<head>\r
<meta http-equiv="Content-Type" content="application/xhtml+xml; charset=UTF-8" />\r
<meta name="generator" content="AsciiDoc 8.6.8" />\r
-<title>Snort 3 User Manual</title>\r
+<title>Snort++ User Manual</title>\r
<style type="text/css">\r
/* Shared CSS for AsciiDoc xhtml11 and html5 backends */\r
\r
</head>\r
<body class="article">\r
<div id="header">\r
-<h1>Snort 3 User Manual</h1>\r
+<h1>Snort++ User Manual</h1>\r
<span id="author">The Snort Team</span><br />\r
</div>\r
<div id="content">\r
<div class="literalblock">\r
<div class="content">\r
<pre><code> ,,_ -*> Snort++ <*-\r
-o" )~ Version 3.0.0-a4 (Build 222) from 2.9.8-383\r
+o" )~ Version 3.0.0-a4 (Build 206) from 2.9.7-262\r
'''' By Martin Roesch & The Snort Team\r
http://snort.org/contact#team\r
Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.\r
<div class="sect1">\r
<h2 id="_overview">Overview</h2>\r
<div class="sectionbody">\r
-<div class="paragraph"><p>Snort 3.0 is an updated version of the Snort Intrusion Prevention System\r
-(IPS) which features a new design that provides a superset of Snort 2.X\r
-functionality with better throughput, detection, scalability, and\r
-usability. Some of the key features of Snort 3.0 are:</p></div>\r
+<div class="paragraph"><p>Snort++ is an updated version of the Snort IPS (intrusion prevention\r
+system). This document assumes you have some familiarity with Snort and\r
+are looking to see what Snort++ has to offer. Here are some of the basic\r
+goals for Snort++:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-Autodetect services for portless configuration\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Modular design\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Plugin framework with over 200 plugins\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-More scalable memory profile\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-LuaJIT configuration, loggers, and rule options\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Hyperscan support\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Rewritten TCP handling\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-New rule parser and syntax\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Service rules like alert http\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Rule "sticky" buffers\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Way better SO rules\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-New HTTP inspector\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-New performance monitor\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-New time and space profiling\r
+Use a simple, scriptable configuration\r
</p>\r
</li>\r
<li>\r
<p>\r
-New latency monitoring and enforcement\r
+Make key components pluggable\r
</p>\r
</li>\r
<li>\r
<p>\r
-Piglets to facilitate component testing\r
+Autogenerate reference documentation\r
</p>\r
</li>\r
<li>\r
<p>\r
-Inspection Events\r
+Autodetect services for portless configuration\r
</p>\r
</li>\r
<li>\r
<p>\r
-Automake and Cmake\r
+Support sticky buffers in rules\r
</p>\r
</li>\r
<li>\r
<p>\r
-Autogenerate reference documentation\r
+Provide better cross platform support\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>Additional features are on the road map:</p></div>\r
+<div class="paragraph"><p>The above goals are met with this first alpha release. Additional,\r
+longer-term goals are:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-Support hardware offload for fast pattern acceleration\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Provide support for DPDK and ODP\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
Support pipelining of packet processing\r
</p>\r
</li>\r
<li>\r
<p>\r
-Support proxy mode\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Multi-tennant support\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Incremental reload\r
+Support hardware offload and data plane integration\r
</p>\r
</li>\r
<li>\r
<p>\r
-New serialization of perf data and events\r
+Rewrite critical modules like TCP reassembly and HTTP inspection\r
</p>\r
</li>\r
<li>\r
<p>\r
-Enhanced rule processing\r
+Support proxy mode\r
</p>\r
</li>\r
<li>\r
<p>\r
-Windows support\r
+Facilitate component testing\r
</p>\r
</li>\r
<li>\r
<p>\r
-Anomaly detection\r
+Simplify memory management\r
</p>\r
</li>\r
<li>\r
<p>\r
-and more!\r
+Provide all of Snort’s functionality\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>The remainder of this section provides a high level survey of the inputs,\r
-processing, and outputs available with Snort 3.0.</p></div>\r
-<div class="paragraph"><p>Snort++ is the project that is creating Snort 3.0. In this manual "Snort"\r
-or "Snort 3" refers to the 3.0 version and earlier versions will be\r
-referred to as "Snort 2" where the distinction is relevant.</p></div>\r
-<div class="sect2">\r
-<h3 id="_first_steps">First Steps</h3>\r
-<div class="paragraph"><p>Snort can be configured to perform complex packet processing and deep\r
-packet inspection but it is best start simply and work up to more\r
-interesting tasks. Snort won’t do anything you didn’t specifically ask it\r
-to do so it is safe to just try things out and see what happens. Let’s\r
-start by just running Snort with no arguments:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>That will output usage information including some basic help commands. You\r
-should run all of these commands now to see what is available:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort -V\r
-$ snort -?\r
-$ snort --help</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Note that Snort has extensive command line help available so if anything\r
-below isn’t clear, there is probably a way to get the exact information you\r
-need from the command line.</p></div>\r
-<div class="paragraph"><p>Now let’s examine the packets in a capture file (pcap):</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort -r a.pcap</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Snort will decode and count the packets in the file and output some\r
-statistics. Note that the output excludes non-zero numbers so it is easy\r
-to see what is there.</p></div>\r
-<div class="paragraph"><p>You may have noticed that there are command line options to limit the\r
-number of packets examined or set a filter to select particular packets.\r
-Now is a good time to experiment with those options.</p></div>\r
-<div class="paragraph"><p>If you want to see details on each packet, you can dump the packets to\r
-console like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort -r a.pcap -L dump</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Add the -d option to see the TCP and UDP payload. Now let’s switch to live\r
-traffic. Replace eth0 in the below command with an available network\r
-interface:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort -i eth0 -L dump</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Unless the interface is taken down, Snort will just keep running, so enter\r
-Control-C to terminate or use the -n option to limit the number of packets.</p></div>\r
-<div class="paragraph"><p>Generally it is better to capture the packets for later analysis like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort -i eth0 -L pcap -n 10</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Snort will write 10 packets to log.pcap.# where # is a timestamp value.\r
-You can read these back with -r and dump to console or pcap with -L. You\r
-get the idea.</p></div>\r
-<div class="paragraph"><p>Note that you can do similar things with other tools like tcpdump or\r
-Wireshark however these commands are very useful when you want to check\r
-your Snort setup.</p></div>\r
-<div class="paragraph"><p>The examples above use the default pcap DAQ. Snort supports non-pcap\r
-interfaces as well via the DAQ (data acquisition) library. Other DAQs\r
-provide additional functionality such as inline operation and/or higher\r
-performance. There are even DAQs that support raw file processing (ie\r
-without packets), socket processing, and plain text packets. To load\r
-external DAQ libraries and see available DAQs or select a particular DAQ\r
-use one of these commands:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort --daq-dir <path> --daq-list\r
-$ snort --daq-dir <path> --daq <type></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Be sure to put the --daq-dir option ahead of the --daq-list option or the\r
-external DAQs won’t appear in the list.</p></div>\r
-<div class="paragraph"><p>To leverage intrusion detection features of Snort you will need to provide\r
-some configuration details. The next section breaks down what must be\r
-done.</p></div>\r
-</div>\r
+<div class="paragraph"><p>This first alpha release is based on Snort 2.9.6-9 and excludes all but one\r
+of Snort’s dynamic preprocessors. Work is underway to port that\r
+functionality and additions will be rolled out as they become available.</p></div>\r
<div class="sect2">\r
<h3 id="_configuration">Configuration</h3>\r
-<div class="paragraph"><p>Effective configuration of Snort is done via the environment, command\r
-line, a Lua configuration file, and a set of rules.</p></div>\r
-<div class="paragraph"><p>Note that backwards compatibility with Snort 2 was sacrificed to obtain\r
-new and improved functionality. While Snort 3 leverages some of the\r
-Snort 2 code base, a lot has changed. The configuration of Snort 3 is\r
-done with Lua, so your old conf won’t work as is. Rules are still text\r
-based but with syntax tweaks, so your 2.X rules must be fixed up. However,\r
-snort2lua will help you convert your conf and rules to the new format.</p></div>\r
-<div class="sect3">\r
-<h4 id="_environment">Environment</h4>\r
-<div class="paragraph"><p>LUA_PATH must be set based on your install:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>LUA_PATH=$install_prefix/include/snort/lua/\?.lua\;\;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>SNORT_LUA_PATH must be set to load auxiliary configuration files if you use\r
-the default snort.lua. For example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>export SNORT_LUA_PATH=$install_prefix/etc/snort</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_command_line">Command Line</h4>\r
-<div class="paragraph"><p>A simple command line might look like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c snort.lua -R cool.rules -r some.pcap -A cmg</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>To understand what that does, you can start by just running snort with no\r
-arguments by running snort --help. Help for all configuration and rule\r
-options is available via a suitable command line. In this case:</p></div>\r
-<div class="paragraph"><p>-c snort.lua is the main configuration file. This is a Lua script that is\r
-executed when loaded.</p></div>\r
-<div class="paragraph"><p>-R cool.rules contains some detection rules. You can write your own or\r
-obtain them from Talos (native 3.0 rules are not yet available from Talos\r
-so you must convert them with snort2lua). You can also put your rules\r
-directly in your configuration file.</p></div>\r
-<div class="paragraph"><p>-r some.pcap tells Snort to read network traffic from the given packet\r
-capture file. You could instead use -i eth0 to read from a live interface.\r
-There many other options available too depending on the DAQ you use.</p></div>\r
-<div class="paragraph"><p>-A cmg says to output intrusion events in "cmg" format, which has basic\r
-header details followed by the payload in hex and text.</p></div>\r
-<div class="paragraph"><p>Note that you add to and/or override anything in your configuration file by\r
-using the --lua command line option. For example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>--lua 'ips = { enable_builtin_rules = true }'</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>will load the built-in decoder and inspector rules. In this case, ips is\r
-overwritten with the config you see above. If you just want to change the\r
-config given in your configuration file you would do it like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>--lua 'ips.enable_builtin_rules = true'</code></pre>\r
-</div></div>\r
+<div class="paragraph"><p>Note that retaining backwards compatibility is not a goal. While Snort++\r
+leverages some of the Snort code base, a lot has changed. The\r
+configuration of Snort++ is done with Lua, so your old conf won’t work as\r
+is. Rules are still text based but nonetheless incompatible. However,\r
+Snort2Lua will help you convert your conf and rules to the new format.</p></div>\r
+<div class="paragraph"><p>The original Snort manual may be useful for some background information not\r
+yet documented for Snort++. The configuration differences are given in\r
+this manual.</p></div>\r
</div>\r
-<div class="sect3">\r
-<h4 id="_configuration_file">Configuration File</h4>\r
-<div class="paragraph"><p>The configuration file gives you complete control over how Snort processes\r
-packets. Start with the default snort.lua included in the distribution\r
-because that contains some key ingredients. Note that most of the\r
-configurations look like:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>stream = { }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This means enable the stream module using internal defaults. To see what\r
-those are, you could run:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --help-config stream</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Snort is organized into a collection of builtin and plugin modules.\r
+<div class="sect2">\r
+<h3 id="_modules">Modules</h3>\r
+<div class="paragraph"><p>Snort++ is organized into a collection of builtin and plugin modules.\r
If a module has parameters, it is configured by a Lua table of the same\r
name. For example, we can see what the active module has to offer with\r
this command:</p></div>\r
<pre><code>active = { max_responses = 1, min_interval = 5 }</code></pre>\r
</div></div>\r
</div>\r
-<div class="sect3">\r
-<h4 id="_rules">Rules</h4>\r
-<div class="paragraph"><p>Rules determine what Snort is looking for. They can be put directly in\r
-your Lua configuration file with the ips module, on the command line with\r
---lua, or in external files. Generally you will have many rules obtained\r
-from various sources such as Talos and loading external files is the way to\r
-go so we will summarize that here. Add this to your Lua configuration:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>ips = { include = 'rules.txt' }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>to load the external rules file named rules.txt. You can only specify\r
-one file this way but rules files can include other rules files with the\r
-include statement. In addition you can load rules like:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ sort -c snort.lua -R rules.txt</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>You can use both approaches together.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_converting_your_2_x_configuration">Converting Your 2.X Configuration</h4>\r
-<div class="paragraph"><p>If you have a working 2.X configuration snort2lua makes it easy to get up\r
-and running with Snort 3. This tool will convert your configuration and/or\r
-rules files automatically. You will want to clean up the results and\r
-double check that it is doing exactly what you need.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort2lua -c snort.conf</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The above command will generate snort.lua based on your 2.X configuration.\r
-For more information and options for more sophisticated use cases, see the\r
-Snort2Lua section later in the manual.</p></div>\r
-</div>\r
-</div>\r
<div class="sect2">\r
-<h3 id="_output">Output</h3>\r
-<div class="paragraph"><p>Snort can produce quite a lot of data. In the following we will summarize\r
-the key aspects of the core output types. Additional data such as from\r
-appid is covered later.</p></div>\r
-<div class="sect3">\r
-<h4 id="_basic_statistics">Basic Statistics</h4>\r
-<div class="paragraph"><p>At shutdown, Snort will output various counts depending on configuration\r
-and the traffic processed. Generally, you may see:</p></div>\r
+<h3 id="_plugins_and_scripts">Plugins and Scripts</h3>\r
+<div class="paragraph"><p>There are several plugin types:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Packet Statistics - this includes data from the DAQ and decoders such as\r
- the number of packets received and number of UDP packets.\r
+Codec - to decode and encode packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-Module Statistics - each module tracks activity via a set of peg counts\r
- that indicate how many times something was observed or performed. This\r
- might include the number of HTTP GET requests processed and the number of\r
- TCP reset packets trimmed.\r
+Inspector - like the prior preprocessors, for normalization, etc.\r
</p>\r
</li>\r
<li>\r
<p>\r
-File Statistics - look here for a breakdown of file type, bytes,\r
- signatures.\r
+IpsOption - for detection in Snort++ IPS rules\r
</p>\r
</li>\r
<li>\r
<p>\r
-Summary Statistics - this includes total runtime for packet processing\r
- and the packets per second. Profiling data will appear here as well if\r
- configured.\r
+IpsAction - for custom rule actions\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Note that only the non-zero counts are output. Run this to see the\r
-available counts:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort --help-counts</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_alerts">Alerts</h4>\r
-<div class="paragraph"><p>If you configured rules, you will need to configure alerts to see the\r
-details of detection events. Use the -A option like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort -c snort.lua -r a.pcap -A cmg</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>There are many types of alert outputs possible. Here is a brief list:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
--A cmg is the same as -A fast -d -e and will show information about the\r
- alert along with packet headers and payload.\r
+Logger - for handling events\r
</p>\r
</li>\r
<li>\r
<p>\r
--A u2 is the same as -A unified2 and will log events and triggering\r
- packets in a binary file that you can feed to other tools for post\r
- processing. Note that Snort 3 does not provide the raw packets for\r
- alerts on PDUs; you will get the actual buffer that alerted.\r
+Mpse - for fast pattern matching\r
</p>\r
</li>\r
<li>\r
<p>\r
--A csv will output various fields in comma separated value format. This\r
- is entirely customizable and very useful for pcap analysis.\r
+So - for dynamic rules\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>To see the available alert types, you can run this command:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort --list-plugins | grep logger</code></pre>\r
-</div></div>\r
+<div class="paragraph"><p>Most plugins can be built statically or dynamically. By default they are\r
+all static. There is no difference in functionality between static or\r
+dynamic plugins but the dynamic build generates a slightly lighter weight\r
+binary. Either way you can add dynamic plugins with --plugin-path and\r
+newer versions will replace older versions, even when built statically.</p></div>\r
+<div class="paragraph"><p>The power of plugins is that they have a very focused purpose and can be\r
+created with relative ease. For example, you can extend the rule language\r
+by writing your own IpsOption and it will plug in and function just like\r
+existing options. The extra directory has examples of each type of plugin.</p></div>\r
+<div class="paragraph"><p>Some things just need to be tweaked or prototyped quickly. In addition to\r
+the Lua conf, which is a script that can contain functions to compute\r
+settings, etc., you can also script Loggers and IpsOptions.</p></div>\r
</div>\r
-<div class="sect3">\r
-<h4 id="_files_and_paths">Files and Paths</h4>\r
-<div class="paragraph"><p>Note that output is specific to each packet thread. If you run 4 packet\r
-threads with u2 output, you will get 4 different u2 files. The basic\r
-structure is:</p></div>\r
+<div class="sect2">\r
+<h3 id="_new_http_inspector">New Http Inspector</h3>\r
+<div class="paragraph"><p>One of the major undertakings for Snort 3.0 is developing a completely new\r
+HTTP inspector. It is incomplete right now but you can examine the\r
+work-in-progress. You can configure it by adding:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code><logdir>/[<run_prefix>][<id#>][<X>]<name></code></pre>\r
+<pre><code>new_http_inspect = {}</code></pre>\r
</div></div>\r
-<div class="paragraph"><p>where:</p></div>\r
+<div class="paragraph"><p>to your snort.lua configuration file. Or you can read it in the source code\r
+under src/service_inspectors/nhttp_inspect.</p></div>\r
+<div class="paragraph"><p>The classic HTTP preprocessor is still available in the alpha release as\r
+http_inspect. It’s probably the better choice for now if you just want to\r
+do some work and do not feel like experimenting. Be sure not to configure\r
+ both old and new HTTP inspectors at the same time.</p></div>\r
+<div class="paragraph"><p>So why a new HTTP inspector?</p></div>\r
+<div class="paragraph"><p>For starters it is object-oriented. That’s good for us because we maintain\r
+this software. But it should also be really nice for open-source\r
+developers. You can make meaningful changes and additions to HTTP\r
+processing without having to understand the whole thing. In fact much of\r
+the new HTTP inspector’s knowledge of HTTP is centralized in a series of\r
+tables where it can be easily reviewed and modified. Many significant\r
+changes can be made just by updating these tables.</p></div>\r
+<div class="paragraph"><p>New_http_inspect is the first inspector written specifically for the new\r
+Snort 3.0 architecture. That provides access to one of the very best\r
+features of Snort 3.0: purely PDU-based inspection. Classic http_inspect\r
+processes HTTP messages, but even while doing so it is constantly aware of\r
+IP packets and how they divide up the TCP data stream. The same HTTP\r
+message might be processed differently depending on how the sender (bad\r
+guy) divided it up into IP packets.</p></div>\r
+<div class="paragraph"><p>New_http_inspect is free of this burden and can focus exclusively on HTTP.\r
+That makes it much more simple, easier to test, and less prone to false\r
+positives. It also greatly reduces the opportunity for adversaries to probe\r
+the inspector for weak spots by adjusting packet boundaries to disguise bad\r
+behavior.</p></div>\r
+<div class="paragraph"><p>Dealing solely with HTTP messages also opens the door for developing major\r
+new features. The new_http_inspect design supports true stateful\r
+processing. Want to ask questions that involve both the client request and\r
+the server response? Or different requests in the same session? These\r
+things are possible.</p></div>\r
+<div class="paragraph"><p>Another new feature on the horizon is HTTP/2 analysis. HTTP/2 derives from\r
+Google’s SPDY project and is in the process of being standardized. Despite\r
+the name, it is better to think of HTTP/2 not as a newer version of\r
+HTTP/1.1, but rather a separate protocol layer that runs under HTTP/1.1 and\r
+on top of TLS or TCP. It’s a perfect fit for the new Snort 3.0 architecture\r
+because a new HTTP/2 inspector would naturally output HTTP/1.1 messages but\r
+not any underlying packets. Exactly what the new_http_inspect wants to\r
+input.</p></div>\r
+<div class="paragraph"><p>New_http_inspect is taking a very different approach to HTTP header fields.\r
+Classic http_inspect divides all the HTTP headers following the start line\r
+into cookies and everything else. It normalizes the two pieces using a\r
+generic process and puts them in buffers that one can write rules against.\r
+There is some limited support for examining individual headers within the\r
+inspector but it is very specific.</p></div>\r
+<div class="paragraph"><p>The new concept is that every header should be normalized in an appropriate\r
+and specific way and individually made available for the user to write\r
+rules against it. If for example a header is supposed to be a date then\r
+normalization means put that date in a standard format.</p></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_binder_and_wizard">Binder and Wizard</h3>\r
+<div class="paragraph"><p>One of the fundamental differences between Snort and Snort++ concerns configuration related to networks and ports. Here is a brief review of Snort’s configuration for network and service related components:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-logdir is set with -l and defaults to ./\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-run_prefix is set with --run-prefix else not used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-id# is the packet thread number that writes the file; with one packet\r
- thread, id# (zero) is omitted without --id-zero\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-X is / if you use --id-subdir, else _ if id# is used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-name is based on module name that writes the file\r
+Snort’s configuration has a default policy and optional policies selected by\r
+ VLAN or network (with config binding).\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Additional considerations:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-There is no way to explicitly configure a full path to avoid issues with\r
- multiple packet threads.\r
+Each policy contains a user defined set of preprocessor configurations.\r
</p>\r
</li>\r
<li>\r
<p>\r
-All text mode outputs default to stdout\r
+Each preprocessor has a default configuration and some support non-default\r
+ configurations selected by network.\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_performance_statistics">Performance Statistics</h4>\r
-<div class="paragraph"><p>Still more data is available beyond the above.</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-By configuring the perf_monitor module you can capture a configurable set\r
- of peg counts during runtime. This is useful to feed to an external\r
- program so you can see what is happening without stopping Snort.\r
+Most preprocessors have port configurations.\r
</p>\r
</li>\r
<li>\r
<p>\r
-The profiler module allows you to track time and space used by module and\r
