignored sessions</strong>: total sessions ignored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp nonce</strong>: During inline mode, would have packets with nonce bit cleared\r
+<strong>sip.info</strong>: info\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp options</strong>: During inline mode, would have packets with options cleared\r
+<strong>sip.invite</strong>: invite\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp paddding</strong>: During inline mode, would have packets with padding cleared\r
+<strong>sip.join</strong>: join\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp req pay</strong>: During inline mode, would have cleared urgent pointer and urgent flag when there is no payload\r
+<strong>sip.message</strong>: message\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp req urg</strong>: During inline mode, would have cleared urgent pointer when urgent flag is not set\r
+<strong>sip.notify</strong>: notify\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp req urp</strong>: During inline mode, would have cleared the urgent flag if the urgent pointer is not set\r
+<strong>sip.options</strong>: options\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp reserved</strong>: During inline mode, would have packets with reserved bits cleared\r
+<strong>sip.packets</strong>: total packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp syn options</strong>: During inline mode, would have SYN only options cleared from non-SYN packets\r
+<strong>sip.prack</strong>: prack\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim mss</strong>: During inline mode, would have data trimmed to MSS\r
+<strong>sip.refer</strong>: refer\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim rst</strong>: During inline mode, would have RST packets with data trimmed\r
+<strong>sip.register</strong>: register\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim syn</strong>: During inline mode, would have tcp segments trimmed on SYN\r
+<strong>sip.sessions</strong>: total sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp trim win</strong>: During inline mode, would have data trimed to window\r
+<strong>sip.subscribe</strong>: subscribe\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ts ecr</strong>: During inline mode, would have timestamp cleared on non-ACKs\r
+<strong>sip.total requests</strong>: total requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp ts nop</strong>: During inline mode, would have timestamp options cleared\r
+<strong>sip.total responses</strong>: total responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>normalizer.test tcp urgent ptr</strong>: During inline mode, would have packets without data with urgent pointer cleared\r
+<strong>sip.update</strong>: update\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>perf_monitor.packets</strong>: total packets\r
+<strong>smtp.b64 attachments</strong>: total base64 attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>pop.packets</strong>: total packets\r
+<strong>smtp.b64 decoded bytes</strong>: total base64 decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>port_scan_global.packets</strong>: total packets\r
+<strong>smtp.concurrent sessions</strong>: total concurrent smtp sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>rpc_decode.packets</strong>: total packets\r
+<strong>smtp.max concurrent sessions</strong>: maximum concurrent smtp sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.dialogs</strong>: total dialogs\r
+<strong>smtp.non-encoded attachments</strong>: total non-encoded attachments extracted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.events</strong>: events generated\r
+<strong>smtp.non-encoded bytes</strong>: total non-encoded extracted bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.ignored channels</strong>: total channels ignored\r
+<strong>smtp.packets</strong>: total packets processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.ignored sessions</strong>: total sessions ignored\r
+<strong>smtp.qp attachments</strong>: total quoted-printable attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.requests</strong>: total requests\r
+<strong>smtp.qp decoded bytes</strong>: total quoted-printable decoded bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.responses</strong>: total responses\r
+<strong>smtp.sessions</strong>: total smtp sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>sip.sessions</strong>: total sessions\r
+<strong>smtp.uu attachments</strong>: total uu attachments decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>smtp.packets</strong>: total packets\r
+<strong>smtp.uu decoded bytes</strong>: total uu decoded bytes\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>136</strong>: reputation\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>137</strong>: ssl\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>145</strong>: dnp3\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>219</strong>: new_http_inspect\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>136:1</strong> (reputation) packets blacklisted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>136:2</strong> (reputation) Packets whitelisted\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>136:3</strong> (reputation) Packets monitored\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>137:1</strong> (ssl) Invalid Client HELLO after Server HELLO Detected\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>145:1</strong> (dnp3) DNP3 Link-Layer Frame contains bad CRC.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:2</strong> (dnp3) DNP3 Link-Layer Frame was dropped.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:3</strong> (dnp3) DNP3 Transport-Layer Segment was dropped during reassembly.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:4</strong> (dnp3) DNP3 Reassembly Buffer was cleared without reassembling a complete message.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:5</strong> (dnp3) DNP3 Link-Layer Frame uses a reserved address.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>145:6</strong> (dnp3) DNP3 Application-Layer Fragment uses a reserved function code.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>219:1</strong> (new_http_inspect) ascii encoding\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>dnp3</strong> (inspector): dnp3 inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3_data</strong> (ips_option): sets the cursor to dnp3 data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3_func</strong> (ips_option): detection option to check dnp3 function code\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3_ind</strong> (ips_option): detection option to check dnp3 indicator flags\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dnp3_obj</strong> (ips_option): detection option to check dnp3 object headers\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>dns</strong> (inspector): dns inspection\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>lowmem_q</strong> (search_engine): MPSE that minimizes memory used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>md5</strong> (ips_option): payload rule option for hash matching\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>pcre</strong> (ips_option): rule option for matching payload data with regex\r
+<strong>pcre</strong> (ips_option): rule option for matching payload data with pcre\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>profiler</strong> (basic): configure profiling of rules and/or modules\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>rate_filter</strong> (basic): configure rate filters (which change rule actions)\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>regex</strong> (ips_option): rule option for matching payload data with hyperscan regex\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>reject</strong> (ips_action): terminate session with TCP reset or ICMP unreachable\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>reputation</strong> (inspector): reputation inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>rev</strong> (ips_option): rule option to indicate current revision of signature\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>inspector::dnp3</strong>: dnp3 inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>inspector::dns</strong>: dns inspection\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>inspector::reputation</strong>: reputation inspection\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>inspector::rpc_decode</strong>: RPC inspector\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>ips_option::dnp3_data</strong>: sets the cursor to dnp3 data\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>ips_option::dnp3_func</strong>: detection option to check dnp3 function code\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>ips_option::dnp3_ind</strong>: detection option to check dnp3 indicator flags\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>ips_option::dnp3_obj</strong>: detection option to check dnp3 object headers\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>ips_option::dsize</strong>: rule option to test payload size\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>ips_option::pcre</strong>: rule option for matching payload data with regex\r
