]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
doc/quic: update for new quic.version logic
authorVictor Julien <vjulien@oisf.net>
Fri, 14 Jan 2022 20:12:48 +0000 (21:12 +0100)
committerVictor Julien <vjulien@oisf.net>
Wed, 19 Jan 2022 13:10:50 +0000 (14:10 +0100)
doc/userguide/rules/quic-keywords.rst

index 80bdd4ee6ce265c86d300b43b94b01baff639bfe..3caad23638982e092a61ac79a32ae20544d22156 100644 (file)
@@ -26,19 +26,19 @@ Match on the CYU string
 Examples::
 
   alert quic any any -> any any (msg:"QUIC CYU STRING"; \
-  quic.cyu.string; content:"46,PAD-SNI-VER-CCS-UAID-TCID-PDMD-SMHL-ICSL-NONP-MIDS-SCLS-CSCT-COPT-IRTT-CFCW-SFCW"; \
-  sid:2;)
+    quic.cyu.string; content:"46,PAD-SNI-VER-CCS-UAID-TCID-PDMD-SMHL-ICSL-NONP-MIDS-SCLS-CSCT-COPT-IRTT-CFCW-SFCW"; \
+    sid:2;)
 
 quic.version
----------------
+------------
 
-Match on the Quic header version
+Sticky buffer for matching on the Quic header version in long headers.
 
 Examples::
 
   alert quic any any -> any any (msg:"QUIC VERSION"; \
-  quic.version:1362113590; \
-  sid:3;)
+    quic.version; content:"Q046"; \
+    sid:3;)
 
 Additional information
 ----------------------