- rules. Use this data to tune your system for best performance. The\r
- output will show up under Summary Statistics at shutdown.\r
+The default policy may also contain a list of ports to ignore.\r
</p>\r
</li>\r
</ul></div>\r
-</div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_concepts">Concepts</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>This section provides background on essential aspects of Snort’s operation.</p></div>\r
-<div class="sect2">\r
-<h3 id="_terminology">Terminology</h3>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>basic module</strong>: a module integrated into Snort that does not come from a\r
- plugin.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>binder</strong>: inspector that maps configuration to traffic\r
+<div class="paragraph"><p>In Snort++, the above configurations are done in a single module called the binder. Here is an example:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>binder =\r
+{\r
+ -- allow all tcp port 22:\r
+ -- (similar to snort 2.X config ignore_ports)\r
+ { when = { proto = 'tcp', ports = '22' }, use = { action = 'allow' } },</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>-- select a config file by vlan\r
+-- (similar to snort 2.X config binding by vlan)\r
+{ when = { vlans = '1024' }, use = { file = 'vlan.lua' } },</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>-- use a non-default HTTP inspector for port 8080:\r
+-- (similar to a snort 2.X targeted preprocessor config)\r
+{ when = { nets = '192.168.0.0/16', proto = 'tcp', ports = '8080' },\r
+ use = { name = 'alt_http', type = 'http_inspect' } },</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>-- use the default inspectors:\r
+-- (similar to a snort 2.X default preprocessor config)\r
+{ when = { proto = 'tcp' }, use = { type = 'stream_tcp' } },\r
+{ when = { service = 'http' }, use = { type = 'http_inspect' } },</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code> -- figure out which inspector to run automatically:\r
+ { use = { type = 'wizard' } }\r
+}</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Bindings are evaluated when a session starts and again if and when service is\r
+identified on the session. Essentially, the bindings are a list of when-use\r
+rules evaluated from top to bottom. The first matching network and service\r
+configurations are applied. binder.when can contain any combination of\r
+criteria and binder.use can specify an action, config file, or inspector\r
+configuration.</p></div>\r
+<div class="paragraph"><p>Using the wizard enables port-independent configuration and the detection of\r
+malware command and control channels. If the wizard is bound to a session, it\r
+peeks at the initial payload to determine the service. For example, <em>GET</em>\r
+would indicate HTTP and <em>HELO</em> would indicate SMTP. Upon finding a match, the\r
+service bindings are reevaluated so the session can be handed off to the\r
+appropriate inspector. The wizard is still under development; if you find you\r
+need to tweak the defaults please let us know.</p></div>\r
+<div class="paragraph"><p>Additional Details:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+If the wizard and one or more service inspectors are configured w/o\r
+ explicitly configuring the binder, default bindings will be generated which\r
+ should work for most common cases.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>builtin rules</strong>: codec and inspector rules for anomalies detected\r
- internally.\r
+Also note that while Snort 2.X bindings can only be configured in the\r
+ default policy, each Snort 3.0 policy can contain a binder leading to an\r
+ arbitrary hierarchy.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>codec</strong>: short for coder / decoder. These plugins are used for basic\r
- protocol decoding, anomaly detection, and construction of active responses.\r
+The entire configuration can be reloaded and hot-swapped during run-time\r
+ via signal or command in both Snort 2.X and 3.0. Ultimately, Snort 3.0\r
+ will support commands to update the binder on the fly, thus enabling\r
+ incremental reloads of individual inspectors.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>data module</strong>: an adjunct configuration plugin for use with certain inspectors.\r
+Both Snort 2.X and 3.0 support server specific configurations via a hosts\r
+ table (XML in Snort 2.X and Lua in Snort 3.0). The table allows you to\r
+ map network, protocol, and port to a service and policy. This table can\r
+ be reloaded and hot-swapped separately from the config file.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dynamic rules</strong>: plugin rules loaded at runtime. See SO rules.\r
+You can find the specifics on the binder, wizard, and hosts tables in the\r
+ manual or command line like this: snort --help-module binder, etc.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_packet_processing">Packet Processing</h3>\r
+<div class="paragraph"><p>One of the goals of Snort++ is to provide a more flexible framework for\r
+packet processing by implementing an event-driven approach. Another is to\r
+produce data only when needed, to minimize expensive normalizations. To help\r
+explain these concepts, let’s start by examining how Snort processes\r
+packets. The key steps are given in the following figure:</p></div>\r
+<div class="imageblock">\r
+<div class="content">\r
+<img src="./snort2x.png" alt="Snort 2X" width="640" />\r
+</div>\r
+</div>\r
+<div class="paragraph"><p>The preprocess step is highly configurable. Arbitrary preprocessors can be\r
+loaded dynamically at startup, configured in snort.conf, and then executed\r
+at runtime. Basically, the preprocessors are put into a list which is\r
+iterated for each packet. Recent versions have tweaked the list handling\r
+some, but the same basic architecture has allowed Snort to grow from a\r
+sniffer, with no preprocessing, to a full-fledged IPS, with lots of\r
+preprocessing.</p></div>\r
+<div class="paragraph"><p>While this "list of plugins" approach has considerable flexibility, it\r
+hampers future development when the flow of data from one preprocessor to\r
+the next depends on traffic conditions, a common situation with advanced\r
+features like application identification. In this case, a preprocessor\r
+like HTTP may be extracting and normalizing data that ultimately is not\r
+used, or app ID may be repeatedly checking for data that is just not\r
+available.</p></div>\r
+<div class="paragraph"><p>Callbacks help break out of the preprocess straightjacket. This is where\r
+one preprocessor supplies another with a function to call when certain data\r
+is available. Snort has started to take this approach to pass some HTTP and\r
+SIP preprocessor data to app ID. However, it remains a peripheral feature\r
+and still requires the production of data that may not be consumed.</p></div>\r
+<div class="paragraph"><p>The basic processing steps Snort++ takes are similar to Snort’s as seen in\r
+the following diagram. The preprocess step employs specific inspector\r
+types instead of a generalized list, but the basic procedure includes\r
+stateless packet decoding, TCP stream reassembly, and service specific\r
+analysis in both cases. (Snort++ provides hooks for arbitrary inspectors,\r
+but they are not central to basic flow processing and are not shown.)</p></div>\r
+<div class="imageblock">\r
+<div class="content">\r
+<img src="./snort3x.png" alt="Snort 3X" width="640" />\r
+</div>\r
+</div>\r
+<div class="paragraph"><p>However, Snort++ also provides a more flexible mechanism than callback\r
+functions. By using inspection events, it is possible for an inspector to\r
+supply data that other inspectors can process. This is known as the\r
+observer pattern or publish-subscribe pattern.</p></div>\r
+<div class="paragraph"><p>Note that the data is not actually published. Instead, access to the data\r
+is published, and that means that subscribers can access the raw or\r
+normalized version(s) as needed. Normalizations are done only on the first\r
+access, and subsequent accesses get the previously normalized data. This\r
+results in just in time (JIT) processing.</p></div>\r
+<div class="paragraph"><p>A basic example of this in action is provided by the extra data_log plugin.\r
+It is a passive inspector, ie it does nothing until it receives the data it\r
+subscribed for (<em>other</em> in the above diagram). By adding data_log = { key\r
+= <em>http_raw_uri</em> } to your snort.lua configuration, you will get a simple\r
+URI logger.</p></div>\r
+<div class="paragraph"><p>Inspection events coupled with pluggable inspectors provide a very flexible\r
+framework for implementing new features. And JIT buffer stuffers allow\r
+Snort++ to work smarter, not harder. These capabilities will be leveraged\r
+more and more as Snort++ development continues.</p></div>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_getting_started">Getting Started</h2>\r
+<div class="sectionbody">\r
+<div class="paragraph"><p>The following pointers will help you get started:</p></div>\r
+<div class="sect2">\r
+<h3 id="_dependencies">Dependencies</h3>\r
+<div class="paragraph"><p>Required:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>fast pattern</strong>: the content in an IPS rule that must be found by the\r
- search engine in order for a rule to be evaluated.\r
+autotools or cmake to build from source\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>fast pattern matcher</strong>: see search engine.\r
+daq from <a href="http://www.snort.org">http://www.snort.org</a> for packet IO\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>hex</strong>: a type of protocol magic that the wizard uses to identify binary\r
- protocols.\r
+g++ >= 4.8 or other recent C++11 compiler\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector</strong>: plugin that processes packets (similar to the Snort 2\r
- preprocessor)\r
+dnet from <a href="https://github.com/dugsong/libdnet.git">https://github.com/dugsong/libdnet.git</a> for network utility\r
+ functions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>IPS</strong>: intrusion prevention system, like Snort.\r
+hwloc from <a href="https://www.open-mpi.org/projects/hwloc/">https://www.open-mpi.org/projects/hwloc/</a> for CPU affinity management\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>IPS action</strong>: plugin that allows you to perform custom actions when\r
- events are generated. Unlike loggers, these are invoked before\r
- thresholding and can be used to control external agents or send active\r
- responses.\r
+LuaJIT from <a href="http://luajit.org">http://luajit.org</a> for configuration and scripting\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>IPS option</strong>: this plugin is the building blocks of IPS rules.\r
+OpenSSL from <a href="https://www.openssl.org/source/">https://www.openssl.org/source/</a> for SHA and MD5 file signatures,\r
+ the protected_content rule option, and SSL service detection\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>logger</strong>: a plugin that performs output of events and packets. Events\r
- are thresholded before reaching loggers.\r
+pcap from <a href="http://www.tcpdump.org">http://www.tcpdump.org</a> for tcpdump style logging\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>module</strong>: the user facing portion of a Snort component. Modules chiefly\r
- provide configuration parameters, but may also provide commands, builtin\r
- rules, profiling statistics, peg counts, etc. Note that not all modules\r
- are plugins and not all plugins have modules.\r
+pcre from <a href="http://www.pcre.org">http://www.pcre.org</a> for regular expression pattern matching\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>peg count</strong>: the number of times a given event or condition occurs.\r
+pkgconfig from <a href="https://www.freedesktop.org/wiki/Software/pkg-config/">https://www.freedesktop.org/wiki/Software/pkg-config/</a> to locate build dependencies\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>plugin</strong>: one of several types of software components that can be loaded\r
- from a dynamic library when Snort starts up. Some plugins are coupled\r
- with the main engine in such a way that they must be built statically,\r
- but a newer version can be loaded dynamically.\r
+zlib from <a href="http://www.zlib.net">http://www.zlib.net</a> for decompression (>= 1.2.8 recommended)\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Optional:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>search engine</strong>: a plugin that performs multipattern searching of packets\r
- and payload to find rules that should be evaluated. There are currently\r
- no specific modules, although there are several search engine plugins.\r
- Related configuration is done with the basic detection module. Aka fast\r
- pattern matcher.\r
+lzma >= 5.1.2 from <a href="http://tukaani.org/xz/">http://tukaani.org/xz/</a> for decompression of SWF and\r
+ PDF files\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>SO rule</strong>: a IPS rule plugin that performs custom detection that can’t\r
- be done by a text rule. These rules typically do not have associated\r
- modules. SO comes from shared object, meaning dynamic library.\r
+hyperscan from <a href="https://github.com/01org/hyperscan">https://github.com/01org/hyperscan</a> to build new and improved\r
+ regex and (coming soon) fast pattern support\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>spell</strong>: a type of protocol magic that the wizard uses to identify ASCII\r
- protocols.\r
+cpputest from <a href="http://cpputest.github.io">http://cpputest.github.io</a> to run additional unit tests with\r
+ make check\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>text rule</strong>: a rule loaded from the configuration that has a header and\r
- body. The header specifies action, protocol, source and destination IP\r
- addresses and ports, and direction. The body specifies detection and\r
- non-detection options.\r
+asciidoc from <a href="http://www.methods.co.nz/asciidoc/">http://www.methods.co.nz/asciidoc/</a> to build the HTML\r
+ manual\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>wizard</strong>: inspector that applies protocol magic to determine which\r
- inspectors should be bound to traffic absent a port specific binding.\r
- See hex and spell.\r
+dblatex from <a href="http://dblatex.sourceforge.net">http://dblatex.sourceforge.net</a> to build the pdf manual (in\r
+ addition to asciidoc)\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_modules">Modules</h3>\r
-<div class="paragraph"><p>Modules are the building blocks of Snort. They encapsulate the types of\r
-data that many components need including parameters, peg counts, profiling,\r
-builtin rules, and commands. This allows Snort to handle them generically\r
-and consistently. You can learn quite a lot about any given module from\r
-the command line. For example, to see what stream_tcp is all about, do\r
-this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$ snort --help-config stream_tcp</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Modules are configured using Lua tables with the same name. So the\r
-stream_tcp module is configured with defaults like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>stream_tcp = { }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The earlier help output showed that the default session tracking timeout is\r
-30 seconds. To change that to 60 seconds, you can configure it this way:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>stream_tcp = { session_timeout = 60 }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Or this way:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>stream_tcp = { }\r
-stream_tcp.session_timeout = 60</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>More on parameters is given in the next section.</p></div>\r
-<div class="paragraph"><p>Other things to note about modules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Shutdown output will show the non-zero peg counts for all modules. For\r
- example, if stream_tcp did anything, you would see the number of sessions\r
- processed among other things.\r
+w3m from <a href="http://sourceforge.net/projects/w3m/">http://sourceforge.net/projects/w3m/</a> to build the plain text\r
+ manual\r
</p>\r
</li>\r
<li>\r
<p>\r
-Providing the builtin rules allows the documentation to include them\r
- automatically and also allows for autogenerating the rules at startup.\r
+source-highlight from <a href="http://www.gnu.org/software/src-highlite/">http://www.gnu.org/software/src-highlite/</a> to\r
+ generate the dev guide\r
</p>\r
</li>\r
<li>\r
<p>\r
-Only a few module provide commands at this point, most notably the snort\r
- module.\r
+safec from <a href="https://sourceforge.net/projects/safeclib/">https://sourceforge.net/projects/safeclib/</a> for runtime bounds\r
+ checks on certain legacy C-library calls.\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_parameters">Parameters</h3>\r
-<div class="paragraph"><p>Parameters are given with this format:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>type name = default: help { range }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The following types are used:</p></div>\r
+<h3 id="_building">Building</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>addr</strong>: any valid IP4 or IP6 address or CIDR\r
+Optionally built features are listed in the reference section.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>addr_list</strong>: a space separated list of addr values\r
+Create an install path:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>export my_path=/path/to/snorty\r
+mkdir -p $my_path</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>bit_list</strong>: a list of consecutive integer values from 1 to the range\r
- maximum\r
+If you are using a github clone with autotools, do this:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>autoreconf -isvf</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>bool</strong>: true or false\r
+Now do one of the following:\r
</p>\r
-</li>\r
+<div class="olist loweralpha"><ol class="loweralpha">\r
<li>\r
<p>\r
-<strong>dynamic</strong>: a select type determined by loaded plugins\r
+To build with autotools, simply do the usual from the top level directory:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>./configure --prefix=$my_path\r
+make -j 8\r
+make install</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>enum</strong>: a string selected from the given range\r
+To build with cmake and make, run configure_cmake.sh. It will\r
+ automatically create and populate a new subdirectory named <em>build</em>.\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>./configure_cmake.sh --prefix=$my_path\r
+cd build\r
+make -j 8\r
+make install\r
+ln -s $my_path/conf $my_path/etc</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>implied</strong>: an IPS rule option that takes no value but means true\r
+You can also specify a cmake project generator:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>./configure_cmake.sh --generator=Xcode --prefix=$my_path</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>int</strong>: a whole number in the given range\r
+Or use ccmake directly to configure and generate from an arbitrary build\r
+ directory like one of these:\r
</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>ip4</strong>: an IP4 address or CIDR\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>ccmake -G Xcode /path/to/Snort++/tree\r
+open snort.xcodeproj</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/Snort++/tree\r
+run eclipse and do File > Import > Existing Eclipse Project</code></pre>\r
+</div></div>\r
+</li>\r
+</ol></div>\r
+</li>\r
+<li>\r
+<p>\r
+To build with g++ on OS X where clang is installed, do this first:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>export CXX=g++</code></pre>\r
+</div></div>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_run">Run</h3>\r
+<div class="paragraph"><p>First set up the environment:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;\r
+export SNORT_LUA_PATH=$my_path/etc/snort/</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Then give it a go:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>mac</strong>: an ethernet address with the form 01:02:03:04:05:06\r
+Get some help:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>$my_path/bin/snort --help\r
+$my_path/bin/snort --help-module suppress\r
+$my_path/bin/snort --help-config | grep thread</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>multi</strong>: one or more space separated strings from the given range\r
+Examine and dump a pcap:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>$my_path/bin/snort -r <pcap>\r
+$my_path/bin/snort -K text -d -e -q -r <pcap></code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>port</strong>: an int in the range 0:65535 indicating a TCP or UDP port number\r
+Verify config, with or w/o rules:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua\r
+$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>real</strong>: a real number in the given range\r
+Run IDS mode. To keep it brief, look at the first n packets in each file:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \\r
+ -r <pcap> -A alert_test -n 100000</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>select</strong>: a string selected from the given range\r
+Let’s suppress 1:2123. We could edit the conf or just do this:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \\r
+ -r <pcap> -A alert_test -n 100000 --lua "suppress = { { gid = 1, sid = 2123 } }"</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<strong>string</strong>: any string with no more than the given length, if any\r
+Go whole hog on a directory with multiple packet threads:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \\r
+ --pcap-filter \*.pcap --pcap-dir <dir> -A alert_fast -n 1000 --max-packet-threads 8</code></pre>\r
+</div></div>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>The parameter name may be adorned in various ways to indicate additional\r
-information about the type and use of the parameter:</p></div>\r
+<div class="paragraph"><p>For more examples, see the usage section.</p></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_tips">Tips</h3>\r
+<div class="paragraph"><p>One of the goals of Snort++ is to make it easier to configure your sensor.\r
+Here is a summary of tips and tricks you may find useful.</p></div>\r
+<div class="paragraph"><p>General Use</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-For Lua configuration (not IPS rules), if the name ends with [] it is\r
- a list item and can be repeated.\r
+Snort tries hard not to error out too quickly. It will report multiple\r
+ semantic errors.\r
</p>\r
</li>\r
<li>\r
<p>\r
-For IPS rules only, names starting with ~ indicate positional\r
- parameters. The names of such parameters do not appear in the rule.\r
+Snort always assumes the simplest mode of operation. Eg, you can omit the -T\r
+ option to validate the conf if you don’t provide a packet source.\r
</p>\r
</li>\r
<li>\r
<p>\r
-IPS rules may also have a wild card parameter, which is indicated by a\r
- *. Only used for metadata that Snort ignores.\r
+Warnings are not emitted unless --warn-* is specified. --warn-all enables all\r
+ warnings, and --pedantic makes such warnings fatal.\r
</p>\r
</li>\r
<li>\r
<p>\r
-The snort module has command line options starting with a -.\r
+You can process multiple sources at one time by using the -z or --max-threads\r
+ option.\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Some additional details to note:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Table and variable names are case sensitive; use lower case only.\r
+To make it easy to find the important data, zero counts are not output at\r
+ shutdown.\r
</p>\r
</li>\r
<li>\r
<p>\r
-String values are case sensitive too; use lower case only.\r
+Load plugins from the command line with --plugin-path /path/to/install/lib.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Numeric ranges may be of the form low:high where low and high are\r
- bounds included in the range. If either is omitted, there is no hard\r
- bound. E.g. 0: means any x where x >= 0.\r
+You can process multiple sources at one time by using the -z or\r
+ --max-threads option.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Strings may have a numeric range indicating a length limit; otherwise\r
- there is no hard limit.\r
+Unit tests are configured with --enable-unit-tests. They can then be run\r
+ with snort --catch-test [tags]|all.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Lua Configuration</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-bit_list is typically used to store a set of byte, port, or VLAN ID\r
- values.\r
+Configure the wizard and default bindings will be created based on configured\r
+ inspectors. No need to explicitly bind ports in this case.\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_plugins">Plugins</h3>\r
-<div class="paragraph"><p>Snort uses a variety of plugins to accomplish much of its processing\r
-objectives, including:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Codec - to decode and encode packets\r
+You can override or add to your Lua conf with the --lua command line option.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Inspector - like Snort 2 preprocessors, for normalization, etc.\r
+The Lua conf is a live script that is executed when loaded. You can add\r
+ functions, grab environment variables, compute values, etc.\r
</p>\r
</li>\r
<li>\r
<p>\r
-IpsOption - for detection in Snort rules\r
+You can also rename symbols that you want to disable. For example,\r
+ changing normalizer to Xnormalizer (an unknown symbol) will disable the\r
+ normalizer. This can be easier than commenting in some cases.\r
</p>\r
</li>\r
<li>\r
<p>\r
-IpsAction - for custom actions\r
+By default, symbols unknown to Snort++ are silently ignored. You can\r
+ generate warnings for them with --warn-unknown. To ignore such symbols,\r
+ export them in the environment variable SNORT_IGNORE.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Writing and Loading Rules</p></div>\r
+<div class="paragraph"><p>Snort++ rules allow arbitrary whitespace. Multi-line rules make it easier to\r
+structure your rule for clarity. There are multiple ways to add comments to\r
+your rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-Logger - for handling events\r