+<strong>ips_option::pcre</strong>: rule option for matching payload data with pcre\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>ips_option::regex</strong>: rule option for matching payload data with hyperscan regex\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>ips_option::rem</strong>: rule option to convey an arbitrary comment in the rule body\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>search_engine::ac_bnfa_q</strong>: Aho-Corasick Binary NFA (low memory, high performance) with queued events\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>search_engine::ac_full</strong>: Aho-Corasick Full (high memory, best performance), implements search_all()\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>search_engine::ac_full_q</strong>: Aho-Corasick Full (high memory, best performance) with queued events, implements search_all()\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>search_engine::ac_sparse</strong>: Aho-Corasick Sparse (high memory, moderate performance) MPSE\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>search_engine::lowmem</strong>: Keyword Trie (low memory, moderate performance) MPSE\r
+<strong>search_engine::hyperscan</strong>: intel hyperscan-based mpse with regex support\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>search_engine::lowmem_q</strong>: Keyword Trie (low memory, moderate performance) MPSE with queued events\r
+<strong>search_engine::lowmem</strong>: Keyword Trie (low memory, moderate performance) MPSE\r
</p>\r
</li>\r
<li>\r
<div id="footnotes"><hr /></div>\r
<div id="footer">\r
<div id="footer-text">\r
-Last updated 2015-11-05 18:33:45 EST\r
+Last updated 2015-12-11 06:03:58 EST\r
</div>\r
</div>\r
</body>\r
3.14. output
3.15. packets
3.16. process
- 3.17. rate_filter
- 3.18. references
- 3.19. rule_state
- 3.20. search_engine
- 3.21. snort
- 3.22. suppress
+ 3.17. profiler
+ 3.18. rate_filter
+ 3.19. references
+ 3.20. rule_state
+ 3.21. search_engine
+ 3.22. snort
+ 3.23. suppress
4. Codec Modules
5.2. back_orifice
5.3. binder
5.4. data_log
- 5.5. dns
- 5.6. dpx
- 5.7. ftp_client
- 5.8. ftp_data
- 5.9. ftp_server
- 5.10. gtp_inspect
- 5.11. http_global
- 5.12. http_inspect
- 5.13. imap
- 5.14. modbus
- 5.15. new_http_inspect
- 5.16. normalizer
- 5.17. perf_monitor
- 5.18. pop
- 5.19. port_scan
- 5.20. port_scan_global
- 5.21. rpc_decode
- 5.22. sip
- 5.23. smtp
- 5.24. ssh
- 5.25. ssl
- 5.26. stream
- 5.27. stream_file
- 5.28. stream_icmp
- 5.29. stream_ip
- 5.30. stream_tcp
- 5.31. stream_udp
- 5.32. stream_user
- 5.33. telnet
- 5.34. wizard
+ 5.5. dnp3
+ 5.6. dns
+ 5.7. dpx
+ 5.8. ftp_client
+ 5.9. ftp_data
+ 5.10. ftp_server
+ 5.11. gtp_inspect
+ 5.12. http_global
+ 5.13. http_inspect
+ 5.14. imap
+ 5.15. modbus
+ 5.16. new_http_inspect
+ 5.17. normalizer
+ 5.18. perf_monitor
+ 5.19. pop
+ 5.20. port_scan
+ 5.21. port_scan_global
+ 5.22. reputation
+ 5.23. rpc_decode
+ 5.24. sip
+ 5.25. smtp
+ 5.26. ssh
+ 5.27. ssl
+ 5.28. stream
+ 5.29. stream_file
+ 5.30. stream_icmp
+ 5.31. stream_ip
+ 5.32. stream_tcp
+ 5.33. stream_udp
+ 5.34. stream_user
+ 5.35. telnet
+ 5.36. wizard
6. IPS Action Modules
7.9. content
7.10. cvs
7.11. detection_filter
- 7.12. dsize
- 7.13. file_data
- 7.14. flags
- 7.15. flow
- 7.16. flowbits
- 7.17. fragbits
- 7.18. fragoffset
- 7.19. gid
- 7.20. gtp_info
- 7.21. gtp_type
- 7.22. gtp_version
- 7.23. http_client_body
- 7.24. http_cookie
- 7.25. http_header
- 7.26. http_method
- 7.27. http_raw_cookie
- 7.28. http_raw_header
- 7.29. http_raw_uri
- 7.30. http_stat_code
- 7.31. http_stat_msg
- 7.32. http_uri
- 7.33. icmp_id
- 7.34. icmp_seq
- 7.35. icode
- 7.36. id
- 7.37. ip_proto
- 7.38. ipopts
- 7.39. isdataat
- 7.40. itype
- 7.41. md5
- 7.42. metadata
- 7.43. modbus_data
- 7.44. modbus_func
- 7.45. modbus_unit
- 7.46. msg
- 7.47. pcre
- 7.48. pkt_data
- 7.49. pkt_num
- 7.50. priority
- 7.51. raw_data
- 7.52. reference
- 7.53. rem
- 7.54. replace
- 7.55. rev
- 7.56. rpc
- 7.57. seq
- 7.58. session
- 7.59. sha256
- 7.60. sha512
- 7.61. sid
- 7.62. sip_body
- 7.63. sip_header
- 7.64. sip_method
- 7.65. sip_stat_code
- 7.66. so
- 7.67. soid
- 7.68. ssl_state
- 7.69. ssl_version
- 7.70. stream_reassemble
- 7.71. stream_size
- 7.72. tag
- 7.73. tos
- 7.74. ttl
- 7.75. urg
- 7.76. window
+ 7.12. dnp3_data
+ 7.13. dnp3_func
+ 7.14. dnp3_ind
+ 7.15. dnp3_obj
+ 7.16. dsize
+ 7.17. file_data
+ 7.18. flags
+ 7.19. flow
+ 7.20. flowbits
+ 7.21. fragbits
+ 7.22. fragoffset
+ 7.23. gid
+ 7.24. gtp_info
+ 7.25. gtp_type
+ 7.26. gtp_version
+ 7.27. http_client_body
+ 7.28. http_cookie
+ 7.29. http_header
+ 7.30. http_method
+ 7.31. http_raw_cookie
+ 7.32. http_raw_header
+ 7.33. http_raw_uri
+ 7.34. http_stat_code
+ 7.35. http_stat_msg
+ 7.36. http_uri
+ 7.37. icmp_id
+ 7.38. icmp_seq
+ 7.39. icode
+ 7.40. id
+ 7.41. ip_proto
+ 7.42. ipopts
+ 7.43. isdataat
+ 7.44. itype
+ 7.45. md5
+ 7.46. metadata
+ 7.47. modbus_data
+ 7.48. modbus_func
+ 7.49. modbus_unit
+ 7.50. msg
+ 7.51. pcre
+ 7.52. pkt_data
+ 7.53. pkt_num
+ 7.54. priority
+ 7.55. raw_data
+ 7.56. reference
+ 7.57. regex
+ 7.58. rem
+ 7.59. replace
+ 7.60. rev
+ 7.61. rpc
+ 7.62. seq
+ 7.63. session
+ 7.64. sha256
+ 7.65. sha512
+ 7.66. sid
+ 7.67. sip_body
+ 7.68. sip_header
+ 7.69. sip_method
+ 7.70. sip_stat_code
+ 7.71. so
+ 7.72. soid
+ 7.73. ssl_state
+ 7.74. ssl_version
+ 7.75. stream_reassemble
+ 7.76. stream_size
+ 7.77. tag
+ 7.78. tos
+ 7.79. ttl
+ 7.80. urg
+ 7.81. window
8. Search Engine Modules
9. SO Rule Modules
Snorty
,,_ -*> Snort++ <*-
-o" )~ Version 3.0.0-a2 (Build 177) from 2.9.7-177
+o" )~ Version 3.0.0-a3 (Build 182) from 2.9.7-177
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2015 Cisco and/or its affiliates. All rights reserved.
Optional:
* lzma >= 5.1.2 from http://tukaani.org/xz/ for decompression of
- SWF fles
+ SWF and PDF files
* openssl from https://www.openssl.org for SHA and MD5 file
signatures and the protected_content rule option
* hyperscan from https://github.com/01org/hyperscan to build new
MY_SERVERS = [[ 172.20.0.0/16 172.21.0.0/16 ]]
EXTERNAL_NET = '!' .. MY_SERVERS
+ * configure will use clang by default if it is installed. To
+ compile with g instead:
-2.8. Bugs
+ export CXX=g++
-------------
+ * If you build with hyperscan on OS X and see:
-2.8.1. Build
+ dyld: Library not loaded: @rpath/libhs.4.0.dylib
- * configure will use clang by default if it is installed. To
- compile with g instead:
+ when you try to run src/snort, export DYLD_LIBRARY_PATH with the path to
+ libhs. You can also do:
+
+ install_name_tool -change @rpath/libhs.4.0.dylib \
+ /path-to/libhs.4.0.dylib src/snort
- export CXX=g++
- * clang coughs up these warnings:
+2.8. Bugs
- Wunused-but-set-variable is not understood by clang
- clang: warning: argument unused during compilation: '-pthread'
+------------
+
+2.8.1. Build
* With cmake, make install will rebuild the docs even though when
already built.
processed from pcaps
* Enabling debug messages may erroneously affect the number of
packets processed from pcaps
- * It is not possible to build unit tests w/o static plugins.
+ * g++ 4.9.2 with -O3 reports:
+
+ src/service_inspectors/back_orifice/back_orifice.cc:231:25: warning:
+ iteration 930u invokes undefined behavior [-Waggressive-loop-optimizations]
2.8.2. Config
(ie must all be true). Should create 2 separate bindings.
* There is a bug in pps_stream_tcp.cc.. when stream_tcp: is
specified without any arguments, snort2lua doesn’t convert it.
+ Same for stream_udp.
* Loses the ip list delimiters [ ]; change to ( )
in snort.conf: var HOME_NET [A,B,C]
* alert_fast and alert_full: output configuration includes "file =
foo.bar", but file is a bool and you cannot specify an output
file name in the configuration.
+ * preprocessor ports option: ports <number> not supported.
2.8.5. Runtime
).
* The hext DAQ does not support embedded quotes in text lines (use
hex lines as a workaround).
+ * Stream TCP alert squash mechanism incorrectly squashes alerts for
+ different TCP packets.
