From d9148d1023f7f880c905cb7074c8883e420abd24 Mon Sep 17 00:00:00 2001 From: Daniel Olatunji Date: Tue, 30 Jan 2024 18:30:37 +0100 Subject: [PATCH] detect/analyzer: add more details for tcp_seq Log the matched Sequence number of a packet Issue: 6353 --- src/detect-engine-analyzer.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 354c93413f..d0f7123880 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -41,6 +41,7 @@ #include "detect-tcp-flags.h" #include "detect-tcp-ack.h" #include "detect-ipopts.h" +#include "detect-tcp-seq.h" #include "feature.h" #include "util-print.h" #include "util-time.h" @@ -912,6 +913,14 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData * jb_close(js); break; } + case DETECT_SEQ: { + const DetectSeqData *cd = (const DetectSeqData *)smd->ctx; + + jb_open_object(js, "seq"); + jb_set_uint(js, "number", cd->seq); + jb_close(js); + break; + } } jb_close(js); -- 2.47.2