+Like Snort, the # character starts a comment to end of line. In addition, all\r
+ lines between #begin and #end are comments.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Mpse - for fast pattern matching\r
+The rem option allows you to write a comment that is conveyed with the rule.\r
</p>\r
</li>\r
<li>\r
<p>\r
-So - for dynamic rules\r
+C style multi-line comments are allowed, which means you can comment out\r
+ portions of a rule while testing it out by putting the options between /* and\r
+ */.\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>The power of plugins is that they have a very focused purpose and can be\r
-created with relative ease. For example, you can extend the rule language\r
-by writing your own IpsOption and it will plug in and function just like\r
-existing options. The extra directory has examples of each type of plugin.</p></div>\r
-<div class="paragraph"><p>Most plugins can be built statically or dynamically. By default they are\r
-all static. There is no difference in functionality between static or\r
-dynamic plugins but the dynamic build generates a slightly lighter weight\r
-binary. Either way you can add dynamic plugins with --plugin-path and\r
-newer versions will replace older versions, even when built statically.</p></div>\r
-<div class="paragraph"><p>A single dynamic library may contain more than one plugin. For example, an\r
-inspector will typically be packaged together with any associated rule\r
-options.</p></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_operation">Operation</h3>\r
-<div class="paragraph"><p>Snort is a signature-based IPS, which means that as it receives network\r
-packets it reassembles and normalizes the content so that a set of rules\r
-can be evaluated to detect the presence of any significant conditions that\r
-merit further action. A rough processing flow is as follows:</p></div>\r
-<div class="imageblock">\r
-<div class="content">\r
-<img src="./snort2x.png" alt="Snort 2" width="480" />\r
-</div>\r
-</div>\r
-<div class="paragraph"><p>The steps are:</p></div>\r
-<div class="olist arabic"><ol class="arabic">\r
+<div class="paragraph"><p>There are multiple ways to load rules too:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-Decode each packet to determine the basic network characteristics such\r
-as source and destination addresses and ports. A typical packet might have\r
-ethernet containing IP containing TCP containing HTTP (ie eth:ip:tcp:http).\r
-The various encapsulating protocols are examined for sanity and anomalies\r
-as the packet is decoded. This is essentially a stateless effort.\r
+Set ips.rules or ips.include.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Preprocess each decoded packet using accumulated state to determine the\r
-purpose and content of the innermost message. This step may involve\r
-reordering and reassembling IP fragments and TCP segments to produce the\r
-original application protocol data unit (PDU). Such PDUs are analyzed and\r
-normalized as needed to support further processing.\r
+Snort 2.X include statements can be used in rules files.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Detection is a two step process. For efficiency, most rules contain a\r
-specific content pattern that can be searched for such that if no match is\r
-found no further processing is necessary. Upon start up, the rules are\r
-compiled into pattern groups such that a single, parallel search can be\r
-done for all patterns in the group. If any match is found, the full rule\r
-is examined according to the specifics of the signature.\r
+Use -R to load a rules file.\r
</p>\r
</li>\r
<li>\r
<p>\r
-The logging step is where Snort saves any pertinent information\r
-resulting from the earlier steps. More generally, this is where other\r
-actions can be taken as well such as blocking the packet.\r
+Use --stdin-rules with command line redirection.\r
</p>\r
</li>\r
-</ol></div>\r
-<div class="sect3">\r
-<h4 id="_snort_2_processing">Snort 2 Processing</h4>\r
-<div class="paragraph"><p>The preprocess step in Snort 2 is highly configurable. Arbitrary\r
-preprocessors can be loaded dynamically at startup, configured in\r
-snort.conf, and then executed at runtime. Basically, the preprocessors are\r
-put into a list which is iterated for each packet. Recent versions have\r
-tweaked the list handling some, but the same basic architecture has allowed\r
-Snort 2 to grow from a sniffer, with no preprocessing, to a full-fledged\r
-IPS, with lots of preprocessing.</p></div>\r
-<div class="paragraph"><p>While this "list of plugins" approach has considerable flexibility, it\r
-hampers future development when the flow of data from one preprocessor to\r
-the next depends on traffic conditions, a common situation with advanced\r
-features like application identification. In this case, a preprocessor\r
-like HTTP may be extracting and normalizing data that ultimately is not\r
-used, or appID may be repeatedly checking for data that is just not\r
-available.</p></div>\r
-<div class="paragraph"><p>Callbacks help break out of the preprocess straitjacket. This is where one\r
-preprocessor supplies another with a function to call when certain data is\r
-available. Snort has started to take this approach to pass some HTTP and\r
-SIP preprocessor data to appID. However, it remains a peripheral feature\r
-and still requires the production of data that may not be consumed.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_snort_3_processing">Snort 3 Processing</h4>\r
-<div class="paragraph"><p>One of the goals of Snort 3 is to provide a more flexible framework for\r
-packet processing by implementing an event-driven approach. Another is to\r
-produce data only when needed to minimize expensive normalizations.\r
-However, the basic packet processing provides very similar functionality.</p></div>\r
-<div class="paragraph"><p>The basic processing steps Snort 3 takes are similar to Snort 2 as seen\r
-in the following diagram. The preprocess step employs specific inspector\r
-types instead of a generalized list, but the basic procedure includes\r
-stateless packet decoding, TCP stream reassembly, and service specific\r
-analysis in both cases. (Snort 3 provides hooks for arbitrary inspectors,\r
-but they are not central to basic flow processing and are not shown.)</p></div>\r
-<div class="imageblock">\r
-<div class="content">\r
-<img src="./snort3x.png" alt="Snort 3" width="480" />\r
-</div>\r
-</div>\r
-<div class="paragraph"><p>However, Snort 3 also provides a more flexible mechanism than callback\r
-functions. By using inspection events, it is possible for an inspector to\r
-supply data that other inspectors can process. This is known as the\r
-observer pattern or publish-subscribe pattern.</p></div>\r
-<div class="paragraph"><p>Note that the data is not actually published. Instead, access to the data\r
-is published, and that means that subscribers can access the raw or\r
-normalized version(s) as needed. Normalizations are done only on the first\r
-access, and subsequent accesses get the previously normalized data. This\r
-results in just in time (JIT) processing.</p></div>\r
-<div class="paragraph"><p>A basic example of this in action is provided by the extra data_log plugin.\r
-It is a passive inspector, ie it does nothing until it receives the data it\r
-subscribed for (<em>other</em> in the above diagram). By adding the following to\r
-your snort.lua configuration, you will get a simple URI logger.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>data_log = { key = 'http_raw_uri' }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Inspection events coupled with pluggable inspectors provide a very flexible\r
-framework for implementing new features. And JIT buffer stuffers allow\r
-Snort to work smarter, not harder. These capabilities will be leveraged\r
-more and more as Snort development continues.</p></div>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_rules_2">Rules</h3>\r
-<div class="paragraph"><p>Rules tell Snort how to detect interesting conditions, such as an attack,\r
-and what to do when the condition is detected. Here is an example rule:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>alert tcp any any -> 192.168.1.1 80 ( msg:"A ha!"; content:"attack"; sid:1; )</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The structure is:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>action proto source dir dest ( body )</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Where:</p></div>\r
-<div class="paragraph"><p>action - tells Snort what to do when a rule "fires", ie when the signature\r
-matches. In this case Snort will log the event. It can also do thing like\r
-block the flow when running inline.</p></div>\r
-<div class="paragraph"><p>proto - tells Snort what protocol applies. This may be ip, icmp, tcp, udp,\r
-http, etc.</p></div>\r
-<div class="paragraph"><p>source - specifies the sending IP address and port, either of which can be\r
-the keyword any, which is a wildcard.</p></div>\r
-<div class="paragraph"><p>dir - must be either unidirectional as above or bidirectional indicated by\r
-<>.</p></div>\r
-<div class="paragraph"><p>dest - similar to source but indicates the receiving end.</p></div>\r
-<div class="paragraph"><p>body - detection and other information contained in parenthesis.</p></div>\r
-<div class="paragraph"><p>There are many rule options available to construct as sophisticated a\r
-signature as needed. In this case we are simply looking for the "attack"\r
-in any TCP packet. A better rule might look like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>alert http\r
-(\r
- msg:"Gotcha!";\r
- flow:established, to_server;\r
- http_uri:"attack";\r
- sid:2;\r
-)</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Note that these examples have a sid option, which indicates the signature\r
-ID. In general rules are specified by gid:sid:rev notation, where gid is\r
-the generator ID and rev is the revision of the rule. By default, text\r
-rules are gid 1 and shared-object (SO) rules are gid 3. The various\r
-components within Snort that generate events have 1XX gids, for example the\r
-decoder is gid 116. You can list the internal gids and sids with these\r
-commands:</p></div>\r
+<li>\r
+<p>\r
+Use --lua to specify one or more rules as a command line argument.\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Output Files</p></div>\r
+<div class="paragraph"><p>To make it simple to configure outputs when you run with multiple packet\r
+threads, output files are not explicitly configured. Instead, you can use the\r
+options below to format the paths:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>$ snort --list-gids\r
-$ snort --list-builtin</code></pre>\r
+<pre><code><logdir>/[<run_prefix>][<id#>][<X>]<name></code></pre>\r
</div></div>\r
-<div class="paragraph"><p>For details on these and other options, see the reference section.</p></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_pattern_matching">Pattern Matching</h3>\r
-<div class="paragraph"><p>Snort evaluates rules in a two-step process which includes a fast pattern\r
-search and full evaluation of the signature. More details on this process\r
-follow.</p></div>\r
-<div class="sect3">\r
-<h4 id="_rule_groups">Rule Groups</h4>\r
-<div class="paragraph"><p>When Snort starts or reloads configuration, rules are grouped by protocol,\r
-port and service. For example, all TCP rules using the HTTP_PORTS variable\r
-will go in one group and all service HTTP rules will go in another group.\r
-These rule groups are compiled into multipattern search engines (MPSE)\r
-which are designed to search for all patterns with just a single pass\r
-through a given packet or buffer. You can select the algorithm to use for\r
-fast pattern searches with search_engine.search_method which defaults to\r
-<em>ac_bnfa</em>, which balances speed and memory. For a faster search at the\r
-expense of significantly more memory, use <em>ac_full</em>. For best performance\r
-and reasonable memory, download the hyperscan source from Intel.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_fast_patterns">Fast Patterns</h4>\r
-<div class="paragraph"><p>Fast patterns are content strings that have the fast_pattern option or\r
-which have been selected by Snort automatically to be used as a fast\r
-pattern. Snort will by default choose the longest pattern in the rule\r
-since that is likely to be most unique. That is not always the case so add\r
-fast_pattern to the appropriate content option for best performance. The\r
-ideal fast pattern is one which, if found, is very likely to result in a\r
-rule match. Fast patterns that match frequently for unrelated traffic will\r
-cause Snort to work hard with little to show for it.</p></div>\r
-<div class="paragraph"><p>Certain contents are not eligible to be used as fast patterns.\r
-Specifically, if a content is negated, then if it is also relative to\r
-another content, case sensitive, or has non-zero offset or depth, then it\r
-is not eligible to be used as a fast pattern.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_rule_evaluation">Rule Evaluation</h4>\r
-<div class="paragraph"><p>For each fast pattern match, the corresponding rule(s) are evaluated\r
-left-to-right. Rule evaluation requires checking each detection option in\r
-a rule and is a fairly costly process which is why fast patterns are so\r
-important. Rule evaluation aborts on the first non-matching option.</p></div>\r
-<div class="paragraph"><p>When rule evaluation takes place, the fast pattern may or may not need to\r
-be searched for a second time. Note that this differs from Snort 2 which\r
-provided the fast_pattern:only option to designate such cases. This was\r
-removed because it is difficult for the rule writer get it right.</p></div>\r
-</div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_tutorial">Tutorial</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>The section will walk you through building and running Snort. It is not\r
-exhaustive but, once you master this material, you should be able to figure\r
-out more advanced usage.</p></div>\r
-<div class="sect2">\r
-<h3 id="_dependencies">Dependencies</h3>\r
-<div class="paragraph"><p>Required:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-autotools or cmake to build from source\r
+logdir is set with -l and defaults to ./\r
</p>\r
</li>\r
<li>\r
<p>\r
-daq from <a href="http://www.snort.org">http://www.snort.org</a> for packet IO\r
+run_prefix is set with --run-prefix else not used\r
</p>\r
</li>\r
<li>\r
<p>\r
-g++ >= 4.8 or other recent C++11 compiler\r
+id# is the packet thread number that writes the file; with one packet thread,\r
+ id# (zero) is omitted without --id-zero\r
</p>\r
</li>\r
<li>\r
<p>\r
-dnet from <a href="https://github.com/dugsong/libdnet.git">https://github.com/dugsong/libdnet.git</a> for network utility\r
- functions\r
+X is / if you use --id-subdir, else _ if id# is used\r
</p>\r
</li>\r
<li>\r
<p>\r
-hwloc from <a href="https://www.open-mpi.org/projects/hwloc/">https://www.open-mpi.org/projects/hwloc/</a> for CPU affinity management\r
+name is based on module name that writes the file\r
</p>\r
</li>\r
<li>\r
<p>\r
-LuaJIT from <a href="http://luajit.org">http://luajit.org</a> for configuration and scripting\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-OpenSSL from <a href="https://www.openssl.org/source/">https://www.openssl.org/source/</a> for SHA and MD5 file signatures,\r
- the protected_content rule option, and SSL service detection\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-pcap from <a href="http://www.tcpdump.org">http://www.tcpdump.org</a> for tcpdump style logging\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-pcre from <a href="http://www.pcre.org">http://www.pcre.org</a> for regular expression pattern matching\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-pkgconfig from <a href="https://www.freedesktop.org/wiki/Software/pkg-config/">https://www.freedesktop.org/wiki/Software/pkg-config/</a> to locate build dependencies\r
+all text mode outputs default to stdout\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_help">Help</h3>\r
+<div class="listingblock">\r
+<div class="content">\r
+<pre><code>Snort has several options to get more help:\r
+\r
+-? list command line options (same as --help)\r
+--help this overview of help\r
+--help-commands [<module prefix>] output matching commands\r
+--help-config [<module prefix>] output matching config options\r
+--help-counts [<module prefix>] output matching peg counts\r
+--help-module <module> output description of given module\r
+--help-modules list all available modules with brief help\r
+--help-plugins list all available plugins with brief help\r
+--help-options [<option prefix>] output matching command line options\r
+--help-signals dump available control signals\r
+--list-buffers output available inspection buffers\r
+--list-builtin [<module prefix>] output matching builtin rules\r
+--list-gids [<module prefix>] output matching generators\r
+--list-modules [<module type>] list all known modules\r
+--list-plugins list all known modules\r
+--show-plugins list module and plugin versions\r
+\r
+--help* and --list* options preempt other processing so should be last on the\r
+command line since any following options are ignored. To ensure options like\r
+--markup and --plugin-path take effect, place them ahead of the help or list\r
+options.\r
+\r
+Options that filter output based on a matching prefix, such as --help-config\r
+won't output anything if there is no match. If no prefix is given, everything\r
+matches.\r
+\r
+Report bugs to bugs@snort.org.</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_common_errors">Common Errors</h3>\r
+<div class="paragraph"><p><em>FATAL: snort_config is required</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-zlib from <a href="http://www.zlib.net">http://www.zlib.net</a> for decompression (>= 1.2.8 recommended)\r
+add this line near top of file:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>require('snort_config')</code></pre>\r
+</div></div>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>Optional:</p></div>\r
+<div class="paragraph"><p><em>PANIC: unprotected error in call to Lua API (cannot open\r
+snort_defaults.lua: No such file or directory)</em></p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-lzma >= 5.1.2 from <a href="http://tukaani.org/xz/">http://tukaani.org/xz/</a> for decompression of SWF and\r
- PDF files\r
+export SNORT_LUA_PATH to point to any dofiles\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>ERROR can’t find xyz</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-hyperscan from <a href="https://github.com/01org/hyperscan">https://github.com/01org/hyperscan</a> to build new and improved\r
- regex and (coming soon) fast pattern support\r
+if xyz is the name of a module, make sure you are not assigning a scalar\r
+ where a table is required (e.g. xyz = 2 should be xyz = { }).\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>ERROR can’t find x.y</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-cpputest from <a href="http://cpputest.github.io">http://cpputest.github.io</a> to run additional unit tests with\r
- make check\r
+module x does not have a parameter named y. check --help-module x for\r
+ available parameters.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>ERROR invalid x.y = z</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-asciidoc from <a href="http://www.methods.co.nz/asciidoc/">http://www.methods.co.nz/asciidoc/</a> to build the HTML\r
- manual\r
+the value z is out of range for x.y. check --help-config x.y for the range\r
+ allowed.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>ERROR: x = { y = z } is in conf but is not being applied</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-dblatex from <a href="http://dblatex.sourceforge.net">http://dblatex.sourceforge.net</a> to build the pdf manual (in\r
- addition to asciidoc)\r
+make sure that x = { } isn’t set later because it will override the\r
+ earlier setting. same for x.y.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>FATAL: can’t load lua/errors.lua: lua/errors.lua:68: <em>=</em> expected near\r
+';'</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-w3m from <a href="http://sourceforge.net/projects/w3m/">http://sourceforge.net/projects/w3m/</a> to build the plain text\r
- manual\r
+this is a syntax error reported by Lua to Snort on line 68 of errors.lua.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>ERROR: rules(2) unknown rule keyword: find.</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-source-highlight from <a href="http://www.gnu.org/software/src-highlite/">http://www.gnu.org/software/src-highlite/</a> to\r
- generate the dev guide\r
+this was due to not including the --script-path.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p><em>WARNING: unknown symbol x</em></p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-safec from <a href="https://sourceforge.net/projects/safeclib/">https://sourceforge.net/projects/safeclib/</a> for runtime bounds\r
- checks on certain legacy C-library calls.\r
+if you any variables, you can squelch such warnings by setting them in\r
+ an environment variable SNORT_IGNORE. to ignore x, y, and z:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>export SNORT_IGNORE="x y z"</code></pre>\r
+</div></div>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_building">Building</h3>\r
+<h3 id="_gotchas">Gotchas</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Optionally built features are listed in the reference section.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Create an install path:\r
+A nil key in a table will not caught. Neither will a nil value in a\r
+ table. Neither of the following will cause errors, nor will they\r
+ actually set http_server.post_depth:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>export my_path=/path/to/snorty\r
-mkdir -p $my_path</code></pre>\r
+<pre><code>http_server = { post_depth }\r
+http_server = { post_depth = undefined_symbol }</code></pre>\r
</div></div>\r
</li>\r
<li>\r
<p>\r
-If you are using a github clone with autotools, do this:\r
+It is not an error to set a value multiple times. The actual value\r
+ applied may not be the last in the table either. It is best to avoid\r
+ such cases.\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>autoreconf -isvf</code></pre>\r
+<pre><code>http_server =\r
+{\r
+ post_depth = 1234,\r
+ post_depth = 4321\r
+}</code></pre>\r
</div></div>\r
</li>\r
<li>\r
<p>\r
-Now do one of the following:\r
+Snort can’t tell you the exact filename or line number of a semantic\r
+ error but it will tell you the fully qualified name.\r
</p>\r
-<div class="olist loweralpha"><ol class="loweralpha">\r
+</li>\r
<li>\r
<p>\r
-To build with autotools, simply do the usual from the top level directory:\r
+The dump DAQ will not work with multiple threads unless you use --daq-var\r
+ file=/dev/null. This will be fixed in at some point to use the Snort log\r
+ directory, etc.\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>./configure --prefix=$my_path\r
-make -j 8\r
-make install</code></pre>\r
-</div></div>\r
</li>\r
<li>\r
<p>\r
-To build with cmake and make, run configure_cmake.sh. It will\r
- automatically create and populate a new subdirectory named <em>build</em>.\r
+Variables are currently processed in an order determined by the Lua hash\r
+ table which is effectively random. That means you will need to use Lua\r
+ string concatenation to ensure Snort doesn’t try to use a variable before\r
+ it is defined (even when it is defined ahead of use in the file):\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>./configure_cmake.sh --prefix=$my_path\r
-cd build\r
-make -j 8\r
-make install\r
-ln -s $my_path/conf $my_path/etc</code></pre>\r
+<pre><code>-- this may fail:\r
+MY_SERVERS = [[ 172.20.0.0/16 172.21.0.0/16 ]]\r
+EXTERNAL_NET = '!$MY_SERVERS'</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>-- this will work:\r
+MY_SERVERS = [[ 172.20.0.0/16 172.21.0.0/16 ]]\r
+EXTERNAL_NET = '!' .. MY_SERVERS</code></pre>\r
</div></div>\r
</li>\r
<li>\r
<p>\r
-You can also specify a cmake project generator:\r
+configure will use clang<code> by default if it is installed. To compile\r
+ with g</code> instead:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>./configure_cmake.sh --generator=Xcode --prefix=$my_path</code></pre>\r
+<pre><code>export CXX=g++</code></pre>\r
</div></div>\r
</li>\r
<li>\r
<p>\r
-Or use ccmake directly to configure and generate from an arbitrary build\r
- directory like one of these:\r
+If you build with hyperscan on OS X and see:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>ccmake -G Xcode /path/to/Snort++/tree\r
-open snort.xcodeproj</code></pre>\r
+<pre><code>dyld: Library not loaded: @rpath/libhs.4.0.dylib</code></pre>\r
</div></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>ccmake -G "Eclipse CDT4 - Unix Makefiles" /path/to/Snort++/tree\r
-run eclipse and do File > Import > Existing Eclipse Project</code></pre>\r
+<pre><code>when you try to run src/snort, export DYLD_LIBRARY_PATH with the path to\r
+libhs. You can also do:</code></pre>\r
</div></div>\r
-</li>\r
-</ol></div>\r
-</li>\r
-<li>\r
-<p>\r
-To build with g++ on OS X where clang is installed, do this first:\r
-</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>export CXX=g++</code></pre>\r
+<pre><code>install_name_tool -change @rpath/libhs.4.0.dylib \\r
+ /path-to/libhs.4.0.dylib src/snort</code></pre>\r
</div></div>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_running">Running</h3>\r
-<div class="paragraph"><p>First set up the environment:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;\r
-export SNORT_LUA_PATH=$my_path/etc/snort/</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Then give it a go:</p></div>\r
+<h3 id="_bugs">Bugs</h3>\r
+<div class="sect3">\r
+<h4 id="_build">Build</h4>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Get some help:\r
+With cmake, make install will rebuild the docs even though when already\r
+ built.\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$my_path/bin/snort --help\r
-$my_path/bin/snort --help-module suppress\r
-$my_path/bin/snort --help-config | grep thread</code></pre>\r
-</div></div>\r
</li>\r
<li>\r
<p>\r
-Examine and dump a pcap:\r
+Enabling large pcap may erroneously affect the number of packets processed\r
+ from pcaps.\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$my_path/bin/snort -r <pcap>\r