---------------------------------------------------------------------
* string file_id.file_rules[].magic[].content: file magic content
* int file_id.file_rules[].magic[].offset = 0: file magic offset {
0: }
+ * int file_id.file_policy[].when.file_type_id = 0: unique ID for
+ file type in file magic rule { 0: }
+ * string file_id.file_policy[].when.sha256: SHA 256
+ * enum file_id.file_policy[].use.verdict = unknown: what to do with
+ matching traffic { unknown | log | stop | block | reset }
+ * bool file_id.file_policy[].use.enable_file_type = false: true/
+ false → enable/disable file type identification
+ * bool file_id.file_policy[].use.enable_file_signature = false:
+ true/false → enable/disable file signature
+ * bool file_id.file_policy[].use.enable_file_capture = false: true/
+ false → enable/disable file capture
* bool file_id.trace_type = false: enable runtime dump of type info
* bool file_id.trace_signature = false: enable runtime dump of
signature info
timestamps
-3.17. rate_filter
+3.17. profiler
+
+------------
+
+What: configure profiling of rules and/or modules
+
+Type: basic
+
+Configuration:
+
+ * bool profiler.modules.show = true: show module time profile stats
+ * int profiler.modules.count = 0: print results to given level (0 =
+ all) { 0: }
+ * enum profiler.modules.sort = total_time: sort by given field {
+ none | checks | avg_check | total_time }
+ * bool profiler.memory.show = true: show module memory profile
+ stats
+ * int profiler.memory.count = 0: print results to given level (0 =
+ all) { 0: }
+ * enum profiler.memory.sort = total_used: sort by given field {
+ none | allocations | total_used | avg_allocation }
+ * bool profiler.rules.show = true: show rule time profile stats
+ * int profiler.rules.count = 0: print results to given level (0 =
+ all) { 0: }
+ * enum profiler.rules.sort = total_time: sort by given field { none
+ | checks | avg_check | total_time | matches | no_matches |
+ avg_match | avg_no_match }
+
+
+3.18. rate_filter
------------
according to track
-3.18. references
+3.19. references
------------
* string references[].url: where this reference is defined
-3.19. rule_state
+3.20. rule_state
------------
policies
-3.20. search_engine
+3.21. search_engine
------------
* bool search_engine.inspect_stream_inserts = false: inspect
reassembled payload - disabling is good for performance, bad for
detection
- * dynamic search_engine.search_method = ac_bnfa_q: set fast pattern
+ * dynamic search_engine.search_method = ac_bnfa: set fast pattern
algorithm - choose available search engine { ac_banded | ac_bnfa
- | ac_bnfa_q | ac_full | ac_full_q | ac_sparse | ac_sparse_bands |
- ac_std }
+ | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan }
* bool search_engine.split_any_any = false: evaluate any-any rules
separately to save memory
* bool search_engine.search_optimize = false: tweak state machine
construction for better performance
-3.21. snort
+3.22. snort
------------
* snort.attribute table hosts: total number of hosts in table
-3.22. suppress
+3.23. suppress
------------
* data_log.packets: total packets
-5.5. dns
+5.5. dnp3
+
+------------
+
+What: dnp3 inspection
+
+Type: inspector
+
+Configuration:
+
+ * bool dnp3.check_crc = false: validate checksums in DNP3 link
+ layer frames
+
+Rules:
+
+ * 145:1 (dnp3) DNP3 Link-Layer Frame contains bad CRC.
+ * 145:2 (dnp3) DNP3 Link-Layer Frame was dropped.
+ * 145:3 (dnp3) DNP3 Transport-Layer Segment was dropped during
+ reassembly.
+ * 145:4 (dnp3) DNP3 Reassembly Buffer was cleared without
+ reassembling a complete message.
+ * 145:5 (dnp3) DNP3 Link-Layer Frame uses a reserved address.
+ * 145:6 (dnp3) DNP3 Application-Layer Fragment uses a reserved
+ function code.
+
+Peg counts:
+
+ * dnp3.total packets: total packets
+ * dnp3.udp packets: total udp packets
+ * dnp3.tcp pdus: total tcp pdus
+ * dnp3.dnp3 link layer frames: total dnp3 link layer frames
+ * dnp3.dnp3 application pdus: total dnp3 application pdus
+
+
+5.6. dns
------------
* dns.responses: total dns responses
-5.6. dpx
+5.7. dpx
------------
* dpx.packets: total packets
-5.7. ftp_client
+5.8. ftp_client
------------
sequences on ftp control channel
-5.8. ftp_data
+5.9. ftp_data
------------
* ftp_data.packets: total packets
-5.9. ftp_server
+5.10. ftp_server
------------
* ftp_server.packets: total packets
-5.10. gtp_inspect
+5.11. gtp_inspect
------------
* gtp_inspect.unknown infos: unknown information elements
-5.11. http_global
+5.12. http_global
------------
* http_global.decompressed bytes: total bytes decompressed
-5.12. http_inspect
+5.13. http_inspect
------------
* 120:17 (http_inspect) HTTP response PDF file parse failure
-5.13. imap
+5.14. imap
------------
Peg counts:
- * imap.packets: total packets
+ * imap.packets: total packets processed
+ * imap.sessions: total imap sessions
+ * imap.b64 attachments: total base64 attachments decoded
+ * imap.b64 decoded bytes: total base64 decoded bytes
+ * imap.qp attachments: total quoted-printable attachments decoded
+ * imap.qp decoded bytes: total quoted-printable decoded bytes
+ * imap.uu attachments: total uu attachments decoded
+ * imap.uu decoded bytes: total uu decoded bytes
+ * imap.non-encoded attachments: total non-encoded attachments
+ extracted
+ * imap.non-encoded bytes: total non-encoded extracted bytes
-5.14. modbus
+5.15. modbus
------------
* modbus.frames: total Modbus messages
-5.15. new_http_inspect
+5.16. new_http_inspect
------------
* 219:68 (new_http_inspect) Gzip decompression failed
-5.16. normalizer
+5.17. normalizer
------------
Peg counts:
* normalizer.ip4 trim: eth packets trimmed to datagram size
- * normalizer.test ip4 trim: During inline mode, would have eth
- packets trimmed to datagram size
+ * normalizer.test ip4 trim: test eth packets trimmed to datagram
+ size
* normalizer.ip4 tos: type of service normalizations
- * normalizer.test ip4 tos: During inline mode, would have type of
- service normalizations
+ * normalizer.test ip4 tos: test type of service normalizations
* normalizer.ip4 df: don’t frag bit normalizations
- * normalizer.test ip4 df: During inline mode, would have don’t frag
- bit normalizations
+ * normalizer.test ip4 df: test don’t frag bit normalizations
* normalizer.ip4 rf: reserved flag bit clears
- * normalizer.test ip4 rf: During inline mode, would have reserved
- flag bit clears
+ * normalizer.test ip4 rf: test reserved flag bit clears
* normalizer.ip4 ttl: time-to-live normalizations
- * normalizer.test ip4 ttl: During inline mode, would have
- time-to-live normalizations
+ * normalizer.test ip4 ttl: test time-to-live normalizations
* normalizer.ip4 opts: ip4 options cleared
- * normalizer.test ip4 opts: During inline mode, would have ip4
- options cleared
+ * normalizer.test ip4 opts: test ip4 options cleared
* normalizer.icmp4 echo: icmp4 ping normalizations
- * normalizer.test icmp4 echo: During inline mode, would have icmp4
- ping normalizations
+ * normalizer.test icmp4 echo: test icmp4 ping normalizations
* normalizer.ip6 hops: ip6 hop limit normalizations
- * normalizer.test ip6 hops: During inline mode, would have ip6 hop
- limit normalizations
+ * normalizer.test ip6 hops: test ip6 hop limit normalizations
* normalizer.ip6 options: ip6 options cleared
- * normalizer.test ip6 options: During inline mode, would have ip6
- options cleared
+ * normalizer.test ip6 options: test ip6 options cleared
* normalizer.icmp6 echo: icmp6 echo normalizations
- * normalizer.test icmp6 echo: During inline mode, would have icmp6
- echo normalizations
+ * normalizer.test icmp6 echo: test icmp6 echo normalizations
* normalizer.tcp syn options: SYN only options cleared from non-SYN
packets
- * normalizer.test tcp syn options: During inline mode, would have
- SYN only options cleared from non-SYN packets
+ * normalizer.test tcp syn options: test SYN only options cleared
+ from non-SYN packets
* normalizer.tcp options: packets with options cleared
- * normalizer.test tcp options: During inline mode, would have
- packets with options cleared
+ * normalizer.test tcp options: test packets with options cleared
* normalizer.tcp paddding: packets with padding cleared
- * normalizer.test tcp paddding: During inline mode, would have
- packets with padding cleared
+ * normalizer.test tcp paddding: test packets with padding cleared
* normalizer.tcp reserved: packets with reserved bits cleared
- * normalizer.test tcp reserved: During inline mode, would have
- packets with reserved bits cleared
+ * normalizer.test tcp reserved: test packets with reserved bits
+ cleared
* normalizer.tcp nonce: packets with nonce bit cleared
- * normalizer.test tcp nonce: During inline mode, would have packets
- with nonce bit cleared
+ * normalizer.test tcp nonce: test packets with nonce bit cleared
* normalizer.tcp urgent ptr: packets without data with urgent
pointer cleared
- * normalizer.test tcp urgent ptr: During inline mode, would have
- packets without data with urgent pointer cleared
+ * normalizer.test tcp urgent ptr: test packets without data with
+ urgent pointer cleared
* normalizer.tcp ecn pkt: packets with ECN bits cleared
- * normalizer.test tcp ecn pkt: During inline mode, would have
- packets with ECN bits cleared
+ * normalizer.test tcp ecn pkt: test packets with ECN bits cleared
* normalizer.tcp ts ecr: timestamp cleared on non-ACKs
- * normalizer.test tcp ts ecr: During inline mode, would have
- timestamp cleared on non-ACKs
+ * normalizer.test tcp ts ecr: test timestamp cleared on non-ACKs
* normalizer.tcp req urg: cleared urgent pointer when urgent flag
is not set
- * normalizer.test tcp req urg: During inline mode, would have
- cleared urgent pointer when urgent flag is not set
+ * normalizer.test tcp req urg: test cleared urgent pointer when
+ urgent flag is not set
* normalizer.tcp req pay: cleared urgent pointer and urgent flag
when there is no payload
- * normalizer.test tcp req pay: During inline mode, would have
- cleared urgent pointer and urgent flag when there is no payload
+ * normalizer.test tcp req pay: test cleared urgent pointer and
+ urgent flag when there is no payload
* normalizer.tcp req urp: cleared the urgent flag if the urgent
pointer is not set
- * normalizer.test tcp req urp: During inline mode, would have
- cleared the urgent flag if the urgent pointer is not set
+ * normalizer.test tcp req urp: test cleared the urgent flag if the
+ urgent pointer is not set
* normalizer.tcp trim syn: tcp segments trimmed on SYN
- * normalizer.test tcp trim syn: During inline mode, would have tcp
- segments trimmed on SYN
+ * normalizer.test tcp trim syn: test tcp segments trimmed on SYN
* normalizer.tcp trim rst: RST packets with data trimmed
- * normalizer.test tcp trim rst: During inline mode, would have RST
- packets with data trimmed
+ * normalizer.test tcp trim rst: test RST packets with data trimmed
* normalizer.tcp trim win: data trimed to window
- * normalizer.test tcp trim win: During inline mode, would have data
- trimed to window
+ * normalizer.test tcp trim win: test data trimed to window
* normalizer.tcp trim mss: data trimmed to MSS
- * normalizer.test tcp trim mss: During inline mode, would have data
- trimmed to MSS
+ * normalizer.test tcp trim mss: test data trimmed to MSS
* normalizer.tcp ecn session: ECN bits cleared
- * normalizer.test tcp ecn session: During inline mode, would have
- ECN bits cleared
+ * normalizer.test tcp ecn session: test ECN bits cleared
* normalizer.tcp ts nop: timestamp options cleared
- * normalizer.test tcp ts nop: During inline mode, would have
- timestamp options cleared
+ * normalizer.test tcp ts nop: test timestamp options cleared
* normalizer.tcp ips data: normalized segments
- * normalizer.test tcp ips data: During inline mode, would have
- normalized segments
+ * normalizer.test tcp ips data: test normalized segments
* normalizer.tcp block: blocked segments
- * normalizer.test tcp block: During inline mode, would have blocked
- segments
+ * normalizer.test tcp block: test blocked segments
-5.17. perf_monitor
+5.18. perf_monitor
------------
exit only { 0: }
* int perf_monitor.flow_ip_memcap = 52428800: maximum memory for
flow tracking { 8200: }
- * int perf_monitor.max_file_size = 4294967295: files will be rolled
+ * int perf_monitor.max_file_size = 1073741824: files will be rolled
over if they exceed this size { 4096: }
* int perf_monitor.flow_ports = 1023: maximum ports to track { 0: }
* bool perf_monitor.reset = true: reset (clear) statistics after
* perf_monitor.packets: total packets
-5.18. pop
+5.19. pop
------------
Peg counts:
- * pop.packets: total packets
+ * pop.packets: total packets processed
+ * pop.sessions: total pop sessions
+ * pop.b64 attachments: total base64 attachments decoded
+ * pop.b64 decoded bytes: total base64 decoded bytes
+ * pop.qp attachments: total quoted-printable attachments decoded
+ * pop.qp decoded bytes: total quoted-printable decoded bytes
+ * pop.uu attachments: total uu attachments decoded
+ * pop.uu decoded bytes: total uu decoded bytes
+ * pop.non-encoded attachments: total non-encoded attachments
+ extracted
+ * pop.non-encoded bytes: total non-encoded extracted bytes
-5.19. port_scan
+5.20. port_scan
------------
* 122:27 (port_scan) open port
-5.20. port_scan_global
+5.21. port_scan_global
------------
* port_scan_global.packets: total packets
-5.21. rpc_decode
+5.22. reputation
+
+------------
+
+What: reputation inspection
+
+Type: inspector
+
+Configuration:
+
+ * string reputation.blacklist: blacklist file name with ip lists
+ * int reputation.memcap = 500: maximum total memory allocated {
+ 1:4095 }
+ * enum reputation.nested_ip = inner: ip to use when there is IP
+ encapsulation { inner|outer|all }
+ * enum reputation.priority = whitelist: defines priority when there
+ is a decision conflict during run-time { blacklist|whitelist }
+ * bool reputation.scan_local = false: inspect local address defined
+ in RFC 1918
+ * enum reputation.white = unblack: specify the meaning of whitelist
+ { unblack|trust }
+ * string reputation.whitelist: whitelist file name with ip lists
+
+Rules:
+
+ * 136:1 (reputation) packets blacklisted
+ * 136:2 (reputation) Packets whitelisted
+ * 136:3 (reputation) Packets monitored
+
+Peg counts:
+
+ * reputation.packets: total packets processed
+ * reputation.blacklisted: number of packets blacklisted
+ * reputation.whitelisted: number of packets whitelisted
+ * reputation.monitored: number of packets monitored
+ * reputation.memory_allocated: total memory allocated
+
+
+5.23. rpc_decode
------------
* rpc_decode.packets: total packets
-5.22. sip
+5.24. sip
------------
Peg counts:
+ * sip.packets: total packets
* sip.sessions: total sessions
* sip.events: events generated
* sip.dialogs: total dialogs
* sip.ignored channels: total channels ignored
* sip.ignored sessions: total sessions ignored
- * sip.requests: total requests
- * sip.responses: total responses
-
-
-5.23. smtp
+ * sip.total requests: total requests
+ * sip.invite: invite
+ * sip.cancel: cancel
+ * sip.ack: ack
+ * sip.bye: bye
+ * sip.register: register
+ * sip.options: options
+ * sip.refer: refer
+ * sip.subscribe: subscribe
+ * sip.update: update
+ * sip.join: join
+ * sip.info: info
+ * sip.message: message
+ * sip.notify: notify
+ * sip.prack: prack
+ * sip.total responses: total responses
+ * sip.1xx: 1xx
+ * sip.2xx: 2xx
+ * sip.3xx: 3xx
+ * sip.4xx: 4xx
+ * sip.5xx: 5xx
+ * sip.6xx: 6xx
+ * sip.7xx: 7xx
+ * sip.8xx: 8xx
+ * sip.9xx: 9xx
+
+
+5.25. smtp
------------
Peg counts:
- * smtp.packets: total packets
+ * smtp.packets: total packets processed
+ * smtp.sessions: total smtp sessions
+ * smtp.concurrent sessions: total concurrent smtp sessions
+ * smtp.max concurrent sessions: maximum concurrent smtp sessions
+ * smtp.b64 attachments: total base64 attachments decoded
+ * smtp.b64 decoded bytes: total base64 decoded bytes
+ * smtp.qp attachments: total quoted-printable attachments decoded
+ * smtp.qp decoded bytes: total quoted-printable decoded bytes
+ * smtp.uu attachments: total uu attachments decoded
+ * smtp.uu decoded bytes: total uu decoded bytes