-$my_path/bin/snort -L dump -d -e -q -r <pcap></code></pre>\r
-</div></div>\r
</li>\r
<li>\r
<p>\r
-Verify config, with or w/o rules:\r
+Enabling debug messages may erroneously affect the number of packets\r
+ processed from pcaps.\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua\r
-$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules</code></pre>\r
-</div></div>\r
</li>\r
<li>\r
<p>\r
-Run IDS mode. To keep it brief, look at the first n packets in each file:\r
+g++ 4.9.2 with -O3 reports:\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \\r
- -r <pcap> -A alert_test -n 100000</code></pre>\r
+<pre><code>src/service_inspectors/back_orifice/back_orifice.cc:231:25: warning:\r
+iteration 930u invokes undefined behavior [-Waggressive-loop-optimizations]</code></pre>\r
</div></div>\r
</li>\r
<li>\r
<p>\r
-Let’s suppress 1:2123. We could edit the conf or just do this:\r
+Building with clang and autotools on Linux will show the following\r
+ warning many times. Please ignore.\r
</p>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \\r
- -r <pcap> -A alert_test -n 100000 --lua "suppress = { { gid = 1, sid = 2123 } }"</code></pre>\r
+<pre><code>clang: warning: argument unused during compilation: '-pthread'</code></pre>\r
</div></div>\r
</li>\r
<li>\r
<p>\r
-Go whole hog on a directory with multiple packet threads:\r
+It is not possible to build dynamic plugins using apple clang due to its\r
+ limited support for thread local variables.\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>$my_path/bin/snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules \\r
- --pcap-filter \*.pcap --pcap-dir <dir> -A alert_fast -n 1000 --max-packet-threads 8</code></pre>\r
-</div></div>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>For more examples, see the usage section.</p></div>\r
</div>\r
-<div class="sect2">\r
-<h3 id="_tips">Tips</h3>\r
-<div class="paragraph"><p>One of the goals of Snort 3 is to make it easier to configure your sensor.\r
-Here is a summary of tips and tricks you may find useful.</p></div>\r
-<div class="paragraph"><p>General Use</p></div>\r
+<div class="sect3">\r
+<h4 id="_config">Config</h4>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Snort tries hard not to error out too quickly. It will report multiple\r
- semantic errors.\r
+Parsing issue with IP lists. can’t parse rules with $EXTERNAL_NET\r
+ defined as below because of the space between ! and 10.\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>HOME_NET = [[ 10.0.17.0/24 10.0.14.0/24 10.247.0.0/16 10.246.0.0/16 ]]\r
+EXTERNAL_NET = '! ' .. HOME_NET</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Snort always assumes the simplest mode of operation. Eg, you can omit the -T\r
- option to validate the conf if you don’t provide a packet source.\r
+Multiple versions of luajit scripts are not handled correctly. The\r
+ first loaded version will always be executed even though plugin manager\r
+ saves the correct version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Warnings are not emitted unless --warn-* is specified. --warn-all enables all\r
- warnings, and --pedantic makes such warnings fatal.\r
+When using -c and -L together, the last on the command line wins (-c -L\r
+ will dump; -L -c will analyze).\r
</p>\r
</li>\r
<li>\r
<p>\r
-You can process multiple sources at one time by using the -z or --max-threads\r
- option.\r
+Modules instantiated by command line only will not get default settings\r
+ unless hard-coded. This notably applies to -A and -L options.\r
</p>\r
</li>\r
<li>\r
<p>\r
-To make it easy to find the important data, zero counts are not output at\r
- shutdown.\r
+--lua can only be used in addition to, not in place of, a -c config.\r
+ Ideally, --lua could be used in lieu of -c.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_rules">Rules</h4>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-Load plugins from the command line with --plugin-path /path/to/install/lib.\r
+metdata:service foo; metadata:service foo; won’t cause a duplicate service\r
+ warning as does metadata:service foo, service foo;\r
</p>\r
</li>\r
<li>\r
<p>\r
-You can process multiple sources at one time by using the -z or\r
- --max-threads option.\r
+ip_proto doesn’t work properly with reassembled packets so it can’t be\r
+ used to restrict the protocol of service rules.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Unit tests are configured with --enable-unit-tests. They can then be run\r
- with snort --catch-test [tags]|all.\r
+Inspector events generated while parsing TCP payload in non-IPS mode will\r
+ indicate the wrong direction (ie they will be based on the ACK packet).\r
+ (Same is true for Snort.)\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>Lua Configuration</p></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_snort2lua">snort2lua</h4>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Configure the wizard and default bindings will be created based on configured\r
- inspectors. No need to explicitly bind ports in this case.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-You can override or add to your Lua conf with the --lua command line option.\r
+uricontent:"foo"; content:"bar"; → http_uri; content:"foo"; content:"bar";\r
+ (missing pkt_data)\r
</p>\r
</li>\r
<li>\r
<p>\r
-The Lua conf is a live script that is executed when loaded. You can add\r
- functions, grab environment variables, compute values, etc.\r
+stream_tcp ports and protocols both go into a single binder.when; this is\r
+ incorrect as the when fields are logically anded together (ie must all be\r
+ true). Should create 2 separate bindings.\r
</p>\r
</li>\r
<li>\r
<p>\r
-You can also rename symbols that you want to disable. For example,\r
- changing normalizer to Xnormalizer (an unknown symbol) will disable the\r
- normalizer. This can be easier than commenting in some cases.\r
+There is a bug in pps_stream_tcp.cc.. when stream_tcp: is specified\r
+ without any arguments, snort2lua doesn’t convert it. Same for\r
+ stream_udp.\r
</p>\r
</li>\r
<li>\r
<p>\r
-By default, symbols unknown to Snort are silently ignored. You can\r
- generate warnings for them with --warn-unknown. To ignore such symbols,\r
- export them in the environment variable SNORT_IGNORE.\r
+Loses the ip list delimiters [ ]; change to ( )\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>in snort.conf: var HOME_NET [A,B,C]\r
+in snort.lua: HOME_NET = [[A B C]]</code></pre>\r
+</div></div>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Writing and Loading Rules</p></div>\r
-<div class="paragraph"><p>Snort rules allow arbitrary whitespace. Multi-line rules make it easier to\r
-structure your rule for clarity. There are multiple ways to add comments to\r
-your rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-The # character starts a comment to end of line. In addition, all lines\r
- between #begin and #end are comments.\r
+Won’t convert packet rules (alert tcp etc.) to service rules (alert http\r
+ etc.).\r
</p>\r
</li>\r
<li>\r
<p>\r
-The rem option allows you to write a comment that is conveyed with the rule.\r
+alert_fast and alert_full: output configuration includes "file =\r
+ <em>foo.bar</em>", but file is a bool and you cannot specify an output file name\r
+ in the configuration.\r
</p>\r
</li>\r
<li>\r
<p>\r
-C style multi-line comments are allowed, which means you can comment out\r
- portions of a rule while testing it out by putting the options between /* and\r
- */.\r
+preprocessor ports option: ports <number> not supported.\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>There are multiple ways to load rules too:</p></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_runtime">Runtime</h4>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Set ips.rules or ips.include.\r
+-B <mask> feature does not work. It does ordinary IP address obfuscation\r
+ instead of using the mask.\r
</p>\r
</li>\r
<li>\r
<p>\r
-include statements can be used in rules files.\r
+Obfuscation does not work for csv format.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use -R to load a rules file.\r
+The hext DAQ will append a newline to text lines (starting with <em>"</em>).\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use --stdin-rules with command line redirection.\r
+The hext DAQ does not support embedded quotes in text lines (use hex\r
+ lines as a workaround).\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use --lua to specify one or more rules as a command line argument.\r
+stream_tcp alert squash mechanism incorrectly squashes alerts for\r
+ different TCP packets.\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Output Files</p></div>\r
-<div class="paragraph"><p>To make it simple to configure outputs when you run with multiple packet\r
-threads, output files are not explicitly configured. Instead, you can use the\r
-options below to format the paths:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code><logdir>/[<run_prefix>][<id#>][<X>]<name></code></pre>\r
-</div></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-logdir is set with -l and defaults to ./\r
+stream_tcp gap count is broken.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_basic_modules">Basic Modules</h2>\r
+<div class="sectionbody">\r
+<div class="paragraph"><p>Internal modules which are not plugins are termed "basic". These include\r
+configuration for core processing.</p></div>\r
+<div class="sect2">\r
+<h3 id="_active">active</h3>\r
+<div class="paragraph"><p>What: configure responses</p></div>\r
+<div class="paragraph"><p>Type: basic</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-run_prefix is set with --run-prefix else not used\r
+int <strong>active.attempts</strong> = 0: number of TCP packets sent per response (with varying sequence numbers) { 0:20 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-id# is the packet thread number that writes the file; with one packet thread,\r
- id# (zero) is omitted without --id-zero\r
+string <strong>active.device</strong>: use <em>ip</em> for network layer responses or <em>eth0</em> etc for link layer\r
</p>\r
</li>\r
<li>\r
<p>\r
-X is / if you use --id-subdir, else _ if id# is used\r
+string <strong>active.dst_mac</strong>: use format <em>01:23:45:67:89:ab</em>\r
</p>\r
</li>\r
<li>\r
<p>\r
-name is based on module name that writes the file\r
+int <strong>active.max_responses</strong> = 0: maximum number of responses { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-all text mode outputs default to stdout\r
+int <strong>active.min_interval</strong> = 255: minimum number of seconds between responses { 1: }\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_help">Help</h3>\r
-<div class="listingblock">\r
-<div class="content">\r
-<pre><code>Snort has several options to get more help:\r
-\r
--? list command line options (same as --help)\r
---help this overview of help\r
---help-commands [<module prefix>] output matching commands\r
---help-config [<module prefix>] output matching config options\r
---help-counts [<module prefix>] output matching peg counts\r
---help-module <module> output description of given module\r
---help-modules list all available modules with brief help\r
---help-plugins list all available plugins with brief help\r
---help-options [<option prefix>] output matching command line options\r
---help-signals dump available control signals\r
---list-buffers output available inspection buffers\r
---list-builtin [<module prefix>] output matching builtin rules\r
---list-gids [<module prefix>] output matching generators\r
---list-modules [<module type>] list all known modules\r
---list-plugins list all known modules\r
---show-plugins list module and plugin versions\r
-\r
---help* and --list* options preempt other processing so should be last on the\r
-command line since any following options are ignored. To ensure options like\r
---markup and --plugin-path take effect, place them ahead of the help or list\r
-options.\r
-\r
-Options that filter output based on a matching prefix, such as --help-config\r
-won't output anything if there is no match. If no prefix is given, everything\r
-matches.\r
-\r
-Report bugs to bugs@snort.org.</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_common_errors">Common Errors</h3>\r
-<div class="paragraph"><p><em>FATAL: snort_config is required</em></p></div>\r
+<h3 id="_alerts">alerts</h3>\r
+<div class="paragraph"><p>What: configure alerts</p></div>\r
+<div class="paragraph"><p>Type: basic</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-add this line near top of file:\r
+bool <strong>alerts.alert_with_interface_name</strong> = false: include interface in alert info (fast, full, or syslog only)\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>require('snort_config')</code></pre>\r
-</div></div>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>PANIC: unprotected error in call to Lua API (cannot open\r
-snort_defaults.lua: No such file or directory)</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-export SNORT_LUA_PATH to point to any dofiles\r
+bool <strong>alerts.default_rule_state</strong> = true: enable or disable ips rules\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>ERROR can’t find xyz</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-if xyz is the name of a module, make sure you are not assigning a scalar\r
- where a table is required (e.g. xyz = 2 should be xyz = { }).\r
+int <strong>alerts.detection_filter_memcap</strong> = 1048576: set available memory for filters { 0: }\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>ERROR can’t find x.y</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-module x does not have a parameter named y. check --help-module x for\r
- available parameters.\r
+int <strong>alerts.event_filter_memcap</strong> = 1048576: set available memory for filters { 0: }\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>ERROR invalid x.y = z</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-the value z is out of range for x.y. check --help-config x.y for the range\r
- allowed.\r
+string <strong>alerts.order</strong> = pass drop alert log: change the order of rule action application\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>ERROR: x = { y = z } is in conf but is not being applied</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-make sure that x = { } isn’t set later because it will override the\r
- earlier setting. same for x.y.\r
+int <strong>alerts.rate_filter_memcap</strong> = 1048576: set available memory for filters { 0: }\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>FATAL: can’t load lua/errors.lua: lua/errors.lua:68: <em>=</em> expected near\r
-';'</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-this is a syntax error reported by Lua to Snort on line 68 of errors.lua.\r
+string <strong>alerts.reference_net</strong>: set the CIDR for homenet (for use with -l or -B, does NOT change $HOME_NET in IDS mode)\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>ERROR: rules(2) unknown rule keyword: find.</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-this was due to not including the --script-path.\r
+bool <strong>alerts.stateful</strong> = false: don’t alert w/o established session (note: rule action still taken)\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p><em>WARNING: unknown symbol x</em></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-if you any variables, you can squelch such warnings by setting them in\r
- an environment variable SNORT_IGNORE. to ignore x, y, and z:\r
+string <strong>alerts.tunnel_verdicts</strong>: let DAQ handle non-allow verdicts for GTP|Teredo|6in4|4in6 traffic\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>export SNORT_IGNORE="x y z"</code></pre>\r
-</div></div>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_gotchas">Gotchas</h3>\r
+<h3 id="_attribute_table">attribute_table</h3>\r
+<div class="paragraph"><p>What: configure hosts loading</p></div>\r
+<div class="paragraph"><p>Type: basic</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-A nil key in a table will not caught. Neither will a nil value in a\r
- table. Neither of the following will cause errors, nor will they\r
- actually set http_server.post_depth:\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>http_server = { post_depth }\r
-http_server = { post_depth = undefined_symbol }</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-It is not an error to set a value multiple times. The actual value\r
- applied may not be the last in the table either. It is best to avoid\r
- such cases.\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>http_server =\r
-{\r
- post_depth = 1234,\r
- post_depth = 4321\r
-}</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Snort can’t tell you the exact filename or line number of a semantic\r
- error but it will tell you the fully qualified name.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-The dump DAQ will not work with multiple threads unless you use --daq-var\r
- file=/dev/null. This will be fixed in at some point to use the Snort log\r
- directory, etc.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Variables are currently processed in an order determined by the Lua hash\r
- table which is effectively random. That means you will need to use Lua\r
- string concatenation to ensure Snort doesn’t try to use a variable before\r
- it is defined (even when it is defined ahead of use in the file):\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>-- this may fail:\r
-MY_SERVERS = [[ 172.20.0.0/16 172.21.0.0/16 ]]\r
-EXTERNAL_NET = '!$MY_SERVERS'</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>-- this will work:\r
-MY_SERVERS = [[ 172.20.0.0/16 172.21.0.0/16 ]]\r
-EXTERNAL_NET = '!' .. MY_SERVERS</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-configure will use clang<code> by default if it is installed. To compile\r
- with g</code> instead:\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>export CXX=g++</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-If you build with hyperscan on OS X and see:\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dyld: Library not loaded: @rpath/libhs.4.0.dylib</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>when you try to run src/snort, export DYLD_LIBRARY_PATH with the path to\r
-libhs. You can also do:</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>install_name_tool -change @rpath/libhs.4.0.dylib \\r
- /path-to/libhs.4.0.dylib src/snort</code></pre>\r
-</div></div>\r
-</li>\r
-</ul></div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_usage">Usage</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>For the following examples "$my_path" is assumed to be the path to the\r
-Snort install directory. Additionally, it is assumed that "$my_path/bin"\r
-is in your PATH.</p></div>\r
-<div class="sect2">\r
-<h3 id="_environment_2">Environment</h3>\r
-<div class="paragraph"><p>LUA_PATH is used directly by Lua to load and run required libraries.\r
-SNORT_LUA_PATH is used by Snort to load supplemental configuration files.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;\r
-export SNORT_LUA_PATH=$my_path/etc/snort</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_help_2">Help</h3>\r
-<div class="paragraph"><p>Print the help summary:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --help</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Get help on a specific module ("stream", for example):</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --help-module stream</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Get help on the "-A" command line option:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --help-options A</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Grep for help on threads:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --help-config | grep thread</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Output help on "rule" options in AsciiDoc format:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --markup --help-options rule</code></pre>\r
-</div></div>\r
-<div class="admonitionblock">\r
-<table><tr>\r
-<td class="icon">\r
-<img src="./images/icons/note.png" alt="Note" />\r
-</td>\r
-<td class="content">Snort stops reading command-line options after the "--help-<strong>" and\r
-"--list-</strong>" options, so any other options should be placed before them.</td>\r
-</tr></table>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_sniffing_and_logging">Sniffing and Logging</h3>\r
-<div class="paragraph"><p>Read a pcap:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -r /path/to/my.pcap</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Dump the packets to stdout:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -r /path/to/my.pcap -L dump</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Dump packets with application data and layer 2 headers</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -r /path/to/my.pcap -L dump -d -e</code></pre>\r
-</div></div>\r
-<div class="admonitionblock">\r
-<table><tr>\r
-<td class="icon">\r
-<img src="./images/icons/note.png" alt="Note" />\r
-</td>\r
-<td class="content">Command line options must be specified separately. "snort -de" won’t\r
-work. You can still concatenate options and their arguments, however, so\r
-"snort -Ldump" will work.</td>\r
-</tr></table>\r
-</div>\r
-<div class="paragraph"><p>Dump packets from all pcaps in a directory:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -d -e</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Log packets to a directory:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -l /path/to/log/dir</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_configuration_2">Configuration</h3>\r
-<div class="paragraph"><p>Validate a configuration file:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Validate a configuration file and a separate rules file:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Read rules from stdin and validate:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Enable warnings for Lua configurations and make warnings fatal:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Tell Snort where to look for additional Lua scripts:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --script-path /path/to/script/dir</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_ids_mode">IDS mode</h3>\r
-<div class="paragraph"><p>Run Snort in IDS mode, reading packets from a pcap:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Log any generated alerts to the console using the "-A" option:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Add or modify a configuration from the command line using the "--lua" option:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \\r
- --lua 'ips = { enable_builtin_rules = true }'</code></pre>\r
-</div></div>\r
-<div class="admonitionblock">\r
-<table><tr>\r
-<td class="icon">\r
-<img src="./images/icons/note.png" alt="Note" />\r
-</td>\r
-<td class="content">The "--lua" option can be specified multiple times.</td>\r
-</tr></table>\r
-</div>\r
-<div class="paragraph"><p>Run Snort in IDS mode on an entire directory of pcaps, processing each\r
-input source on a separate thread:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
- --pcap-filter '*.pcap' --max-packet-threads 8</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Run Snort on 2 interfaces, eth0 and eth1:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -i "eth0 eth1" -z 2 -A cmg</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Run Snort inline with the afpacket DAQ:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua --daq afpacket -i "eth0:eth1" \\r
- -A cmg</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_plugins_2">Plugins</h3>\r
-<div class="paragraph"><p>Load external plugins and use the "ex" alert:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --plugin-path $my_path/lib/snort_extra \\r
- -A alert_ex -r /path/to/my.pcap</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Test the LuaJIT rule option <em>find</em> loaded from stdin:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --script-path $my_path/lib/snort_extra \\r
- --stdin-rules -A cmg -r /path/to/my.pcap << END\r
-alert tcp any any -> any 80 (\r
- sid:3; msg:"found"; content:"GET";\r
- find:"pat='HTTP/1%.%d'" ; )\r
-END</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_output_files">Output Files</h3>\r
-<div class="paragraph"><p>To make it simple to configure outputs when you run with multiple packet\r
-threads, output files are not explicitly configured. Instead, you can use\r
-the options below to format the paths:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code><logdir>/[<run_prefix>][<id#>][<X>]<name></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Log to unified in the current directory:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Log to unified in the current directory with a different prefix:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \\r
- --run-prefix take2</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Log to unified in /tmp:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Run 4 packet threads and log with thread number prefix (0-3):</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
- --pcap-filter '*.pcap' -z 4 -A unified2</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Run 4 packet threads and log in thread number subdirs (0-3):</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
- --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir</code></pre>\r
-</div></div>\r
-<div class="admonitionblock">\r
-<table><tr>\r
-<td class="icon">\r
-<img src="./images/icons/note.png" alt="Note" />\r
-</td>\r
-<td class="content">subdirectories are created automatically if required. Log filename\r
-is based on module name that writes the file. All text mode outputs\r
-default to stdout. These options can be combined.</td>\r
-</tr></table>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_daq_alternatives">DAQ Alternatives</h3>\r
-<div class="paragraph"><p>Process hext packets from stdin:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --daq-dir $my_path/lib/snort/daqs --daq hext -i tty << END\r
-$packet 10.1.2.3 48620 -> 10.9.8.7 80\r
-"GET / HTTP/1.1\r\n"\r
-"Host: localhost\r\n"\r
-"\r\n"\r
-END</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Process raw ethernet from hext file:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --daq-dir $my_path/lib/snort/daqs --daq hext \\r
- --daq-var dlt=1 -r <hext-file></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Process a directory of plain files (ie non-pcap) with 4 threads with 8K\r