+ * smtp.non-encoded attachments: total non-encoded attachments
+ extracted
+ * smtp.non-encoded bytes: total non-encoded extracted bytes
-5.24. ssh
+5.26. ssh
------------
* ssh.packets: total packets
-5.25. ssl
+5.27. ssl
------------
* ssl.detection disabled: total detection disabled
-5.26. stream
+5.28. stream
------------
* stream.file prunes: file sessions pruned
-5.27. stream_file
+5.29. stream_file
------------
* bool stream_file.upload = false: indicate file transfer direction
-5.28. stream_icmp
+5.30. stream_icmp
------------
* stream_icmp.released: icmp session trackers released
-5.29. stream_ip
+5.31. stream_ip
------------
* stream_ip.nodes deleted: fragments deleted from tracker
-5.30. stream_tcp
+5.32. stream_tcp
------------
flushed when session released
-5.31. stream_udp
+5.33. stream_udp
------------
* stream_udp.timeouts: udp session timeouts
-5.32. stream_user
+5.34. stream_user
------------
1:86400 }
-5.33. telnet
+5.35. telnet
------------
* telnet.packets: total packets
-5.34. wizard
+5.36. wizard
------------
1: }
-7.12. dsize
+7.12. dnp3_data
+
+------------
+
+What: sets the cursor to dnp3 data
+
+Type: ips_option
+
+
+7.13. dnp3_func
+
+------------
+
+What: detection option to check dnp3 function code
+
+Type: ips_option
+
+Configuration:
+
+ * string dnp3_func.~: match dnp3 function code or name
+
+
+7.14. dnp3_ind
+
+------------
+
+What: detection option to check dnp3 indicator flags
+
+Type: ips_option
+
+Configuration:
+
+ * string dnp3_ind.~: match given dnp3 indicator flags
+
+
+7.15. dnp3_obj
+
+------------
+
+What: detection option to check dnp3 object headers
+
+Type: ips_option
+
+Configuration:
+
+ * int dnp3_obj.group = 0: match given dnp3 object header group {
+ 0:255 }
+ * int dnp3_obj.var = 0: match given dnp3 object header var { 0:255
+ }
+
+
+7.16. dsize
------------
max | <max | >min
-7.13. file_data
+7.17. file_data
------------
Type: ips_option
-7.14. flags
+7.18. flags
------------
* string flags.~mask_flags: these flags are don’t cares
-7.15. flow
+7.19. flow
------------
* implied flow.only_frag: match on defragmented packets only
-7.16. flowbits
+7.20. flowbits
------------
* string flowbits.~arg2: group if arg1 is bits
-7.17. fragbits
+7.21. fragbits
------------
* string fragbits.~flags: these flags are tested
-7.18. fragoffset
+7.22. fragoffset
------------
min<>max | <max | >min
-7.19. gid
+7.23. gid
------------
* int gid.~: generator id { 1: }
-7.20. gtp_info
+7.24. gtp_info
------------
* string gtp_info.~: info element to match
-7.21. gtp_type
+7.25. gtp_type
------------
* string gtp_type.~: list of types to match
-7.22. gtp_version
+7.26. gtp_version
------------
* int gtp_version.~: version to match { 0:2 }
-7.23. http_client_body
+7.27. http_client_body
------------
Type: ips_option
-7.24. http_cookie
+7.28. http_cookie
------------
Type: ips_option
-7.25. http_header
+7.29. http_header
------------
* string http_header.~name: restrict to given header
-7.26. http_method
+7.30. http_method
------------
Type: ips_option
-7.27. http_raw_cookie
+7.31. http_raw_cookie
------------
Type: ips_option
-7.28. http_raw_header
+7.32. http_raw_header
------------
Type: ips_option
-7.29. http_raw_uri
+7.33. http_raw_uri
------------
Type: ips_option
-7.30. http_stat_code
+7.34. http_stat_code
------------
Type: ips_option
-7.31. http_stat_msg
+7.35. http_stat_msg
------------
Type: ips_option
-7.32. http_uri
+7.36. http_uri
------------
Type: ips_option
-7.33. icmp_id
+7.37. icmp_id
------------
>min
-7.34. icmp_seq
+7.38. icmp_seq
------------
min<>max | <max | >min
-7.35. icode
+7.39. icode
------------
| >min
-7.36. id
+7.40. id
------------
min
-7.37. ip_proto
+7.41. ip_proto
------------
* string ip_proto.~proto: [!|>|<] name or number
-7.38. ipopts
+7.42. ipopts
------------
lsrre|ssrr|satid|any }
-7.39. isdataat
+7.43. isdataat
------------
buffer
-7.40. itype
+7.44. itype
------------
| >min
-7.41. md5
+7.45. md5
------------
of buffer
-7.42. metadata
+7.46. metadata
------------
* string metadata.*: additional parameters not used by snort
-7.43. modbus_data
+7.47. modbus_data
------------
Type: ips_option
-7.44. modbus_func
+7.48. modbus_func
------------
* string modbus_func.~: function code to match
-7.45. modbus_unit
+7.49. modbus_unit
------------
* int modbus_unit.~: modbus unit ID { 0:255 }
-7.46. msg
+7.50. msg
------------
* string msg.~: message describing rule
-7.47. pcre
+7.51. pcre
------------
-What: rule option for matching payload data with regex
+What: rule option for matching payload data with pcre
Type: ips_option
Configuration:
- * string pcre.~regex: Snort regular expression
+ * string pcre.~re: Snort regular expression
-7.48. pkt_data
+7.52. pkt_data
------------
Type: ips_option
-7.49. pkt_num
+7.53. pkt_num
------------
* string pkt_num.~range: check if packet number is in given range
-7.50. priority
+7.54. priority
------------
1: }
-7.51. raw_data
+7.55. raw_data
------------
Type: ips_option
-7.52. reference
+7.56. reference
------------
* string reference.~id: reference id
-7.53. rem
+7.57. regex
+
+------------
+
+What: rule option for matching payload data with hyperscan regex
+
+Type: ips_option
+
+Configuration:
+
+ * string regex.~re: hyperscan regular expression
+ * implied regex.nocase: case insensitive match
+ * implied regex.dotall: matching a . will not exclude newlines
+ * implied regex.multiline: ^ and $ anchors match any newlines in
+ data
+ * implied regex.relative: start search from end of last match
+ instead of start of buffer
+
+
+7.58. rem
------------
* string rem.~: comment
-7.54. replace
+7.59. replace
------------
* string replace.~: byte code to replace with
-7.55. rev
+7.60. rev
------------
* int rev.~: revision { 1: }
-7.56. rpc
+7.61. rpc
------------
* string rpc.~proc: procedure number or * for any
-7.57. seq
+7.62. seq
------------
max | <max | >min
-7.58. session
+7.63. session
------------
* enum session.~mode: output format { printable|binary|all }
-7.59. sha256
+7.64. sha256
------------
start of buffer
-7.60. sha512
+7.65. sha512
------------
start of buffer
-7.61. sid
+7.66. sid
------------
* int sid.~: signature id { 1: }
-7.62. sip_body
+7.67. sip_body
------------
Type: ips_option
-7.63. sip_header
+7.68. sip_header
------------
Type: ips_option
-7.64. sip_method
+7.69. sip_method
------------
* string sip_method.*method: sip method
-7.65. sip_stat_code
+7.70. sip_stat_code
------------
* int sip_stat_code.*code: stat code { 1:999 }
-7.66. so
+7.71. so
------------
* string so.~func: name of eval function
-7.67. soid
+7.72. soid
------------
* string soid.~: SO rule ID has <gid>|<sid> format, like 3|12345
-7.68. ssl_state
+7.73. ssl_state
------------
unknown
-7.69. ssl_version
+7.74. ssl_version
------------
tls1.2
-7.70. stream_reassemble
+7.75. stream_reassemble
------------
remainder of the session
-7.71. stream_size
+7.76. stream_size
------------
direction(s) { either|to_server|to_client|both }
-7.72. tag
+7.77. tag
------------
* int tag.bytes: tag for this many bytes { 1: }
-7.73. tos
+7.78. tos
------------
max | <max | >min
-7.74. ttl
+7.79. ttl
------------
max | <max | >min
-7.75. urg
+7.80. urg
------------
min
-7.76. window
+7.81. window
------------
dir src_ap dst_ap rule action: selected fields will be output in
given order left to right { action | dir | dgm_len | dst_addr |
dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid
- | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len |
- msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr |
- src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq |
- tcp_win | timestamp | tos | ttl | udp_len }
+ | icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id |
+ ip_len | msg | pkt_gen | pkt_num | proto | rev | rule | sid |
+ src_addr | src_ap | src_port | tcp_ack | tcp_flags | tcp_len |
+ tcp_seq | tcp_win | timestamp | tos | ttl | udp_len }
* int alert_csv.limit = 0: set limit (0 is unlimited) { 0: }
* string alert_csv.separator = , : separate fields with this
character sequence
built into the Snort binary. For a full list of build features, run .
/configure --help.
- * --enable-ppm: enable packet and rule performance monitoring and
- coarse latency enforcement.
- * --enable-perf-profiling: enable module and rule performance
- profiling.
- * --enable-shell: enable local and remote command line shell
- support.
+ * --enable-ppm: enable building packet and rule performance
+ monitoring and coarse latency enforcement.
+ * --enable-shell: enable building local and remote command line
+ shell support.
These features are built only if the required libraries and headers
are present. There is no need to explicitly enable.
- * lzma: from http://www.7-zip.org/sdk.html for decompression of SWF
- fles.
- * openssl: from https://www.openssl.org for SHA and MD5 file
- signatures and the protected_content rule option.
+ * lzma: for decompression of SWF and PDF files.
+ * openssl: for SHA and MD5 file signatures and the
+ protected_content rule option.
* *intel-soft-cpm": an optional pattern matcher based on a library
from Intel.
+ * hyperscan for the regex rule option and hyperscan search engine.
If you need to use headers and/or libraries in non-standard
locations, you can use these options:
package libraries.
These can be use for pcap, luajit, pcre, dnet, daq, lzma, openssl,
-and intel-soft-cpm packages.
+intel-soft-cpm, and hyperscan packages. For more information on these
+libraries see the Getting Started section of the manual.
16.6. Environment Variables
dir src_ap dst_ap rule action: selected fields will be output in
given order left to right { action | dir | dgm_len | dst_addr |
dst_ap | dst_port | eth_dst | eth_len | eth_src | eth_type | gid
- | icmp_code | icmp_id | icmp_seq | icmp_type | ip_id | ip_len |
- msg | pkt_gen | pkt_num | proto | rev | rule | sid | src_addr |
- src_ap | src_port | tcp_ack | tcp_flags | tcp_len | tcp_seq |
- tcp_win | timestamp | tos | ttl | udp_len }
+ | icmp_code | icmp_id | icmp_seq | icmp_type | iface | ip_id |
+ ip_len | msg | pkt_gen | pkt_num | proto | rev | rule | sid |
+ src_addr | src_ap | src_port | tcp_ack | tcp_flags | tcp_len |
+ tcp_seq | tcp_win | timestamp | tos | ttl | udp_len }
* bool alert_csv.file = false: output to alert_csv.txt instead of
stdout
* int alert_csv.limit = 0: set limit (0 is unlimited) { 0: }
1: }
* enum detection_filter.track: track hits by source or destination
IP address { by_src | by_dst }
+ * bool dnp3.check_crc = false: validate checksums in DNP3 link
+ layer frames
+ * string dnp3_func.~: match dnp3 function code or name
+ * string dnp3_ind.~: match given dnp3 indicator flags
+ * int dnp3_obj.group = 0: match given dnp3 object header group {
+ 0:255 }
+ * int dnp3_obj.var = 0: match given dnp3 object header var { 0:255
+ }
* int dpx.max = 0: maximum payload before alert { 0:65535 }
* port dpx.port: port to check
* string dsize.~range: check if packet payload size is size | min<>
* bool file_id.enable_signature = false: enable signature
calculation
* bool file_id.enable_type = false: enable type ID
+ * bool file_id.file_policy[].use.enable_file_capture = false: true/
+ false → enable/disable file capture
+ * bool file_id.file_policy[].use.enable_file_signature = false:
+ true/false → enable/disable file signature
+ * bool file_id.file_policy[].use.enable_file_type = false: true/
+ false → enable/disable file type identification
+ * enum file_id.file_policy[].use.verdict = unknown: what to do with
+ matching traffic { unknown | log | stop | block | reset }
+ * int file_id.file_policy[].when.file_type_id = 0: unique ID for
+ file type in file magic rule { 0: }
+ * string file_id.file_policy[].when.sha256: SHA 256
* string file_id.file_rules[].category: file type category
* int file_id.file_rules[].id = 0: file type id { 0: }
* string file_id.file_rules[].magic[].content: file magic content
* int log_hext.width = 20: set line width (0 is unlimited) { 0: }
* int log_pcap.limit = 0: set limit (0 is unlimited) { 0: }
* enum log_pcap.units = B: bytes | KB | MB | GB { B | K | M | G }
- * string lowmem_q.var: additional print text
* int md5.length: number of octets in plain text { 1:65535 }
* string md5.offset: var or number of bytes from start of buffer to
start search
processing { 0: }
* bool packets.vlan_agnostic = false: determines whether VLAN info
is used to track fragments and connections
- * string pcre.~regex: Snort regular expression
+ * string pcre.~re: Snort regular expression
* bool perf_monitor.console = false: output to console
* bool perf_monitor.events = false: report on qualified vs
non-qualified events
* int perf_monitor.flow_ports = 1023: maximum ports to track { 0: }
* bool perf_monitor.max = false: calculate theoretical maximum
performance
- * int perf_monitor.max_file_size = 4294967295: files will be rolled
+ * int perf_monitor.max_file_size = 1073741824: files will be rolled
over if they exceed this size { 4096: }
* int perf_monitor.packets = 10000: minim packets to report { 0: }
* bool perf_monitor.reset = true: reset (clear) statistics after
* string process.umask: set process umask (same as -m)
* bool process.utc = false: use UTC instead of local time for
timestamps
+ * int profiler.memory.count = 0: print results to given level (0 =
+ all) { 0: }
+ * bool profiler.memory.show = true: show module memory profile
+ stats
+ * enum profiler.memory.sort = total_used: sort by given field {
+ none | allocations | total_used | avg_allocation }
+ * int profiler.modules.count = 0: print results to given level (0 =
+ all) { 0: }
+ * bool profiler.modules.show = true: show module time profile stats
+ * enum profiler.modules.sort = total_time: sort by given field {
+ none | checks | avg_check | total_time }
+ * int profiler.rules.count = 0: print results to given level (0 =
+ all) { 0: }
+ * bool profiler.rules.show = true: show rule time profile stats
+ * enum profiler.rules.sort = total_time: sort by given field { none
+ | checks | avg_check | total_time | matches | no_matches |
+ avg_match | avg_no_match }
* string rate_filter[].apply_to: restrict filter to these addresses
according to track
* int rate_filter[].count = 1: number of events in interval before
* string reference.~scheme: reference scheme
* string references[].name: name used with reference rule option
* string references[].url: where this reference is defined
+ * implied regex.dotall: matching a . will not exclude newlines
+ * implied regex.multiline: ^ and $ anchors match any newlines in
+ data
+ * implied regex.nocase: case insensitive match
+ * implied regex.relative: start search from end of last match
+ instead of start of buffer
+ * string regex.~re: hyperscan regular expression
* enum reject.control: send icmp unreachable(s) { network|host|port
|all }
* enum reject.reset: send tcp reset to one or both ends { source|
dest|both }
* string rem.~: comment
* string replace.~: byte code to replace with
+ * string reputation.blacklist: blacklist file name with ip lists
+ * int reputation.memcap = 500: maximum total memory allocated {
+ 1:4095 }
+ * enum reputation.nested_ip = inner: ip to use when there is IP
+ encapsulation { inner|outer|all }
+ * enum reputation.priority = whitelist: defines priority when there
+ is a decision conflict during run-time { blacklist|whitelist }
+ * bool reputation.scan_local = false: inspect local address defined
+ in RFC 1918
+ * enum reputation.white = unblack: specify the meaning of whitelist
+ { unblack|trust }
+ * string reputation.whitelist: whitelist file name with ip lists
* int rev.~: revision { 1: }
* string rpc.~app: application number
* string rpc.~proc: procedure number or * for any
compiling into state machine (0 means no maximum) { 0: }
* int search_engine.max_queue_events = 5: maximum number of
matching fast pattern states to queue per packet
- * dynamic search_engine.search_method = ac_bnfa_q: set fast pattern
+ * dynamic search_engine.search_method = ac_bnfa: set fast pattern
algorithm - choose available search engine { ac_banded | ac_bnfa