-buffers:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --daq-dir $my_path/lib/snort/daqs --daq file \\r
- --pcap-dir path/to/files -z 4 -s 8192</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Bridge two TCP connections on port 8000 and inspect the traffic:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --daq-dir $my_path/lib/snort/daqs --daq socket</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_logger_alternatives">Logger Alternatives</h3>\r
-<div class="paragraph"><p>Dump TCP stream payload in hext mode:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -L hext</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Output timestamp, pkt_num, proto, pkt_gen, dgm_len, dir, src_ap, dst_ap,\r
-rule, action for each alert:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua -A csv</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Output the old test format alerts:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
- --lua "alert_csv = { fields = 'pkt_num gid sid rev', separator = '\t' }"</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_shell">Shell</h3>\r
-<div class="paragraph"><p>You must build with --enable-shell to make the command line shell available.</p></div>\r
-<div class="paragraph"><p>Enable shell mode:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --shell <args></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>You will see the shell mode command prompt, which looks like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>o")~</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>(The prompt can be changed with the SNORT_PROMPT environment variable.)</p></div>\r
-<div class="paragraph"><p>You can pause immediately after loading the configuration and again before\r
-exiting with:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --shell --pause <args></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>In that case you must issue the resume() command to continue. Enter quit()\r
-to terminate Snort or detach() to exit the shell. You can list the\r
-available commands with help().</p></div>\r
-<div class="paragraph"><p>To enable local telnet access on port 12345:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --shell -j 12345 <args></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The command line interface is still under development. Suggestions are\r
-welcome.</p></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_signals">Signals</h3>\r
-<div class="admonitionblock">\r
-<table><tr>\r
-<td class="icon">\r
-<img src="./images/icons/note.png" alt="Note" />\r
-</td>\r
-<td class="content">The following examples assume that Snort is currently running and has\r
-a process ID of <pid>.</td>\r
-</tr></table>\r
-</div>\r
-<div class="paragraph"><p>Modify and Reload Configuration:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua\r
-kill -hup <pid></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Dump stats to stdout:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>kill -usr1 <pid></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Shutdown normally:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>kill -term <pid></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Exit without flushing packets:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>kill -quit <pid></code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>List available signals:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>snort --help-signals</code></pre>\r
-</div></div>\r
-<div class="admonitionblock">\r
-<table><tr>\r
-<td class="icon">\r
-<img src="./images/icons/note.png" alt="Note" />\r
-</td>\r
-<td class="content">The available signals may vary from platform to platform.</td>\r
-</tr></table>\r
-</div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_features">Features</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>This section explains how to use key features of Snort.</p></div>\r
-<div class="sect2">\r
-<h3 id="_appid">AppId</h3>\r
-<div class="paragraph"><p>Network administrators need application awareness in order to fine tune\r
-their management of the ever-growing number of applications passing traffic\r
-over the network. Application awareness allows an administrator to create\r
-rules for applications as needed by the business. The rules can be used to\r
-take action based on the application, such as block, allow or alert.</p></div>\r
-<div class="sect3">\r
-<h4 id="_overview_2">Overview</h4>\r
-<div class="paragraph"><p>The AppId inspector provides an application level view when managing\r
-networks by providing the following features:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Network control: The inspector works with Snort rules by providing a set of\r
- application identifiers (AppIds) to Snort rule writers.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Application usage awareness: The inspector outputs statistics to show\r
- how many times applications are being used on the network.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Custom applications: Administrators can create their own application\r
- detectors to detect new applications. The detectors are written in Lua\r
- and interface with Snort using a well-defined C-Lua API.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Open Detector Package (ODP): A set of pre-defined application detectors are\r
- provided by the Snort team and can be downloaded from snort.org.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_dependency_requirements">Dependency Requirements</h4>\r
-<div class="paragraph"><p>For proper functioning of the AppId inspector, at a minimum stream flow\r
-tracking must be enabled. In addition, to identify TCP-based or UDP-based\r
-applications then the appropriate stream inspector must be enabled, e.g.\r
-stream_tcp or stream_udp.</p></div>\r
-<div class="paragraph"><p>In addition, in order to identify HTTP-based applications, the HTTP\r
-inspector must be enabled. Otherwise, only non-HTTP applications will be\r
-identified.</p></div>\r
-<div class="paragraph"><p>AppId subscribes to the inspection events published by other inspectors,\r
-such as the HTTP and SSL inspectors, to gain access to the data needed. It\r
-uses that data to help determine the application ID.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_configuration_3">Configuration</h4>\r
-<div class="paragraph"><p>The AppId feature can be enabled via configuration. To enable it with the\r
-default settings use:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>appid = { }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>To use an AppId as a matching parameter in an IPS rule, use the <em>appids</em>\r
-keyword. For example, to block HTTP traffic that contains a specific header:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>block tcp any any -> 192.168.0.1 any ( msg:"Block Malicious HTTP header";\r
- appids:"HTTP"; content:"X-Header: malicious"; sid:18000; )</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Alternatively, the HTTP application can be specified in place of <em>tcp</em> instead\r
-of using the <em>appids</em> keyword. The AppId inspector will set the service when\r
-it is discovered so it can be used in IPS rules like this. Note that this rule\r
-also does not specify the IPs or ports which default to <em>any</em>.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>block http ( msg:"Block Malicious HTTP header";\r
- content:"X-Header: malicious"; sid:18000; )</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>It’s possible to specify multiple applications (as many as desired) with\r
-the appids keyword. A rule is considered a match if any of the applications\r
-on the rule match. Note that this rule does not match specific content which\r
-will reduce performance.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>alert tcp any any -> 192.168.0.1 any ( msg:"Alert ";\r
- appids:"telnet,ssh,smtp,http";</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Below is a minimal Snort configuration that is sufficient to block flows\r
-based on a specific HTTP header:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>require("snort_config")</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dir = os.getenv('SNORT_LUA_PATH')</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>if ( not dir ) then\r
- dir = '.'\r
-end</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dofile(dir .. '/snort_defaults.lua')</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>local_rules =\r
-[[\r
-block http ( msg:"openAppId: test content match for app http";\r
-content:"X-Header: malicious"; sid:18760; rev:4; )\r
-]]</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>stream = { }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>stream_tcp = { }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>binder =\r
-{\r
- {\r
- when =\r
- {\r
- proto = 'tcp',\r
- ports = [[ 80 8080 ]],\r
- },\r
- use =\r
- {\r
- type = 'http_inspect',\r
- },\r
- },\r
-}</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>http_inspect = { }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>appid = { }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>ips =\r
-{\r
- rules = local_rules,\r
-}</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_session_application_identifiers">Session Application Identifiers</h4>\r
-<div class="paragraph"><p>There are up to four AppIds stored in a session as defined below:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-serviceAppId - An appId associated with server side of a session. Example:\r
- http server.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-clientAppId - An appId associated with application on client side of a\r
- session. Example: Firefox.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-payloadAppId - For services like http this appId is associated with a\r
- webserver host. Example: Facebook.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-miscAppId - For some encapsulated protocols, this is the highest\r
- encapsulated application.\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>For packets originating from the client, a payloadAppid in a session is\r
-matched with all AppIds listed on a rule. Thereafter miscAppId, clientAppId\r
-and serviceAppId are matched. Since Alert Events contain one AppId, only the\r
-first match is reported. If a rule without an appids option matches, then the\r
-most specific appId (in order of payload, misc, client, server) is reported.</p></div>\r
-<div class="paragraph"><p>The same logic is followed for packets originating from the server with one\r
-exception. The order of matching is changed to make serviceAppId come\r
-before clientAppId.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_appid_usage_statistics">AppId Usage Statistics</h4>\r
-<div class="paragraph"><p>The AppId inspector prints application network usage periodically in the snort\r
-log directory in unified2 format. File name, time interval for statistic and\r
-file rollover are controlled by appId inspection configuration.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_open_detector_package_odp_installation">Open Detector Package (ODP) Installation</h4>\r
-<div class="paragraph"><p>Application detectors from Snort team will be delivered in a separate package\r
-called the Open Detector Package (ODP) that can be downloaded from snort.org.\r
-ODP is a package that contains the following artifacts:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Application detectors in the Lua language.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Port detectors, which are port only application detectors, in meta-data in\r
- YAML format.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-appMapping.data file containing application metadata. This file should not\r
- be modified. The first column contains application identifier and second\r
- column contains application name. Other columns contain internal\r
- information.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Lua library files DetectorCommon.lua, flowTrackerModule.lua and\r
- hostServiceTrackerModule.lua\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>A user can install the ODP package in any directory and configure this\r
-directory via the app_detector_dir option in the appid preprocessor\r
-configuration. Installing ODP will not modify any subdirectory named\r
-custom, where user-created detectors are located.</p></div>\r
-<div class="paragraph"><p>When installed, ODP will create following sub-directories:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-odp/port //Cisco port-only detectors\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-odp/lua //Cisco Lua detectors\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-odp/libs //Cisco Lua modules\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_user_created_application_detectors">User Created Application Detectors</h4>\r
-<div class="paragraph"><p>Users can detect new applications by adding detectors in the Lua language. A\r
-document will be posted on the Snort Website with details on API. Users can also\r
-copy over Snort team provided detectors and modify them. Users can also use the\r
-detector creation tool described in the next section.</p></div>\r
-<div class="paragraph"><p>Users must organize their Lua detectors and libraries by creating the\r
-following directory structure, under the ODP installation directory.</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-custom/port //port-only detectors\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-custom/lua //Lua detectors\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-custom/libs //Lua modules\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>The root path is specified by the "app_detector_dir" parameter of the appid\r
-section of snort.conf:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>appid =\r
-{\r
- app_detector_dir = '/usr/local/lib/openappid',\r
-}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>So the path to the user-created lua files would be\r
-/usr/local/lib/openappid/custom/lua/</p></div>\r
-<div class="paragraph"><p>None of the directories below /usr/local/lib/openappid/ would be added for\r
-you.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_application_detector_creation_tool">Application Detector Creation Tool</h4>\r
-<div class="paragraph"><p>For rudimentary Lua detectors, there is a tool provided called\r
-appid_detector_builder.sh. This is a simple, menu-driven bash script\r
-which creates .lua files in your current directory, based on your choices\r
-and on patterns you supply.</p></div>\r
-<div class="paragraph"><p>When you launch the script, it will prompt for the Application Id\r
-that you are giving for your detector. This is free-form ASCII with\r
-minor restrictions. The Lua detector file will be named based on your\r
-Application Id. If the file name already exists you will be prompted to\r
-overwrite it.</p></div>\r
-<div class="paragraph"><p>You will also be prompted for a description of your detector to be placed\r
-in the comments of the Lua source code. This is optional.</p></div>\r
-<div class="paragraph"><p>You will then be asked a series of questions designed to construct Lua\r
-code based on the kind of pattern data, protocol, port(s), etc.</p></div>\r
-<div class="paragraph"><p>When complete, the Protocol menu will be changed to include the option,\r
-"Save Detector". Instead of saving the file and exiting the script,\r
-you are allowed to give additional criteria for another pattern which\r
-may also be incorporated in the detection scheme. Then either pattern,\r
-when matched, will be considered a valid detection.</p></div>\r
-<div class="paragraph"><p>For example, your first choices might create an HTTP detection pattern\r
-of "example.com", and the next set of choices would add the HTTP\r
-detection pattern of "example.uk.co" (an equally fictional British\r
-counterpart). They would then co-exist in the Lua detector, and either\r
-would cause a detection with the name you give for your Application Id.</p></div>\r
-<div class="paragraph"><p>The resulting .lua file will need to be placed in the directory,\r
-"custom/lua", described in the previous section of the README above called\r
-"User Created Application Detectors"</p></div>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_binder">Binder</h3>\r
-<div class="paragraph"><p>One of the fundamental differences between Snort 2 and Snort 3 concerns configuration\r
-related to networks and ports. Here is a brief review of Snort 2 configuration for\r
-network and service related components:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Snort’s configuration has a default policy and optional policies selected by\r
- VLAN or network (with config binding).\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Each policy contains a user defined set of preprocessor configurations.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Each preprocessor has a default configuration and some support non-default\r
- configurations selected by network.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Most preprocessors have port configurations.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-The default policy may also contain a list of ports to ignore.\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>In Snort 3, the above configurations are done in a single module called the\r
-binder. Here is an example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>binder =\r
-{\r
- -- allow all tcp port 22:\r
- -- (similar to Snort 2 config ignore_ports)\r
- { when = { proto = 'tcp', ports = '22' }, use = { action = 'allow' } },</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>-- select a config file by vlan\r
--- (similar to Snort 2 config binding by vlan)\r
-{ when = { vlans = '1024' }, use = { file = 'vlan.lua' } },</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>-- use a non-default HTTP inspector for port 8080:\r
--- (similar to a Snort 2 targeted preprocessor config)\r
-{ when = { nets = '192.168.0.0/16', proto = 'tcp', ports = '8080' },\r
- use = { name = 'alt_http', type = 'http_inspect' } },</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>-- use the default inspectors:\r
--- (similar to a Snort 2 default preprocessor config)\r
-{ when = { proto = 'tcp' }, use = { type = 'stream_tcp' } },\r
-{ when = { service = 'http' }, use = { type = 'http_inspect' } },</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code> -- figure out which inspector to run automatically:\r
- { use = { type = 'wizard' } }\r
-}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Bindings are evaluated when a session starts and again if and when service is\r
-identified on the session. Essentially, the bindings are a list of when-use\r
-rules evaluated from top to bottom. The first matching network and service\r
-configurations are applied. binder.when can contain any combination of\r
-criteria and binder.use can specify an action, config file, or inspector\r
-configuration.</p></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_dce_inspectors">DCE Inspectors</h3>\r
-<div class="paragraph"><p>The main purpose of these inspector are to perform SMB desegmentation and\r
-DCE/RPC defragmentation to avoid rule evasion using these techniques.</p></div>\r
-<div class="sect3">\r
-<h4 id="_overview_3">Overview</h4>\r
-<div class="paragraph"><p>The following transports are supported for DCE/RPC: SMB, TCP, and UDP.\r
-New rule options have been implemented to improve performance, reduce false\r
-positives and reduce the count and complexity of DCE/RPC based rules.</p></div>\r
-<div class="paragraph"><p>Different from Snort 2, the DCE-RPC preprocessor is split into three inspectors\r
- - one for each transport: dce_smb, dce_tcp, dce_udp. This includes the\r
-configuration as well as the inspector modules. The Snort 2 server configuration\r
-is now split between the inspectors. Options that are meaningful to all\r
-inspectors, such as policy and defragmentation, are copied into each inspector\r
-configuration. The address/port mapping is handled by the binder. Autodetect\r
-functionality is replaced by wizard curses.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_quick_guide">Quick Guide</h4>\r
-<div class="paragraph"><p>A typical dcerpce configuration looks like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>binder =\r
-{\r
- {\r
- when =\r
- {\r
- proto = 'tcp',\r
- ports = '139 445 1025',\r
- },\r
- use =\r
- {\r
- type = 'dce_smb',\r
- },\r
- },\r
- {\r
- when =\r
- {\r
- proto = 'tcp',\r
- ports = '135 2103',\r
- },\r
- use =\r
- {\r
- type = 'dce_tcp',\r
- },\r
- },\r
- {\r
- when =\r
- {\r
- proto = 'udp',\r
- ports = '1030',\r
- },\r
- use =\r
- {\r
- type = 'dce_udp',\r
- },\r
- }\r
- }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_smb = { }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_tcp = { }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_udp = { }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>In this example, it defines smb, tcp and udp inspectors based on port. All the\r
-configurations are default.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_target_based">Target Based</h4>\r
-<div class="paragraph"><p>There are enough important differences between Windows and Samba versions that\r
-a target based approach has been implemented. Some important differences:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Named pipe instance tracking\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Accepted SMB commands\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-AndX command chaining\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Transaction tracking\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Multiple Bind requests\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-DCE/RPC Fragmented requests - Context ID\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-DCE/RPC Fragmented requests - Operation number\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-DCE/RPC Stub data byte order\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Because of those differences, each inspector can be configured to different\r
-policy. Here are the list of policies supported:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-WinXP (default)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Win2000\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-WinVista\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Win2003\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Win2008\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Win7\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Samba\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Samba-3.0.37\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Samba-3.0.22\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Samba-3.0.20\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_reassembling">Reassembling</h4>\r
-<div class="paragraph"><p>Both SMB inspector and TCP inspector support reassemble. Reassemble threshold\r
-specifies a minimum number of bytes in the DCE/RPC desegmentation and\r
-defragmentation buffers before creating a reassembly packet to send to the\r
-detection engine. This option is useful in inline mode so as to potentially\r
-catch an exploit early before full defragmentation is done. A value of 0 s\r
-supplied as an argument to this option will, in effect, disable this option.\r
-Default is disabled.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_smb">SMB</h4>\r
-<div class="paragraph"><p>SMB inspector is one of the most complex inspectors. In addition to supporting\r
-rule options and lots of inspector rule events, it also supports file\r
-processing for both SMB version 1, 2, and 3.</p></div>\r
-<div class="sect4">\r
-<h5 id="_finger_print_policy">Finger Print Policy</h5>\r
-<div class="paragraph"><p>In the initial phase of an SMB session, the client needs to authenticate with a\r
-SessionSetupAndX. Both the request and response to this command contain OS and\r
-version information that can allow the inspector to dynamically set the policy\r
-for a session which allows for better protection against Windows and Samba\r
-specific evasions.</p></div>\r
-</div>\r
-<div class="sect4">\r
-<h5 id="_file_inspection">File Inspection</h5>\r
-<div class="paragraph"><p>SMB inspector supports file inspection. A typical configuration looks like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>binder =\r
-{\r
- {\r
- when =\r
- {\r
- proto = 'tcp',\r
- ports = '139 445',\r
- },\r
- use =\r
- {\r
- type = 'dce_smb',\r
- },\r
- },\r
-}</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_smb =\r
-{\r
- smb_file_inspection = 'on',\r
- smb_file_depth = 0,\r
- }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>file_id =\r
-{\r
- enable_type = true,\r
- enable_signature = true,\r
- enable_capture = true,\r
- file_rules = magics,\r
-}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>First, define a binder to map tcp port 139 and 445 to smb. Then, enable file\r
-inspection in smb inspection and set the file depth as unlimited. Lastly, enable\r
-file inspector to inspect file type, calculate file signature, and capture file.\r
-The details of file inspector are explained in file processing section.</p></div>\r
-<div class="paragraph"><p>SMB inspector does inspection of normal SMB file transfers. This includes doing\r
-file type and signature through the file processing as well as setting a pointer\r
-for the "file_data" rule option. Note that the "file_depth" option only applies\r
-to the maximum amount of file data for which it will set the pointer for the\r
-"file_data" rule option. For file type and signature it will use the value\r
-configured for the file API. If "only" is specified, the inspector will only\r
-do SMB file inspection, i.e. it will not do any DCE/RPC tracking or inspection.\r
-If "on" is specified with no arguments, the default file depth is 16384 bytes.\r
-An argument of -1 to "file-depth" disables setting the pointer for "file_data",\r
-effectively disabling SMB file inspection in rules. An argument of 0 to\r
-"file_depth" means unlimited. Default is "off", i.e. no SMB file inspection is\r
- done in the inspector.</p></div>\r
-</div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_tcp">TCP</h4>\r
-<div class="paragraph"><p>dce_tcp inspector supports defragementation, reassembling, and policy that is\r
-similar to SMB.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_udp">UDP</h4>\r
-<div class="paragraph"><p>dce_udp is a very simple inspector that only supports defragementation</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_rule_options">Rule Options</h4>\r
-<div class="paragraph"><p>New rule options are supported by enabling the dcerpc2 inspectors:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-dce_iface\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-dce_opnum\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-dce_stub_data\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>New modifiers to existing byte_test and byte_jump rule options:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-byte_test: dce\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-byte_jump: dce\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="sect4">\r
-<h5 id="_dce_iface">dce_iface</h5>\r
-<div class="paragraph"><p>For DCE/RPC based rules it has been necessary to set flow-bits based on a client\r
-bind to a service to avoid false positives. It is necessary for a client to bind\r
-to a service before being able to make a call to it. When a client sends a bind\r
-request to the server, it can, however, specify one or more service interfaces\r
-to bind to. Each interface is represented by a UUID. Each interface UUID is\r
-paired with a unique index (or context id) that future requests can use to\r
-reference the service that the client is making a call to. The server will\r
-respond with the interface UUIDs it accepts as valid and will allow the client\r
-to make requests to those services. When a client makes a request, it will\r
-specify the context id so the server knows what service the client is making a\r
-request to. Instead of using flow-bits, a rule can simply ask the inspector,\r
-using this rule option, whether or not the client has bound to a specific\r
-interface UUID and whether or not this client request is making a request to it.\r
-This can eliminate false positives where more than one service is bound to\r
-successfully since the inspector can correlate the bind UUID to the context\r
-id used in the request. A DCE/RPC request can specify whether numbers are\r
-represented as big endian or little endian. The representation of the interface\r
-UUID is different depending on the endianness specified in the DCE/RPC\r
-previously requiring two rules - one for big endian and one for little endian.\r
-The inspector eliminates the need for two rules by normalizing the UUID.\r
-An interface contains a version. Some versions of an interface may not be\r
-vulnerable to a certain exploit. Also, a DCE/RPC request can be broken up into\r
-1 or more fragments. Flags (and a field in the connectionless header) are set in\r
-the DCE/RPC header to indicate whether the fragment is the first, a middle or\r
-the last fragment. Many checks for data in the DCE/RPC request are only relevant\r
-if the DCE/RPC request is a first fragment (or full request), since subsequent\r
-fragments will contain data deeper into the DCE/RPC request. A rule which is\r
-looking for data, say 5 bytes into the request (maybe it’s a length field), will\r
-be looking at the wrong data on a fragment other than the first, since the\r
-beginning of subsequent fragments are already offset some length from the\r
-beginning of the request. This can be a source of false positives in fragmented\r
-DCE/RPC traffic. By default it is reasonable to only evaluate if the request is\r
-a first fragment (or full request). However, if the "any_frag" option is used to\r
-specify evaluating on all fragments.</p></div>\r
-<div class="paragraph"><p>Examples:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188;\r
-dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188,<2;\r
-dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188,any_frag;\r
-dce_iface: 4b324fc8-1670-01d3-1278-5a47bf6ee188,=1,any_frag;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This option is used to specify an interface UUID. Optional arguments are an\r
-interface version and operator to specify that the version be less than (<em><</em>),\r
-greater than (<em>></em>), equal to (<em>=</em>) or not equal to (<em>!</em>) the version specified.\r
-Also, by default the rule will only be evaluated for a first fragment (or full\r
-request, i.e. not a fragment) since most rules are written to start at the\r
-beginning of a request. The "any_frag" argument says to evaluate for middle and\r
-last fragments as well. This option requires tracking client Bind and\r
-Alter Context requests as well as server Bind Ack and Alter Context responses\r
-for connection-oriented DCE/RPC in the inspector. For each Bind and\r
-Alter Context request, the client specifies a list of interface UUIDs along\r
-with a handle (or context id) for each interface UUID that will be used during\r
-the DCE/RPC session to reference the interface. The server response indicates\r
-which interfaces it will allow the client to make requests to - it either\r
-accepts or rejects the client’s wish to bind to a certain interface. This\r
-tracking is required so that when a request is processed, the context id used\r
-in the request can be correlated with the interface UUID it is a handle for.</p></div>\r
-<div class="paragraph"><p>hexlong and hexshort will be specified and interpreted to be in big endian\r
-order (this is usually the default way an interface UUID will be seen and\r
-represented). As an example, the following Messenger interface UUID as taken\r
-off the wire from a little endian Bind request:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>|f8 91 7b 5a 00 ff d0 11 a9 b2 00 c0 4f b6 e6 fc|</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>must be written as:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The same UUID taken off the wire from a big endian Bind request:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>|5a 7b 91 f8 ff 00 11 d0 a9 b2 00 c0 4f b6 e6 fc|</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>must be written the same way:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>5a7b91f8-ff00-11d0-a9b2-00c04fb6e6fc</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This option matches if the specified interface UUID matches the interface UUID\r
-(as referred to by the context id) of the DCE/RPC request and if supplied, the\r
-version operation is true. This option will not match if the fragment is not a\r
-first fragment (or full request) unless the "any_frag" option is supplied in\r
-which case only the interface UUID and version need match. Note that a\r
-defragmented DCE/RPC request will be considered a full request.</p></div>\r
-<div class="paragraph"><p>Using this rule option will automatically insert fast pattern contents into\r
-the fast pattern matcher. For UDP rules, the interface UUID, in both big and\r
-little endian format will be inserted into the fast pattern matcher. For TCP\r
-rules, (1) if the rule option "flow:to_server|from_client" is used, |05 00 00|\r
-will be inserted into the fast pattern matcher, (2) if the rule option\r
-"flow:from_server|to_client" is used, |05 00 02| will be inserted into the\r
-fast pattern matcher and (3) if the flow isn’t known, |05 00| will be inserted\r
-into the fast pattern matcher. Note that if the rule already has content rule\r
-options in it, the best (meaning longest) pattern will be used. If a content\r
-in the rule uses the fast_pattern rule option, it will unequivocally be used\r
-over the above mentioned patterns.</p></div>\r
-</div>\r
-<div class="sect4">\r
-<h5 id="_dce_opnum">dce_opnum</h5>\r
-<div class="paragraph"><p>The opnum represents a specific function call to an interface. After is has\r
-been determined that a client has bound to a specific interface and is making\r
-a request to it (see above - dce_iface) usually we want to know what function\r
-call it is making to that service. It is likely that an exploit lies in the\r
-particular DCE/RPC function call.</p></div>\r
-<div class="paragraph"><p>Examples:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_opnum: 15;\r
-dce_opnum: 15-18;\r
-dce_opnum: 15,18-20;\r
-dce_opnum: 15,17,20-22;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This option is used to specify an opnum (or operation number), opnum range or\r
-list containing either or both opnum and/or opnum-range. The opnum of a\r
-DCE/RPC request will be matched against the opnums specified with this option.\r
-This option matches if any one of the opnums specified match the opnum of the\r
-DCE/RPC request.</p></div>\r
-</div>\r
-<div class="sect4">\r
-<h5 id="_dce_stub_data">dce_stub_data</h5>\r
-<div class="paragraph"><p>Since most DCE/RPC based rules had to do protocol decoding only to get to the\r
-DCE/RPC stub data, i.e. the remote procedure call or function call data, this\r
-option will alleviate this need and place the cursor at the beginning of the\r
-DCE/RPC stub data. This reduces the number of rule option checks and the\r
-complexity of the rule.</p></div>\r
-<div class="paragraph"><p>This option takes no arguments.</p></div>\r
-<div class="paragraph"><p>Example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dce_stub_data;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This option is used to place the cursor (used to walk the packet payload in\r
-rules processing) at the beginning of the DCE/RPC stub data, regardless of\r
-preceding rule options. There are no arguments to this option. This option\r
-matches if there is DCE/RPC stub data.</p></div>\r
-<div class="paragraph"><p>The cursor is moved to the beginning of the stub data. All ensuing rule\r
-options will be considered "sticky" to this buffer. The first rule option\r
-following dce_stub_data should use absolute location modifiers if it is\r
-position-dependent. Subsequent rule options should use a relative modifier if\r
-they are meant to be relative to a previous rule option match in the stub data\r
-buffer. Any rule option that does not specify a relative modifier will be\r
-evaluated from the start of the stub data buffer. To leave the stub data buffer\r
-and return to the main payload buffer, use the "pkt_data" rule option.</p></div>\r
-</div>\r
-<div class="sect4">\r
-<h5 id="_byte_test_and_byte_jump">byte_test and byte_jump</h5>\r
-<div class="paragraph"><p>A DCE/RPC request can specify whether numbers are represented in big or little\r
-endian. These rule options will take as a new argument "dce" and will work\r
-basically the same as the normal byte_test/byte_jump, but since the DCE/RPC\r
-inspector will know the endianness of the request, it will be able to do\r
-the correct conversion.</p></div>\r
-<div class="paragraph"><p>Examples:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>byte_test: 4,>,35000,0,relative,dce;\r
-byte_test: 2,!=,2280,-10,relative,dce;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>When using the "dce" argument to a byte_test, the following normal byte_test\r
-arguments will not be allowed: "big", "little", "string", "hex", "dec" and\r
-"oct".</p></div>\r
-<div class="paragraph"><p>Examples:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>byte_jump:4,-4,relative,align,multiplier 2,post_offset -4,dce;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>When using the dce argument to a byte_jump, the following normal byte_jump\r
-arguments will not be allowed: "big", "little", "string", "hex", "dec", "oct"\r
-and "from_beginning"</p></div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_file_processing">File Processing</h3>\r
-<div class="paragraph"><p>With the volume of malware transferred through network increasing,\r
-network file inspection becomes more and more important. This feature\r
-will provide file type identification, file signature creation, and file\r
-capture capabilities to help users deal with those challenges.</p></div>\r
-<div class="sect3">\r
-<h4 id="_overview_4">Overview</h4>\r
-<div class="paragraph"><p>There are two parts of file services: file APIs and file policy.\r
-File APIs provides all the file inspection functionalities, such as file\r
-type identification, file signature calculation, and file capture.\r
-File policy provides users ability to control file services, such\r
-as enable/disable/configure file type identification, file signature, or\r
-file capture.</p></div>\r
-<div class="paragraph"><p>In addition to all capabilities from Snort 2, we support customized file\r
-policy along with file event log.</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Supported protocols: HTTP, SMTP, IMAP, POP3, FTP, and SMB.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Supported file signature calculation: SHA256\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_quick_guide_2">Quick Guide</h4>\r
-<div class="paragraph"><p>A very simple configuration has been included in lua/snort.lua file.\r
-A typical file configuration looks like this:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dofile('magic.lua')</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>my_file_policy =\r
-{\r
- { when = { file_type_id = 0 }, use = { verdict = 'log', enable_file_signature = true, enable_file_capture = true } }\r
- { when = { file_type_id = 22 }, use = { verdict = 'log', enable_file_signature = true } },\r
- { when = { sha256 = "F74DC976BC8387E7D4FC0716A069017A0C7ED13F309A523CC41A8739CCB7D4B6" }, use = { verdict = 'block'} },\r
-}</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>file_id =\r
-{\r
- enable_type = true,\r
- enable_signature = true,\r
- enable_capture = true,\r
- file_rules = magics,\r
- trace_type = true,\r
- trace_signature = true,\r
- trace_stream = true,\r
- file_policy = my_file_policy,\r
- }</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>file_log =\r
-{\r
- log_pkt_time = true,\r
- log_sys_time = false,\r
-}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>There are 3 steps to enable file processing:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-First, you need to include the file magic rules.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Then, define the file policy and configure the inspector\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-At last, enable file_log to get detailed information about file event\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_pre_packaged_file_magic_rules">Pre-packaged File Magic Rules</h4>\r
-<div class="paragraph"><p>A set of file magic rules is packaged with Snort. They can be located at\r
-"lua/file_magic.lua". To use this feature, it is recommended that these\r
-pre-packaged rules are used; doing so requires that you include\r
-the file in your Snort configuration as such (already in snort.lua):</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>dofile('magic.lua')</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>{ type = "GIF", id = 62, category = "Graphics", rev = 1,\r
- magic = { { content = "| 47 49 46 38 37 61 |",offset = 0 } } },</code></pre>\r
-</div></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>{ type = "GIF", id = 63, category = "Graphics", rev = 1,\r
- magic = { { content = "| 47 49 46 38 39 61 |",offset = 0 } } },</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The previous two rules define GIF format, because two file magics are\r
-different. File magics are specifed by content and offset, which look\r
-at content at particular file offset to identify the file type. In this\r
-case, two magics look at the beginning of the file. You can use character\r
-if it is printable or hex value in between "|".</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_file_policy">File Policy</h4>\r
-<div class="paragraph"><p>You can enabled file type, file signature, or file capture by configuring\r
-file_id. In addition, you can enable trace to see file stream data, file\r
-type, and file signature information.</p></div>\r
-<div class="paragraph"><p>Most importantly, you can configure a file policy that can block/alert\r
-some file type or an individual file based on SHA. This allows you\r
-build a file blacklist or whitelist.</p></div>\r
-<div class="paragraph"><p>Example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>file_policy =\r
-{\r
- { when = { file_type_id = 22 }, use = { verdict = 'log', enable_file_signature = true } },\r
- { when = { sha256 = "F74DC976BC8387E7D4FC0716A069017A0C7ED13F309A523CC41A8739CCB7D4B6" }, use = { verdict = 'block'} },\r
- { when = { file_type_id = 0 }, use = { verdict = 'log', enable_file_signature = true, enable_file_capture = true } }\r
-}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>In this example, it enables this policy:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-For PDF files, they will be logged with signatures.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-For the file matching this SHA, it will be blocked\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-For all file types identified, they will be logged with signature, and\r
-also captured onto log folder.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_file_capture">File Capture</h4>\r
-<div class="paragraph"><p>File can be captured and stored to log folder. We use SHA as file name\r
-instead of actual file name to avoid conflicts. You can capture either\r
-all files, some file type, or a particular file based on SHA.</p></div>\r
-<div class="paragraph"><p>You can enable file capture through this config:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>enable_capture = true,</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>or enable it for some file or file type in your file policy:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>{ when = { file_type_id = 22 }, use = { verdict = 'log', enable_file_capture = true } },</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>The above rule will enable PDF file capture.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_file_events">File Events</h4>\r
-<div class="paragraph"><p>File inspect preprocessor also works as a dynamic output plugin for file\r
-events. It logs basic information about file. The log file is in the same\r
-folder as other log files with name starting with "file.log".</p></div>\r
-<div class="paragraph"><p>Example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>file_log = { log_pkt_time = true, log_sys_time = false }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>All file events will be logged in packet time, system time is not logged.</p></div>\r
-<div class="paragraph"><p>File event example:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>08/14-19:14:19.100891 10.22.75.72:33734 -> 10.22.75.36:80,\r
-[Name: "malware.exe"] [Verdict: Block] [Type: MSEXE]\r
-[SHA: 6F26E721FDB1AAFD29B41BCF90196DEE3A5412550615A856DAE8E3634BCE9F7A]\r
-[Size: 1039328]</code></pre>\r
-</div></div>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_http_inspector">HTTP Inspector</h3>\r
-<div class="paragraph"><p>One of the major undertakings for Snort 3 is developing a completely new\r
-HTTP inspector. You can configure it by adding:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>http_inspect = {}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>to your snort.lua configuration file. Or you can read it in the source code\r
-under src/service_inspectors/http_inspect.</p></div>\r
-<div class="paragraph"><p>The classic HTTP preprocessor is still available in the alpha release under\r
-extra. It has been renamed http_server. Be sure not to configure both old\r
-and new HTTP inspectors at the same time.</p></div>\r
-<div class="paragraph"><p>So why a new HTTP inspector?</p></div>\r
-<div class="paragraph"><p>For starters it is object-oriented. That’s good for us because we maintain\r
-this software. But it should also be really nice for open-source\r
-developers. You can make meaningful changes and additions to HTTP\r
-processing without having to understand the whole thing. In fact much of\r
-the new HTTP inspector’s knowledge of HTTP is centralized in a series of\r
-tables where it can be easily reviewed and modified. Many significant\r
-changes can be made just by updating these tables.</p></div>\r
-<div class="paragraph"><p>Http_inspect is the first inspector written specifically for the new\r
-Snort 3 architecture. That provides access to one of the very best\r
-features of Snort 3: purely PDU-based inspection. The classic preprocessor\r
-processes HTTP messages, but even while doing so it is constantly aware of\r
-IP packets and how they divide up the TCP data stream. The same HTTP\r
-message might be processed differently depending on how the sender (bad\r
-guy) divided it up into IP packets.</p></div>\r
-<div class="paragraph"><p>Http_inspect is free of this burden and can focus exclusively on HTTP.\r
-That makes it much simpler, easier to test, and less prone to false\r
-positives. It also greatly reduces the opportunity for adversaries to probe\r
-the inspector for weak spots by adjusting packet boundaries to disguise bad\r
-behavior.</p></div>\r
-<div class="paragraph"><p>Dealing solely with HTTP messages also opens the door for developing major\r
-new features. The http_inspect design supports true stateful\r
-processing. Want to ask questions that involve both the client request and\r
-the server response? Or different requests in the same session? These\r
-things are possible.</p></div>\r
-<div class="paragraph"><p>Another new feature on the horizon is HTTP/2 analysis. HTTP/2 derives from\r
-Google’s SPDY project and is in the process of being standardized. Despite\r
-the name, it is better to think of HTTP/2 not as a newer version of\r
-HTTP/1.1, but rather a separate protocol layer that runs under HTTP/1.1 and\r
-on top of TLS or TCP. It’s a perfect fit for the new Snort 3 architecture\r
-because a new HTTP/2 inspector would naturally output HTTP/1.1 messages but\r
-not any underlying packets. Exactly what http_inspect wants to input.</p></div>\r
-<div class="paragraph"><p>Http_inspect is taking a very different approach to HTTP header fields.\r
-The classic preprocessor divides all the HTTP headers following the start line\r
-into cookies and everything else. It normalizes the two pieces using a\r
-generic process and puts them in buffers that one can write rules against.\r
-There is some limited support for examining individual headers within the\r
-inspector but it is very specific.</p></div>\r
-<div class="paragraph"><p>The new concept is that every header should be normalized in an appropriate\r
-and specific way and individually made available for the user to write\r
-rules against it. If for example a header is supposed to be a date then\r
-normalization means put that date in a standard format.</p></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_performance_monitor">Performance Monitor</h3>\r
-<div class="paragraph"><p>The new and improved performance monitor! Is your sensor being bogged down by\r
-too many flows? perf_monitor! Why are certain TCP segments being dropped without\r
-hitting a rule? perf_monitor! Why is a sensor leaking water? Not perf_monitor, check\r
-with stream…</p></div>\r
-<div class="sect3">\r
-<h4 id="_overview_5">Overview</h4>\r
-<div class="paragraph"><p>The Snort performance monitor is the built-in utility for monitoring system\r
-and traffic statistics. All statistics are separated by processing thread.\r
-perf_monitor supports several trackers for monitoring such data:</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_base_tracker">Base Tracker</h4>\r
-<div class="paragraph"><p>The base tracker is used to gather running statistics about Snort and its\r
-running modules. All Snort modules gather, at the very least, counters for the\r
-number of packets reaching it. Most supplement these counts with those for\r
-domain specific functions, such as http_inspect’s number of GET requests seen.</p></div>\r
-<div class="paragraph"><p>Statistics are gathered live and can be reported at regular intervals. The stats\r
-reported correspond only to the interval in question and are reset at the\r
-beginning of each interval.</p></div>\r
-<div class="paragraph"><p>These are the same counts displayed when Snort shuts down, only sorted amongst\r
-the discrete intervals in which they occurred.</p></div>\r
-<div class="paragraph"><p>Base differs from prior implementations in Snort in that all stats gathered are\r
-only raw counts, allowing the data to be evaluated as needed. Additionally,\r
-base is entirely pluggable. Data from new Snort plugins can be added to the\r
-existing stats either automatically or, if specified, by name and function.</p></div>\r
-<div class="paragraph"><p>All plugins and counters can be enabled or disabled individually, allowing for\r
-only the data that is actually desired instead of overly verbose performance\r
-logs.</p></div>\r
-<div class="paragraph"><p>To enable everything:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>perf_monitor = { modules = {} }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>To enable everything within a module:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>perf_monitor =\r
-{\r
- modules =\r
- {\r
- {\r
- name = 'stream_tcp',\r
- pegs = [[ ]]\r
- },\r
- }\r
-}</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>To enable specific counts within modules:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>perf_monitor =\r
-{\r
- modules =\r
- {\r
- {\r
- name = 'stream_tcp',\r
- pegs = [[ overlaps gaps ]]\r
- },\r
- }</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Note: Event stats from prior Snorts are now located within base statistics.</p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_flow_tracker">Flow Tracker</h4>\r
-<div class="paragraph"><p>Flow tracks statistics regarding traffic and L3/L4 protocol distributions. This\r
-data can be used to build a profile of traffic for inspector tuning and for\r
-identifying where Snort may be stressed.</p></div>\r
-<div class="paragraph"><p>To enable:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>perf_monitor = { flow = true }</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_flowip_tracker">FlowIP Tracker</h4>\r
-<div class="paragraph"><p>FlowIP provides statistics for individual hosts within a network. This data can\r
-be used for identifying communication habits, such as generating large or small\r
-amounts of data, opening a small or large number of sessions, and tendency to\r
-send smaller or larger IP packets.</p></div>\r
-<div class="paragraph"><p>To enable:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>perf_monitor = { flow_ip = true }</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_cpu_tracker">CPU Tracker</h4>\r
-<div class="paragraph"><p>This tracker monitors the CPU and wall time spent by a given processing thread.</p></div>\r