- | ac_bnfa_q | ac_full | ac_full_q | ac_sparse | ac_sparse_bands |
- ac_std | lowmem | lowmem_q }
+ | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan |
+ lowmem }
* bool search_engine.search_optimize = false: tweak state machine
construction for better performance
* bool search_engine.split_any_any = false: evaluate any-any rules
* detection.raw searches: fast pattern searches in raw packet data
* detection.slow searches: non-fast pattern rule evaluations
* detection.total alerts: alerts including IP reputation
+ * dnp3.dnp3 application pdus: total dnp3 application pdus
+ * dnp3.dnp3 link layer frames: total dnp3 link layer frames
+ * dnp3.tcp pdus: total tcp pdus
+ * dnp3.total packets: total packets
+ * dnp3.udp packets: total udp packets
* dns.packets: total packets processed
* dns.requests: total dns requests
* dns.responses: total dns responses
* icmp4.bad checksum: non-zero icmp checksums
* icmp6.bad checksum (ip4): nonzero ipcm4 checksums
* icmp6.bad checksum (ip6): nonzero ipcm6 checksums
- * imap.packets: total packets
+ * imap.b64 attachments: total base64 attachments decoded
+ * imap.b64 decoded bytes: total base64 decoded bytes
+ * imap.non-encoded attachments: total non-encoded attachments
+ extracted
+ * imap.non-encoded bytes: total non-encoded extracted bytes
+ * imap.packets: total packets processed
+ * imap.qp attachments: total quoted-printable attachments decoded
+ * imap.qp decoded bytes: total quoted-printable decoded bytes
+ * imap.sessions: total imap sessions
+ * imap.uu attachments: total uu attachments decoded
+ * imap.uu decoded bytes: total uu decoded bytes
* ipv4.bad checksum: nonzero ip checksums
* modbus.frames: total Modbus messages
* modbus.sessions: total sessions processed
* normalizer.tcp ts nop: timestamp options cleared
* normalizer.tcp urgent ptr: packets without data with urgent
pointer cleared
- * normalizer.test icmp4 echo: During inline mode, would have icmp4
- ping normalizations
- * normalizer.test icmp6 echo: During inline mode, would have icmp6
- echo normalizations
- * normalizer.test ip4 df: During inline mode, would have don’t frag
- bit normalizations
- * normalizer.test ip4 opts: During inline mode, would have ip4
- options cleared
- * normalizer.test ip4 rf: During inline mode, would have reserved
- flag bit clears
- * normalizer.test ip4 tos: During inline mode, would have type of
- service normalizations
- * normalizer.test ip4 trim: During inline mode, would have eth
- packets trimmed to datagram size
- * normalizer.test ip4 ttl: During inline mode, would have
- time-to-live normalizations
- * normalizer.test ip6 hops: During inline mode, would have ip6 hop
- limit normalizations
- * normalizer.test ip6 options: During inline mode, would have ip6
- options cleared
- * normalizer.test tcp block: During inline mode, would have blocked
- segments
- * normalizer.test tcp ecn pkt: During inline mode, would have
- packets with ECN bits cleared
- * normalizer.test tcp ecn session: During inline mode, would have
- ECN bits cleared
- * normalizer.test tcp ips data: During inline mode, would have
- normalized segments
- * normalizer.test tcp nonce: During inline mode, would have packets
- with nonce bit cleared
- * normalizer.test tcp options: During inline mode, would have
- packets with options cleared
- * normalizer.test tcp paddding: During inline mode, would have
- packets with padding cleared
- * normalizer.test tcp req pay: During inline mode, would have
- cleared urgent pointer and urgent flag when there is no payload
- * normalizer.test tcp req urg: During inline mode, would have
- cleared urgent pointer when urgent flag is not set
- * normalizer.test tcp req urp: During inline mode, would have
- cleared the urgent flag if the urgent pointer is not set
- * normalizer.test tcp reserved: During inline mode, would have
- packets with reserved bits cleared
- * normalizer.test tcp syn options: During inline mode, would have
- SYN only options cleared from non-SYN packets
- * normalizer.test tcp trim mss: During inline mode, would have data
- trimmed to MSS
- * normalizer.test tcp trim rst: During inline mode, would have RST
- packets with data trimmed
- * normalizer.test tcp trim syn: During inline mode, would have tcp
- segments trimmed on SYN
- * normalizer.test tcp trim win: During inline mode, would have data
- trimed to window
- * normalizer.test tcp ts ecr: During inline mode, would have
- timestamp cleared on non-ACKs
- * normalizer.test tcp ts nop: During inline mode, would have
- timestamp options cleared
- * normalizer.test tcp urgent ptr: During inline mode, would have
- packets without data with urgent pointer cleared
+ * normalizer.test icmp4 echo: test icmp4 ping normalizations
+ * normalizer.test icmp6 echo: test icmp6 echo normalizations
+ * normalizer.test ip4 df: test don’t frag bit normalizations
+ * normalizer.test ip4 opts: test ip4 options cleared
+ * normalizer.test ip4 rf: test reserved flag bit clears
+ * normalizer.test ip4 tos: test type of service normalizations
+ * normalizer.test ip4 trim: test eth packets trimmed to datagram
+ size
+ * normalizer.test ip4 ttl: test time-to-live normalizations
+ * normalizer.test ip6 hops: test ip6 hop limit normalizations
+ * normalizer.test ip6 options: test ip6 options cleared
+ * normalizer.test tcp block: test blocked segments
+ * normalizer.test tcp ecn pkt: test packets with ECN bits cleared
+ * normalizer.test tcp ecn session: test ECN bits cleared
+ * normalizer.test tcp ips data: test normalized segments
+ * normalizer.test tcp nonce: test packets with nonce bit cleared
+ * normalizer.test tcp options: test packets with options cleared
+ * normalizer.test tcp paddding: test packets with padding cleared
+ * normalizer.test tcp req pay: test cleared urgent pointer and
+ urgent flag when there is no payload
+ * normalizer.test tcp req urg: test cleared urgent pointer when
+ urgent flag is not set
+ * normalizer.test tcp req urp: test cleared the urgent flag if the
+ urgent pointer is not set
+ * normalizer.test tcp reserved: test packets with reserved bits
+ cleared
+ * normalizer.test tcp syn options: test SYN only options cleared
+ from non-SYN packets
+ * normalizer.test tcp trim mss: test data trimmed to MSS
+ * normalizer.test tcp trim rst: test RST packets with data trimmed
+ * normalizer.test tcp trim syn: test tcp segments trimmed on SYN
+ * normalizer.test tcp trim win: test data trimed to window
+ * normalizer.test tcp ts ecr: test timestamp cleared on non-ACKs
+ * normalizer.test tcp ts nop: test timestamp options cleared
+ * normalizer.test tcp urgent ptr: test packets without data with
+ urgent pointer cleared
* perf_monitor.packets: total packets
- * pop.packets: total packets
+ * pop.b64 attachments: total base64 attachments decoded
+ * pop.b64 decoded bytes: total base64 decoded bytes
+ * pop.non-encoded attachments: total non-encoded attachments
+ extracted
+ * pop.non-encoded bytes: total non-encoded extracted bytes
+ * pop.packets: total packets processed
+ * pop.qp attachments: total quoted-printable attachments decoded
+ * pop.qp decoded bytes: total quoted-printable decoded bytes
+ * pop.sessions: total pop sessions
+ * pop.uu attachments: total uu attachments decoded
+ * pop.uu decoded bytes: total uu decoded bytes
* port_scan_global.packets: total packets
+ * reputation.blacklisted: number of packets blacklisted
+ * reputation.memory_allocated: total memory allocated
+ * reputation.monitored: number of packets monitored
+ * reputation.packets: total packets processed
+ * reputation.whitelisted: number of packets whitelisted
* rpc_decode.packets: total packets
+ * sip.1xx: 1xx
+ * sip.2xx: 2xx
+ * sip.3xx: 3xx
+ * sip.4xx: 4xx
+ * sip.5xx: 5xx
+ * sip.6xx: 6xx
+ * sip.7xx: 7xx
+ * sip.8xx: 8xx
+ * sip.9xx: 9xx
+ * sip.ack: ack
+ * sip.bye: bye
+ * sip.cancel: cancel
* sip.dialogs: total dialogs
* sip.events: events generated