-<div class="paragraph"><p>To enable:</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>perf_monitor = { cpu = true }</code></pre>\r
-</div></div>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_sensitive_data_filtering">Sensitive Data Filtering</h3>\r
-<div class="paragraph"><p>The <code>sd_pattern</code> IPS option provides detection and filtering of Personally\r
-Identifiable Information (PII). This information includes credit card\r
-numbers, U.S. Social Security numbers, and email addresses. A rich regular\r
-expression syntax is available for defining your own PII.</p></div>\r
-<div class="sect3">\r
-<h4 id="_hyperscan">Hyperscan</h4>\r
-<div class="paragraph"><p>The <code>sd_pattern</code> rule option is powered by the open source Hyperscan\r
-library from Intel. It provides a regex grammar which is mostly PCRE\r
-compatible. To learn more about Hyperscan see\r
-<a href="http://01org.github.io/hyperscan/dev-reference/">http://01org.github.io/hyperscan/dev-reference/</a></p></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_syntax">Syntax</h4>\r
-<div class="paragraph"><p>Snort provides <code>sd_pattern</code> as IPS rule option with no additional inspector\r
-overhead. The Rule option takes the following syntax.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>sd_pattern: "<pattern>"[, threshold <count>];</code></pre>\r
-</div></div>\r
-<div class="sect4">\r
-<h5 id="_pattern">Pattern</h5>\r
-<div class="paragraph"><p>Pattern is the most important and is the only required parameter to\r
-<code>sd_pattern</code>. It supports 3 built in patterns which are configured by name:\r
-"credit_card", "us_social" and "us_social_nodashes", as well as user\r
-defined regular expressions of the Hyperscan dialect (see\r
-<a href="http://01org.github.io/hyperscan/dev-reference/compilation.html#pattern-support">http://01org.github.io/hyperscan/dev-reference/compilation.html#pattern-support</a>).</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>sd_pattern:"credit_card";</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>When configured, Snort will replace the pattern <em>credit_card</em> with the built in\r
-pattern. In addition to pattern matching, Snort will validate that the matched\r
-digits will pass the Luhn-check algorithm. Currently the only pattern that\r
-performs extra verification.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>sd_pattern:"us_social";\r
-sd_pattern:"us_social_nodashes";</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>These special patterns will also be replaced with a built in pattern.\r
-Naturally, "us_social" is a pattern of 9 digits separated by <code>-</code>'s in the\r
-canonical form.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>sd_pattern:"\b\w+@ourdomain\.com\b"</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This is a user defined pattern which matches what is most likely email\r
-addresses for the site "ourdomain.com". The pattern is a PCRE compatible\r
-regex, <em>\b</em> matches a word boundary (whitespace, end of line, non-word\r
-characters) and <em>\w+</em> matches one or more word characters. <em>\.</em> matches\r
-a literal <em>.</em>.</p></div>\r
-<div class="paragraph"><p>The above pattern would match "a@ourdomain.com", "aa@ourdomain.com" but would\r
-not match <code>1@ourdomain.com</code> <code>ab12@ourdomain.com</code> or <code>@ourdomain.com</code>.</p></div>\r
-<div class="paragraph"><p>Note: This is just an example, this pattern is not suitable to detect many\r
-correctly formatted emails.</p></div>\r
-</div>\r
-<div class="sect4">\r
-<h5 id="_threshold">Threshold</h5>\r
-<div class="paragraph"><p>Threshold is an optional parameter allowing you to change built in default\r
-value (default value is <em>1</em>). The following two instances are identical.\r
-The first will assume the default value of <em>1</em> the second declaration\r
-explicitly sets the threshold to <em>1</em>.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>sd_pattern:"This rule requires 1 match";\r
-sd_pattern:"This rule requires 1 match", threshold 1;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>That’s pretty easy, but here is one more example anyway.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>sd_pattern:"This is a string literal", threshold 300;</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>This example requires 300 matches of the pattern "This is a string literal"\r
-to qualify as a positive match. That is, if the string only occurred 299 times\r
-in a packet, you will not see an event.</p></div>\r
-</div>\r
-<div class="sect4">\r
-<h5 id="_obfuscating_credit_cards_and_social_security_numbers">Obfuscating Credit Cards and Social Security Numbers</h5>\r
-<div class="paragraph"><p>Snort provides discreet logging for the built in patterns "credit_card",\r
-"us_social" and "us_social_nodashes". Enabling <code>output.obfuscate_pii</code> makes\r
-Snort obfuscate the suspect packet payload which was matched by the\r
-patterns. This configuration is disabled by default.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>output =\r
-{\r
- obfuscate_pii = true\r
-}</code></pre>\r
-</div></div>\r
-</div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_example">Example</h4>\r
-<div class="paragraph"><p>A complete Snort IPS rule</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>alert tcp ( sid:1; msg:"Credit Card"; sd_pattern:"credit_card"; )</code></pre>\r
-</div></div>\r
-<div class="paragraph"><p>Logged output when running Snort in "cmg" alert format.</p></div>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>02/25-21:19:05.125553 [**] [1:1:0] "Credit Card" [**] [Priority: 0] {TCP} 10.1.2.3:48620 -> 10.9.8.7:8\r
-02:01:02:03:04:05 -> 02:09:08:07:06:05 type:0x800 len:0x46\r
-10.1.2.3:48620 -> 10.9.8.7:8 TCP TTL:64 TOS:0x0 ID:14 IpLen:20 DgmLen:56\r
-***A**** Seq: 0xB2 Ack: 0x2 Win: 0x2000 TcpLen: 20\r
-- - - raw[16] - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r
-58 58 58 58 58 58 58 58 58 58 58 58 39 32 39 34 XXXXXXXXXXXX9294\r
-- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -</code></pre>\r
-</div></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_caveats">Caveats</h4>\r
-<div class="olist arabic"><ol class="arabic">\r
-<li>\r
-<p>\r
-Snort currently requires setting the fast pattern engine to use\r
-"hyperscan" in order for <code>sd_pattern</code> ips option to function correctly.\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>search_engine = { search_method = 'hyperscan' }</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Log obfuscation is only applicable to CMG and Unified2 logging formats.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Log obfuscation doesn’t support user defined PII patterns. It is\r
-currently only supported for the built in patterns for Credit Cards and US\r
-Social Security numbers.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Log obfuscation doesn’t work with stream rebuilt packet payloads. (This\r
-is a known bug).\r
-</p>\r
-</li>\r
-</ol></div>\r
-</div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_wizard">Wizard</h3>\r
-<div class="paragraph"><p>Using the wizard enables port-independent configuration and the detection of\r
-malware command and control channels. If the wizard is bound to a session, it\r
-peeks at the initial payload to determine the service. For example, <em>GET</em>\r
-would indicate HTTP and <em>HELO</em> would indicate SMTP. Upon finding a match, the\r
-service bindings are reevaluated so the session can be handed off to the\r
-appropriate inspector. The wizard is still under development; if you find you\r
-need to tweak the defaults please let us know.</p></div>\r
-<div class="paragraph"><p>Additional Details:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-If the wizard and one or more service inspectors are configured w/o\r
- explicitly configuring the binder, default bindings will be generated which\r
- should work for most common cases.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Also note that while Snort 2 bindings can only be configured in the\r
- default policy, each Snort 3 policy can contain a binder leading to an\r
- arbitrary hierarchy.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-The entire configuration can be reloaded and hot-swapped during run-time\r
- via signal or command in both Snort 2 and Snort 3. Ultimately, Snort 3\r
- will support commands to update the binder on the fly, thus enabling\r
- incremental reloads of individual inspectors.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Both Snort 2 and Snort 3 support server specific configurations via a hosts\r
- table (XML in Snort 2 and Lua in Snort 3). The table allows you to\r
- map network, protocol, and port to a service and policy. This table can\r
- be reloaded and hot-swapped separately from the config file.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-You can find the specifics on the binder, wizard, and hosts tables in the\r
- manual or command line like this: snort --help-module binder, etc.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_basic_modules">Basic Modules</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>Internal modules which are not plugins are termed "basic". These include\r
-configuration for core processing.</p></div>\r
-<div class="sect2">\r
-<h3 id="_active">active</h3>\r
-<div class="paragraph"><p>What: configure responses</p></div>\r
-<div class="paragraph"><p>Type: basic</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-int <strong>active.attempts</strong> = 0: number of TCP packets sent per response (with varying sequence numbers) { 0:20 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>active.device</strong>: use <em>ip</em> for network layer responses or <em>eth0</em> etc for link layer\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>active.dst_mac</strong>: use format <em>01:23:45:67:89:ab</em>\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>active.max_responses</strong> = 0: maximum number of responses { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>active.min_interval</strong> = 255: minimum number of seconds between responses { 1: }\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_alerts_2">alerts</h3>\r
-<div class="paragraph"><p>What: configure alerts</p></div>\r
-<div class="paragraph"><p>Type: basic</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-bool <strong>alerts.alert_with_interface_name</strong> = false: include interface in alert info (fast, full, or syslog only)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>alerts.default_rule_state</strong> = true: enable or disable ips rules\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>alerts.detection_filter_memcap</strong> = 1048576: set available bytes of memory for detection_filters { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>alerts.event_filter_memcap</strong> = 1048576: set available bytes of memory for event_filters { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>alerts.order</strong> = pass drop alert log: change the order of rule action application\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>alerts.rate_filter_memcap</strong> = 1048576: set available bytes of memory for rate_filters { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>alerts.reference_net</strong>: set the CIDR for homenet (for use with -l or -B, does NOT change $HOME_NET in IDS mode)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>alerts.stateful</strong> = false: don’t alert w/o established session (note: rule action still taken)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>alerts.tunnel_verdicts</strong>: let DAQ handle non-allow verdicts for GTP|Teredo|6in4|4in6 traffic\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_attribute_table">attribute_table</h3>\r
-<div class="paragraph"><p>What: configure hosts loading</p></div>\r
-<div class="paragraph"><p>Type: basic</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-int <strong>attribute_table.max_hosts</strong> = 1024: maximum number of hosts in attribute table { 32:207551 }\r
+int <strong>attribute_table.max_hosts</strong> = 1024: maximum number of hosts in attribute table { 32:207551 }\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:450</strong> (decode) bad IP protocol\r
+<strong>116:450</strong> (decode) BAD-TRAFFIC bad IP protocol\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:150</strong> (decode) loopback IP\r
+<strong>116:150</strong> (decode) bad traffic loopback IP\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:151</strong> (decode) same src/dst IP\r
+<strong>116:151</strong> (decode) bad traffic same src/dst IP\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:449</strong> (decode) unassigned/reserved IP protocol\r
+<strong>116:449</strong> (decode) BAD-TRAFFIC unassigned/reserved IP protocol\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:472</strong> (decode) too many protocols present\r
+<strong>116:468</strong> (decode) too many protocols present\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.hard evals</strong>: non-fast pattern rule evaluations\r
+<strong>detection.slow searches</strong>: non-fast pattern rule evaluations\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>file_id.max_files_cached</strong> = 65536: maximal number of files cached in memory { 8: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
bool <strong>file_id.enable_type</strong> = false: enable type ID\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>file_id.file_policy[].use.enable_file_capture</strong> = false: true/false → enable/disable file capture\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>file_id.trace_type</strong> = false: enable runtime dump of type info\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>file_id.trace_signature</strong> = false: enable runtime dump of signature info\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>file_id.trace_stream</strong> = false: enable runtime dump of file data\r
+bool <strong>file_id.file_policy[].use.enable_file_capture</strong> = false: true/false → enable/disable file capture\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>file_id.total files</strong>: number of files processed\r
+bool <strong>file_id.trace_type</strong> = false: enable runtime dump of type info\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>file_id.total file data</strong>: number of file data bytes processed\r
+bool <strong>file_id.trace_signature</strong> = false: enable runtime dump of signature info\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>file_id.cache failures</strong>: number of file cache add failures\r
+bool <strong>file_id.trace_stream</strong> = false: enable runtime dump of file data\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-enum <strong>latency.packet.action</strong> = none: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }\r
+enum <strong>latency.packet.action</strong> = alert_and_log: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>latency.rule.action</strong> = none: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }\r
+enum <strong>latency.rule.action</strong> = alert_and_log: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>latency.total packets</strong>: total packets monitored\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>latency.total usecs</strong>: total usecs elapsed\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>latency.max usecs</strong>: maximum usecs elapsed\r
+<strong>latency.total_packets</strong>: total packets monitored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.packet timeouts</strong>: packets that timed out\r
+<strong>latency.packet_timeouts</strong>: packets that timed out\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.total rule evals</strong>: total rule evals monitored\r
+<strong>latency.total_rule_evals</strong>: total rule evals monitored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.rule eval timeouts</strong>: rule evals that timed out\r
+<strong>latency.rule_eval_timeouts</strong>: rule evals that timed out\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.rule tree enables</strong>: rule tree re-enables\r
+<strong>latency.rule_tree_enables</strong>: rule tree re-enables\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-int <strong>network.layers</strong> = 40: the maximum number of protocols that Snort can correctly decode { 3:255 }\r
+int <strong>network.layers</strong> = 40: The maximum number of protocols that Snort can correctly decode { 3:255 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>network.max_ip6_extensions</strong> = 0: the maximum number of IP6 options Snort will process for a given IPv6 layer before raising 116:456 (0 = unlimited) { 0:255 }\r
+int <strong>network.max_ip6_extensions</strong> = 0: The number of IP6 options Snort will process for a given IPv6 layer. If this limit is hit, rule 116:456 may fire. 0 = unlimited { 0:255 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>network.max_ip_layers</strong> = 0: the maximum number of IP layers Snort will process for a given packet before raising 116:293 (0 = unlimited) { 0:255 }\r
+int <strong>network.max_ip_layers</strong> = 0: The maximum number of IP layers Snort will process for a given packet If this limit is hit, rule 116:293 may fire. 0 = unlimited { 0:255 }\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_output_2">output</h3>\r
+<h3 id="_output">output</h3>\r
<div class="paragraph"><p>What: configure general output parameters</p></div>\r
<div class="paragraph"><p>Type: basic</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
</li>\r
<li>\r
<p>\r
-bool <strong>output.obfuscate_pii</strong> = false: mask all but the last 4 characters of credit card and social security numbers\r
+bool <strong>output.obfuscate_pii</strong> = false: Mask all but the last 4 characters of credit card and social security numbers\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>rate_filter[].new_action</strong> = alert: take this action on future hits until timeout { log | pass | alert | drop | block | reset }\r
+select <strong>rate_filter[].new_action</strong> = alert: take this action on future hits until timeout { alert | drop | log | pass | | reject | sdrop }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>search_engine.max_pattern_len</strong> = 0: truncate patterns when compiling into state machine (0 means no maximum) { 0: }\r
+bool <strong>search_engine.debug_print_fast_pattern</strong> = false: print fast pattern info for each rule\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>search_engine.max_queue_events</strong> = 5: maximum number of matching fast pattern states to queue per packet\r
+int <strong>search_engine.max_pattern_len</strong> = 0: truncate patterns when compiling into state machine (0 means no maximum) { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>search_engine.inspect_stream_inserts</strong> = false: inspect reassembled payload - disabling is good for performance, bad for detection\r
+int <strong>search_engine.max_queue_events</strong> = 5: maximum number of matching fast pattern states to queue per packet\r
</p>\r
</li>\r
<li>\r
<p>\r
-dynamic <strong>search_engine.search_method</strong> = ac_bnfa: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan }\r
+bool <strong>search_engine.inspect_stream_inserts</strong> = false: inspect reassembled payload - disabling is good for performance, bad for detection\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>search_engine.search_optimize</strong> = true: tweak state machine construction for better performance\r
+dynamic <strong>search_engine.search_method</strong> = ac_bnfa: set fast pattern algorithm - choose available search engine { ac_banded | ac_bnfa | ac_full | ac_sparse | ac_sparse_bands | ac_std | hyperscan }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>search_engine.show_fast_patterns</strong> = false: print fast pattern info for each rule\r
+bool <strong>search_engine.split_any_any</strong> = false: evaluate any-any rules separately to save memory\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>search_engine.split_any_any</strong> = false: evaluate any-any rules separately to save memory\r
+bool <strong>search_engine.search_optimize</strong> = true: tweak state machine construction for better performance\r
</p>\r
</li>\r
</ul></div>\r
string <strong>side_channel.connectors[].connector</strong>: connector handle\r
</p>\r
</li>\r
-<li>\r
-<p>\r
-string <strong>side_channel.connector</strong>: connector handle\r
-</p>\r
-</li>\r
</ul></div>\r
<div class="paragraph"><p>Peg counts:</p></div>\r
</div>\r
</li>\r
<li>\r
<p>\r
+implied <strong>snort.-w</strong>: dump 802.11 management and control frames\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
implied <strong>snort.-X</strong>: dump the raw packet data starting at the link layer\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_ciscometadata">ciscometadata</h3>\r
-<div class="paragraph"><p>What: support for cisco metadata</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>116:468</strong> (ciscometadata) truncated Cisco Metadata header\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:469</strong> (ciscometadata) invalid Cisco Metadata option length\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:470</strong> (ciscometadata) invalid Cisco Metadata option type\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:471</strong> (ciscometadata) invalid Cisco Metadata SGT\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
<h3 id="_erspan2">erspan2</h3>\r
<div class="paragraph"><p>What: support for encapsulated remote switched port analyzer - type 2</p></div>\r
<div class="paragraph"><p>Type: codec</p></div>\r
</li>\r
<li>\r
<p>\r
-<strong>116:463</strong> (erspan2) captured length < ERSpan type2 header length\r
+<strong>116:463</strong> (erspan2) captured < ERSpan type2 header length\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:424</strong> (eth) truncated ethernet header\r
+<strong>116:424</strong> (eth) truncated eth header\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>116:250</strong> (icmp4) ICMP original IP header truncated\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:251</strong> (icmp4) ICMP version and original IP header versions differ\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:252</strong> (icmp4) ICMP original datagram length < original IP header length\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:253</strong> (icmp4) ICMP original IP payload < 64 bits\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:254</strong> (icmp4) ICMP original IP payload > 576 bytes\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:255</strong> (icmp4) ICMP original IP fragmented and offset not 0\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:415</strong> (icmp4) ICMP4 packet to multicast dest address\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:416</strong> (icmp4) ICMP4 packet to broadcast dest address\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:418</strong> (icmp4) ICMP4 type other\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:434</strong> (icmp4) ICMP ping Nmap\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:435</strong> (icmp4) ICMP icmpenum v1.1.1\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:436</strong> (icmp4) ICMP redirect host\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:437</strong> (icmp4) ICMP redirect net\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:438</strong> (icmp4) ICMP traceroute ipopts\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:439</strong> (icmp4) ICMP source quench\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:440</strong> (icmp4) broadscan smurf scanner\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:441</strong> (icmp4) ICMP destination unreachable communication administratively prohibited\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:442</strong> (icmp4) ICMP destination unreachable communication with destination host is administratively prohibited\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:443</strong> (icmp4) ICMP destination unreachable communication with destination network is administratively prohibited\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:451</strong> (icmp4) ICMP path MTU denial of service attempt\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:452</strong> (icmp4) Linux ICMP header DOS attempt\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:426</strong> (icmp4) truncated ICMP4 header\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>icmp4.bad checksum</strong>: non-zero icmp checksums\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_icmp6">icmp6</h3>\r
-<div class="paragraph"><p>What: support for Internet control message protocol v6</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>116:427</strong> (icmp6) truncated ICMP6 header\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:431</strong> (icmp6) ICMPv6 type not decoded\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:432</strong> (icmp6) ICMPv6 packet to multicast address\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:285</strong> (icmp6) ICMPv6 packet of type 2 (message too big) with MTU field < 1280\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:286</strong> (icmp6) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:287</strong> (icmp6) ICMPv6 router solicitation packet with a code not equal to 0\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:288</strong> (icmp6) ICMPv6 router advertisement packet with a code not equal to 0\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:289</strong> (icmp6) ICMPv6 router solicitation packet with the reserved field not equal to 0\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:290</strong> (icmp6) ICMPv6 router advertisement packet with the reachable time field set > 1 hour\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:457</strong> (icmp6) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:460</strong> (icmp6) ICMPv6 node info query/response packet with a code greater than 2\r
-</p>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>icmp6.bad checksum (ip4)</strong>: nonzero ipcm4 checksums\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>icmp6.bad checksum (ip6)</strong>: nonzero ipcm6 checksums\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_igmp">igmp</h3>\r
-<div class="paragraph"><p>What: support for Internet group management protocol</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-<strong>116:455</strong> (igmp) DOS IGMP IP options validation attempt\r