* sip.ignored channels: total channels ignored
* sip.ignored sessions: total sessions ignored
- * sip.requests: total requests
- * sip.responses: total responses
+ * sip.info: info
+ * sip.invite: invite
+ * sip.join: join
+ * sip.message: message
+ * sip.notify: notify
+ * sip.options: options
+ * sip.packets: total packets
+ * sip.prack: prack
+ * sip.refer: refer
+ * sip.register: register
* sip.sessions: total sessions
- * smtp.packets: total packets
+ * sip.subscribe: subscribe
+ * sip.total requests: total requests
+ * sip.total responses: total responses
+ * sip.update: update
+ * smtp.b64 attachments: total base64 attachments decoded
+ * smtp.b64 decoded bytes: total base64 decoded bytes
+ * smtp.concurrent sessions: total concurrent smtp sessions
+ * smtp.max concurrent sessions: maximum concurrent smtp sessions
+ * smtp.non-encoded attachments: total non-encoded attachments
+ extracted
+ * smtp.non-encoded bytes: total non-encoded extracted bytes
+ * smtp.packets: total packets processed
+ * smtp.qp attachments: total quoted-printable attachments decoded
+ * smtp.qp decoded bytes: total quoted-printable decoded bytes
+ * smtp.sessions: total smtp sessions
+ * smtp.uu attachments: total uu attachments decoded
+ * smtp.uu decoded bytes: total uu decoded bytes
* snort.attribute table hosts: total number of hosts in table
* snort.attribute table reloads: number of times hosts table was
reloaded
* 128: ssh
* 129: stream_tcp
* 131: dns
+ * 136: reputation
* 137: ssl
* 140: sip
* 141: imap
* 142: pop
* 143: gtp_inspect
* 144: modbus
+ * 145: dnp3
* 219: new_http_inspect
* 256: dpx
* 131:1 (dns) Obsolete DNS RR Types
* 131:2 (dns) Experimental DNS RR Types
* 131:3 (dns) DNS Client rdata txt Overflow
+ * 136:1 (reputation) packets blacklisted
+ * 136:2 (reputation) Packets whitelisted
+ * 136:3 (reputation) Packets monitored
* 137:1 (ssl) Invalid Client HELLO after Server HELLO Detected
* 137:2 (ssl) Invalid Server HELLO without Client HELLO Detected
* 137:3 (ssl) Heartbeat Read Overrun Attempt Detected
length needed for the given function
* 144:2 (modbus) Modbus protocol ID is non-zero
* 144:3 (modbus) Reserved Modbus function code in use
+ * 145:1 (dnp3) DNP3 Link-Layer Frame contains bad CRC.
+ * 145:2 (dnp3) DNP3 Link-Layer Frame was dropped.
+ * 145:3 (dnp3) DNP3 Transport-Layer Segment was dropped during
+ reassembly.
+ * 145:4 (dnp3) DNP3 Reassembly Buffer was cleared without
+ reassembling a complete message.
+ * 145:5 (dnp3) DNP3 Link-Layer Frame uses a reserved address.
+ * 145:6 (dnp3) DNP3 Application-Layer Fragment uses a reserved
+ function code.
* 219:1 (new_http_inspect) ascii encoding
* 219:2 (new_http_inspect) double decoding attack
* 219:3 (new_http_inspect) u encoding
parameters
* detection_filter (ips_option): rule option to require multiple
hits before a rule generates an event
+ * dnp3 (inspector): dnp3 inspection
+ * dnp3_data (ips_option): sets the cursor to dnp3 data
+ * dnp3_func (ips_option): detection option to check dnp3 function
+ code
+ * dnp3_ind (ips_option): detection option to check dnp3 indicator
+ flags
+ * dnp3_obj (ips_option): detection option to check dnp3 object
+ headers
* dns (inspector): dns inspection
* dpx (inspector): dynamic inspector example
* dsize (ips_option): rule option to test payload size
* log_codecs (logger): log protocols in packet by layer
* log_hext (logger): output payload suitable for daq hext
* log_pcap (logger): log packet in pcap format
- * lowmem_q (search_engine): MPSE that minimizes memory used
* md5 (ips_option): payload rule option for hash matching
* metadata (ips_option): rule option for conveying arbitrary name,
value data within the rule text
* output (basic): configure general output parameters
* packets (basic): configure basic packet handling
* pcre (ips_option): rule option for matching payload data with
- regex
+ pcre
* perf_monitor (inspector): performance monitoring and flow
statistics collection
* pgm (codec): support for pragmatic general multicast
* pppoe (codec): support for point-to-point protocol over ethernet
* priority (ips_option): rule option for prioritizing events
* process (basic): configure basic process setup
+ * profiler (basic): configure profiling of rules and/or modules
* rate_filter (basic): configure rate filters (which change rule
actions)
* raw_data (ips_option): rule option to set the detection cursor to
* reference (ips_option): rule option to indicate relevant attack
identification system
* references (basic): define reference systems used in rules
+ * regex (ips_option): rule option for matching payload data with
+ hyperscan regex
* reject (ips_action): terminate session with TCP reset or ICMP
unreachable
* rem (ips_option): rule option to convey an arbitrary comment in
the rule body
* replace (ips_option): rule option to overwrite payload data; use
with rewrite action
+ * reputation (inspector): reputation inspection
* rev (ips_option): rule option to indicate current revision of
signature
* rewrite (ips_action): overwrite packet contents
* inspector::binder: configure processing based on CIDRs, ports,
services, etc.
* inspector::data_log: log selected published data to data.log
+ * inspector::dnp3: dnp3 inspection
* inspector::dns: dns inspection
* inspector::dpx: dynamic inspector example
* inspector::ftp_client: FTP inspector client module
port_scan_global
* inspector::port_scan_global: shared settings for port_scan
inspectors for use with port_scan
+ * inspector::reputation: reputation inspection
* inspector::rpc_decode: RPC inspector
* inspector::sip: sip inspection
* inspector::smtp: smtp inspection
attacks
* ips_option::detection_filter: rule option to require multiple
hits before a rule generates an event
+ * ips_option::dnp3_data: sets the cursor to dnp3 data
+ * ips_option::dnp3_func: detection option to check dnp3 function
+ code
+ * ips_option::dnp3_ind: detection option to check dnp3 indicator
+ flags
+ * ips_option::dnp3_obj: detection option to check dnp3 object
+ headers
* ips_option::dsize: rule option to test payload size
* ips_option::file_data: rule option to set detection cursor to
file data
* ips_option::modbus_unit: rule option to check modbus unit ID
* ips_option::msg: rule option summarizing rule purpose output with
events
- * ips_option::pcre: rule option for matching payload data with
- regex
+ * ips_option::pcre: rule option for matching payload data with pcre
* ips_option::pkt_data: rule option to set the detection cursor to
the normalized packet data
* ips_option::pkt_num: alert on raw packet number
the raw packet data
* ips_option::reference: rule option to indicate relevant attack
identification system
+ * ips_option::regex: rule option for matching payload data with
+ hyperscan regex
* ips_option::rem: rule option to convey an arbitrary comment in
the rule body
* ips_option::replace: rule option to overwrite payload data; use
moderate performance)
* search_engine::ac_bnfa: Aho-Corasick Binary NFA (low memory, high
performance) MPSE
- * search_engine::ac_bnfa_q: Aho-Corasick Binary NFA (low memory,
- high performance) with queued events
* search_engine::ac_full: Aho-Corasick Full (high memory, best
performance), implements search_all()
- * search_engine::ac_full_q: Aho-Corasick Full (high memory, best
- performance) with queued events, implements search_all()
* search_engine::ac_sparse: Aho-Corasick Sparse (high memory,
moderate performance) MPSE
* search_engine::ac_sparse_bands: Aho-Corasick Sparse-Banded (high
memory, moderate performance) MPSE
* search_engine::ac_std: Aho-Corasick Full (high memory, best
performance) MPSE
+ * search_engine::hyperscan: intel hyperscan-based mpse with regex
+ support
* search_engine::lowmem: Keyword Trie (low memory, moderate
performance) MPSE
- * search_engine::lowmem_q: Keyword Trie (low memory, moderate
- performance) MPSE with queued events
* so_rule::3|18758: SO rule example
projects / thirdparty / snort3.git / commitdiff