+<strong>116:250</strong> (icmp4) ICMP original IP header truncated\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_ipv4">ipv4</h3>\r
-<div class="paragraph"><p>What: support for Internet protocol v4</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:1</strong> (ipv4) not IPv4 datagram\r
+<strong>116:251</strong> (icmp4) ICMP version and original IP header versions differ\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:2</strong> (ipv4) IPv4 header length < minimum\r
+<strong>116:252</strong> (icmp4) ICMP original datagram length < original IP header length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:3</strong> (ipv4) IPv4 datagram length < header field\r
+<strong>116:253</strong> (icmp4) ICMP original IP payload < 64 bits\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:4</strong> (ipv4) IPv4 options found with bad lengths\r
+<strong>116:254</strong> (icmp4) ICMP original IP payload > 576 bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:5</strong> (ipv4) truncated IPv4 options\r
+<strong>116:255</strong> (icmp4) ICMP original IP fragmented and offset not 0\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:6</strong> (ipv4) IPv4 datagram length > captured length\r
+<strong>116:415</strong> (icmp4) ICMP4 packet to multicast dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:404</strong> (ipv4) IPv4 packet with zero TTL\r
+<strong>116:416</strong> (icmp4) ICMP4 packet to broadcast dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:405</strong> (ipv4) IPv4 packet with bad frag bits (both MF and DF set)\r
+<strong>116:418</strong> (icmp4) ICMP4 type other\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:407</strong> (ipv4) IPv4 packet frag offset + length exceed maximum\r
+<strong>116:434</strong> (icmp4) ICMP ping NMAP\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:408</strong> (ipv4) IPv4 packet from <em>current net</em> source address\r
+<strong>116:435</strong> (icmp4) ICMP icmpenum v1.1.1\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:409</strong> (ipv4) IPv4 packet to <em>current net</em> dest address\r
+<strong>116:436</strong> (icmp4) ICMP redirect host\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:410</strong> (ipv4) IPv4 packet from multicast source address\r
+<strong>116:437</strong> (icmp4) ICMP redirect net\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:411</strong> (ipv4) IPv4 packet from reserved source address\r
+<strong>116:438</strong> (icmp4) ICMP traceroute ipopts\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:412</strong> (ipv4) IPv4 packet to reserved dest address\r
+<strong>116:439</strong> (icmp4) ICMP source quench\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:413</strong> (ipv4) IPv4 packet from broadcast source address\r
+<strong>116:440</strong> (icmp4) broadscan smurf scanner\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:414</strong> (ipv4) IPv4 packet to broadcast dest address\r
+<strong>116:441</strong> (icmp4) ICMP destination unreachable communication administratively prohibited\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:428</strong> (ipv4) IPv4 packet below TTL limit\r
+<strong>116:442</strong> (icmp4) ICMP destination unreachable communication with destination host is administratively prohibited\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:430</strong> (ipv4) IPv4 packet both DF and offset set\r
+<strong>116:443</strong> (icmp4) ICMP destination unreachable communication with destination network is administratively prohibited\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:448</strong> (ipv4) IPv4 reserved bit set\r
+<strong>116:451</strong> (icmp4) ICMP path MTU denial of service attempt\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:444</strong> (ipv4) IPv4 option set\r
+<strong>116:452</strong> (icmp4) BAD-TRAFFIC Linux ICMP header DOS attempt\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:425</strong> (ipv4) truncated IPv4 header\r
+<strong>116:426</strong> (icmp4) truncated ICMP4 header\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>ipv4.bad checksum</strong>: nonzero ip checksums\r
+<strong>icmp4.bad checksum</strong>: non-zero icmp checksums\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_ipv6">ipv6</h3>\r
-<div class="paragraph"><p>What: support for Internet protocol v6</p></div>\r
+<h3 id="_icmp6">icmp6</h3>\r
+<div class="paragraph"><p>What: support for Internet control message protocol v6</p></div>\r
<div class="paragraph"><p>Type: codec</p></div>\r
<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:270</strong> (ipv6) IPv6 packet below TTL limit\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:271</strong> (ipv6) IPv6 header claims to not be IPv6\r
+<strong>116:427</strong> (icmp6) truncated ICMP6 header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:272</strong> (ipv6) IPv6 truncated extension header\r
+<strong>116:431</strong> (icmp6) ICMP6 type not decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:273</strong> (ipv6) IPv6 truncated header\r
+<strong>116:432</strong> (icmp6) ICMP6 packet to multicast address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:274</strong> (ipv6) IPv6 datagram length < header field\r
+<strong>116:285</strong> (icmp6) ICMPv6 packet of type 2 (message too big) with MTU field < 1280\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:275</strong> (ipv6) IPv6 datagram length > captured length\r
+<strong>116:286</strong> (icmp6) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 2463 code\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:276</strong> (ipv6) IPv6 packet with destination address ::0\r
+<strong>116:287</strong> (icmp6) ICMPv6 router solicitation packet with a code not equal to 0\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:277</strong> (ipv6) IPv6 packet with multicast source address\r
+<strong>116:288</strong> (icmp6) ICMPv6 router advertisement packet with a code not equal to 0\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:278</strong> (ipv6) IPv6 packet with reserved multicast destination address\r
+<strong>116:289</strong> (icmp6) ICMPv6 router solicitation packet with the reserved field not equal to 0\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:279</strong> (ipv6) IPv6 header includes an undefined option type\r
+<strong>116:290</strong> (icmp6) ICMPv6 router advertisement packet with the reachable time field set > 1 hour\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:280</strong> (ipv6) IPv6 address includes an unassigned multicast scope value\r
+<strong>116:457</strong> (icmp6) ICMPv6 packet of type 1 (destination unreachable) with non-RFC 4443 code\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:281</strong> (ipv6) IPv6 header includes an invalid value for the <em>next header</em> field\r
+<strong>116:460</strong> (icmp6) ICMPv6 node info query/response packet with a code greater than 2\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:282</strong> (ipv6) IPv6 header includes a routing extension header followed by a hop-by-hop header\r
+<strong>icmp6.bad checksum (ip4)</strong>: nonzero ipcm4 checksums\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:283</strong> (ipv6) IPv6 header includes two routing extension headers\r
+<strong>icmp6.bad checksum (ip6)</strong>: nonzero ipcm6 checksums\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_igmp">igmp</h3>\r
+<div class="paragraph"><p>What: support for Internet group management protocol</p></div>\r
+<div class="paragraph"><p>Type: codec</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:292</strong> (ipv6) IPv6 header has destination options followed by a routing header\r
+<strong>116:455</strong> (igmp) DOS IGMP IP options validation attempt\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_ipv4">ipv4</h3>\r
+<div class="paragraph"><p>What: support for Internet protocol v4</p></div>\r
+<div class="paragraph"><p>Type: codec</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:291</strong> (ipv6) IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux kernel attack\r
+<strong>116:1</strong> (ipv4) Not IPv4 datagram\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:295</strong> (ipv6) IPv6 header includes an option which is too big for the containing header\r
+<strong>116:2</strong> (ipv4) hlen < minimum\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:296</strong> (ipv6) IPv6 packet includes out-of-order extension headers\r
+<strong>116:3</strong> (ipv4) IP dgm len < IP Hdr len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:429</strong> (ipv6) IPv6 packet has zero hop limit\r
+<strong>116:4</strong> (ipv4) Ipv4 Options found with bad lengths\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:453</strong> (ipv6) ISATAP-addressed IPv6 traffic spoofing attempt\r
+<strong>116:5</strong> (ipv4) Truncated Ipv4 Options\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:458</strong> (ipv6) bogus fragmentation packet, possible BSD attack\r
+<strong>116:6</strong> (ipv4) IP dgm len > captured len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:461</strong> (ipv6) IPv6 routing type 0 extension header\r
+<strong>116:404</strong> (ipv4) IPV4 packet with zero TTL\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:456</strong> (ipv6) too many IPv6 extension headers\r
+<strong>116:405</strong> (ipv4) IPV4 packet with bad frag bits (both MF and DF set)\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_mpls">mpls</h3>\r
-<div class="paragraph"><p>What: support for multiprotocol label switching</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>mpls.enable_mpls_multicast</strong> = false: enables support for MPLS multicast\r
+<strong>116:407</strong> (ipv4) IPV4 packet frag offset + length exceed maximum\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>mpls.enable_mpls_overlapping_ip</strong> = false: enable if private network addresses overlap and must be differentiated by MPLS label(s)\r
+<strong>116:408</strong> (ipv4) IPV4 packet from <em>current net</em> source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>mpls.max_mpls_stack_depth</strong> = -1: set MPLS stack depth { -1: }\r
+<strong>116:409</strong> (ipv4) IPV4 packet to <em>current net</em> dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-enum <strong>mpls.mpls_payload_type</strong> = ip4: set encapsulated payload type { eth | ip4 | ip6 }\r
+<strong>116:410</strong> (ipv4) IPV4 packet from multicast source address\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:170</strong> (mpls) bad MPLS frame\r
+<strong>116:411</strong> (ipv4) IPV4 packet from reserved source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:171</strong> (mpls) MPLS label 0 appears in non-bottom header\r
+<strong>116:412</strong> (ipv4) IPV4 packet to reserved dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:172</strong> (mpls) MPLS label 1 appears in bottom header\r
+<strong>116:413</strong> (ipv4) IPV4 packet from broadcast source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:173</strong> (mpls) MPLS label 2 appears in non-bottom header\r
+<strong>116:414</strong> (ipv4) IPV4 packet to broadcast dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:174</strong> (mpls) MPLS label 3 appears in header\r
+<strong>116:428</strong> (ipv4) IPV4 packet below TTL limit\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:175</strong> (mpls) MPLS label 4, 5,.. or 15 appears in header\r
+<strong>116:430</strong> (ipv4) IPV4 packet both DF and offset set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:176</strong> (mpls) too many MPLS headers\r
+<strong>116:448</strong> (ipv4) BAD-TRAFFIC IP reserved bit set\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>mpls.total packets</strong>: total mpls labeled packets processed\r
+<strong>116:444</strong> (ipv4) MISC IP option set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>mpls.total bytes</strong>: total mpls labeled bytes processed\r
+<strong>116:425</strong> (ipv4) truncated IP4 header\r
</p>\r
</li>\r
</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_pgm">pgm</h3>\r
-<div class="paragraph"><p>What: support for pragmatic general multicast</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:454</strong> (pgm) PGM nak list overflow attempt\r
+<strong>ipv4.bad checksum</strong>: nonzero ip checksums\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_pppoe">pppoe</h3>\r
-<div class="paragraph"><p>What: support for point-to-point protocol over ethernet</p></div>\r
+<h3 id="_ipv6">ipv6</h3>\r
+<div class="paragraph"><p>What: support for Internet protocol v6</p></div>\r
<div class="paragraph"><p>Type: codec</p></div>\r
<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:120</strong> (pppoe) bad PPPOE frame detected\r
+<strong>116:270</strong> (ipv6) IPv6 packet below TTL limit\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_tcp_2">tcp</h3>\r
-<div class="paragraph"><p>What: support for transmission control protocol</p></div>\r
-<div class="paragraph"><p>Type: codec</p></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:45</strong> (tcp) TCP packet length is smaller than 20 bytes\r
+<strong>116:271</strong> (ipv6) IPv6 header claims to not be IPv6\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:46</strong> (tcp) TCP data offset is less than 5\r
+<strong>116:272</strong> (ipv6) IPV6 truncated extension header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:47</strong> (tcp) TCP header length exceeds packet length\r
+<strong>116:273</strong> (ipv6) IPV6 truncated header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:54</strong> (tcp) TCP options found with bad lengths\r
+<strong>116:274</strong> (ipv6) IP dgm len < IP Hdr len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:55</strong> (tcp) truncated TCP options\r
+<strong>116:275</strong> (ipv6) IP dgm len > captured len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:56</strong> (tcp) T/TCP detected\r
+<strong>116:276</strong> (ipv6) IPv6 packet with destination address ::0\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:57</strong> (tcp) obsolete TCP options found\r
+<strong>116:277</strong> (ipv6) IPv6 packet with multicast source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:58</strong> (tcp) experimental TCP options found\r
+<strong>116:278</strong> (ipv6) IPv6 packet with reserved multicast destination address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:59</strong> (tcp) TCP window scale option found with length > 14\r
+<strong>116:279</strong> (ipv6) IPv6 header includes an undefined option type\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:400</strong> (tcp) XMAS attack detected\r
+<strong>116:280</strong> (ipv6) IPv6 address includes an unassigned multicast scope value\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:401</strong> (tcp) Nmap XMAS attack detected\r
+<strong>116:281</strong> (ipv6) IPv6 header includes an invalid value for the <em>next header</em> field\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:419</strong> (tcp) TCP urgent pointer exceeds payload length or no payload\r
+<strong>116:282</strong> (ipv6) IPv6 header includes a routing extension header followed by a hop-by-hop header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:420</strong> (tcp) TCP SYN with FIN\r
+<strong>116:283</strong> (ipv6) IPv6 header includes two routing extension headers\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:421</strong> (tcp) TCP SYN with RST\r
+<strong>116:292</strong> (ipv6) IPv6 header has destination options followed by a routing header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:422</strong> (tcp) TCP PDU missing ack for established session\r
+<strong>116:291</strong> (ipv6) IPV6 tunneled over IPv4, IPv6 header truncated, possible Linux kernel attack\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:423</strong> (tcp) TCP has no SYN, ACK, or RST\r
+<strong>116:295</strong> (ipv6) IPv6 header includes an option which is too big for the containing header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:433</strong> (tcp) DDOS shaft SYN flood\r
+<strong>116:296</strong> (ipv6) IPv6 packet includes out-of-order extension headers\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:446</strong> (tcp) TCP port 0 traffic\r
+<strong>116:429</strong> (ipv6) IPV6 packet has zero hop limit\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:402</strong> (tcp) DOS NAPTHA vulnerability detected\r
+<strong>116:453</strong> (ipv6) BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:403</strong> (tcp) SYN to multicast address\r
+<strong>116:458</strong> (ipv6) bogus fragmentation packet, possible BSD attack\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>tcp.bad checksum (ip4)</strong>: nonzero tcp over ip checksums\r
+<strong>116:461</strong> (ipv6) IPV6 routing type 0 extension header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>tcp.bad checksum (ip6)</strong>: nonzero tcp over ipv6 checksums\r
+<strong>116:456</strong> (ipv6) too many IP6 extension headers\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_udp_2">udp</h3>\r
-<div class="paragraph"><p>What: support for user datagram protocol</p></div>\r
+<h3 id="_mpls">mpls</h3>\r
+<div class="paragraph"><p>What: support for multiprotocol label switching</p></div>\r
<div class="paragraph"><p>Type: codec</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>udp.deep_teredo_inspection</strong> = false: look for Teredo on all UDP ports (default is only 3544)\r
+bool <strong>mpls.enable_mpls_multicast</strong> = false: enables support for MPLS multicast\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>udp.enable_gtp</strong> = false: decode GTP encapsulations\r
+bool <strong>mpls.enable_mpls_overlapping_ip</strong> = false: enable if private network addresses overlap and must be differentiated by MPLS label(s)\r
</p>\r
</li>\r
<li>\r
<p>\r
-bit_list <strong>udp.gtp_ports</strong> = 2152 3386: set GTP ports { 65535 }\r
+int <strong>mpls.max_mpls_stack_depth</strong> = -1: set MPLS stack depth { -1: }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+enum <strong>mpls.mpls_payload_type</strong> = ip4: set encapsulated payload type { eth | ip4 | ip6 }\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:95</strong> (udp) truncated UDP header\r
+<strong>116:170</strong> (mpls) bad MPLS frame\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:96</strong> (udp) invalid UDP header, length field < 8\r
+<strong>116:171</strong> (mpls) MPLS label 0 appears in non-bottom header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:97</strong> (udp) short UDP packet, length field > payload length\r
+<strong>116:172</strong> (mpls) MPLS label 1 appears in bottom header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:98</strong> (udp) long UDP packet, length field < payload length\r
+<strong>116:173</strong> (mpls) MPLS label 2 appears in non-bottom header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:406</strong> (udp) invalid IPv6 UDP packet, checksum zero\r
+<strong>116:174</strong> (mpls) MPLS label 3 appears in header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:445</strong> (udp) large UDP packet (> 4000 bytes)\r
+<strong>116:175</strong> (mpls) MPLS label 4, 5,.. or 15 appears in header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:447</strong> (udp) UDP port 0 traffic\r
+<strong>116:176</strong> (mpls) too many MPLS headers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>udp.bad checksum (ip4)</strong>: nonzero udp over ipv4 checksums\r
+<strong>mpls.total packets</strong>: total mpls labeled packets processed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>udp.bad checksum (ip6)</strong>: nonzero udp over ipv6 checksums\r
+<strong>mpls.total bytes</strong>: total mpls labeled bytes processed\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_vlan">vlan</h3>\r
-<div class="paragraph"><p>What: support for local area network</p></div>\r
+<h3 id="_pgm">pgm</h3>\r
+<div class="paragraph"><p>What: support for pragmatic general multicast</p></div>\r
<div class="paragraph"><p>Type: codec</p></div>\r
<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>116:130</strong> (vlan) bad VLAN frame\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:131</strong> (vlan) bad LLC header\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:132</strong> (vlan) bad extra LLC info\r
+<strong>116:454</strong> (pgm) BAD-TRAFFIC PGM nak list overflow attempt\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_inspector_modules">Inspector Modules</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>These modules perform a variety of functions, including analysis of\r
-protocols beyond basic decoding.</p></div>\r
<div class="sect2">\r
-<h3 id="_appid_2">appid</h3>\r
-<div class="paragraph"><p>What: application and service identification</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-int <strong>appid.memcap</strong> = 0: disregard - not implemented { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>appid.log_stats</strong> = false: enable logging of appid statistics\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.app_stats_period</strong> = 300: time period for collecting and logging appid statistics { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.app_stats_rollover_size</strong> = 20971520: max file size for appid stats before rolling over the log file { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.app_stats_rollover_time</strong> = 86400: max time period for collection appid stats before rolling over the log file { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>appid.app_detector_dir</strong>: directory to load appid detectors from\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.instance_id</strong> = 0: instance id - need more details for what this is { 0: }\r
-</p>\r
-</li>\r
+<h3 id="_pppoe">pppoe</h3>\r
+<div class="paragraph"><p>What: support for point-to-point protocol over ethernet</p></div>\r
+<div class="paragraph"><p>Type: codec</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>appid.debug</strong> = false: enable appid debug logging\r
+<strong>116:120</strong> (pppoe) bad PPPOE frame detected\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_tcp">tcp</h3>\r
+<div class="paragraph"><p>What: support for transmission control protocol</p></div>\r
+<div class="paragraph"><p>Type: codec</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>appid.dump_ports</strong> = false: enable dump of appid port information\r
+<strong>116:45</strong> (tcp) TCP packet len is smaller than 20 bytes\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>appid.thirdparty_appid_dir</strong>: directory to load thirdparty appid detectors from\r
+<strong>116:46</strong> (tcp) TCP data offset is less than 5\r
</p>\r
</li>\r
<li>\r
<p>\r
-addr <strong>appid.session_log_filter.src_ip</strong> = 0.0.0.0/32: source ip address in CIDR format\r
+<strong>116:47</strong> (tcp) TCP header length exceeds packet length\r
</p>\r
</li>\r
<li>\r
<p>\r
-addr <strong>appid.session_log_filter.dst_ip</strong> = 0.0.0.0/32: destination ip address in CIDR format\r
+<strong>116:54</strong> (tcp) TCP options found with bad lengths\r
</p>\r
</li>\r
<li>\r
<p>\r
-port <strong>appid.session_log_filter.src_port</strong>: source port { 1: }\r
+<strong>116:55</strong> (tcp) truncated TCP options\r
</p>\r
</li>\r
<li>\r
<p>\r
-port <strong>appid.session_log_filter.dst_port</strong>: destination port { 1: }\r
+<strong>116:56</strong> (tcp) T/TCP detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>appid.session_log_filter.protocol</strong>: ip protocol\r
+<strong>116:57</strong> (tcp) obsolete TCP options found\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>appid.session_log_filter.log_all_sessions</strong> = false: enable logging for all appid sessions\r
+<strong>116:58</strong> (tcp) experimental TCP options found\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.packets</strong>: count of packets received\r
+<strong>116:59</strong> (tcp) TCP window scale option found with length > 14\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.processed packets</strong>: count of packets processed\r
+<strong>116:400</strong> (tcp) XMAS attack detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ignored packets</strong>: count of packets ignored\r
+<strong>116:401</strong> (tcp) Nmap XMAS attack detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.aim clients</strong>: count of aim clients discovered\r
+<strong>116:419</strong> (tcp) TCP urgent pointer exceeds payload length or no payload\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.battlefield flows</strong>: count of battle field flows discovered\r
+<strong>116:420</strong> (tcp) TCP SYN with FIN\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.bgp flows</strong>: count of bgp flows discovered\r
+<strong>116:421</strong> (tcp) TCP SYN with RST\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.bit clients</strong>: count of bittorrent clients discovered\r
+<strong>116:422</strong> (tcp) TCP PDU missing ack for established session\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.bit flows</strong>: count of bittorrent flows discovered\r
+<strong>116:423</strong> (tcp) TCP has no SYN, ACK, or RST\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.bittracker clients</strong>: count of bittorrent tracker clients discovered\r
+<strong>116:433</strong> (tcp) DDOS shaft SYN flood\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.bootp flows</strong>: count of bootp flows discovered\r
+<strong>116:446</strong> (tcp) BAD-TRAFFIC TCP port 0 traffic\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.dcerpc tcp flows</strong>: count of dce rpc flows over tcp discovered\r
+<strong>116:402</strong> (tcp) DOS NAPTHA vulnerability detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.dcerpc udp flows</strong>: count of dce rpc flows over udp discovered\r
+<strong>116:403</strong> (tcp) bad traffic SYN to multicast address\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.direct connect flows</strong>: count of direct connect flows discovered\r
+<strong>tcp.bad checksum (ip4)</strong>: nonzero tcp over ip checksums\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.dns tcp flows</strong>: count of dns flows over tcp discovered\r
+<strong>tcp.bad checksum (ip6)</strong>: nonzero tcp over ipv6 checksums\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_udp">udp</h3>\r
+<div class="paragraph"><p>What: support for user datagram protocol</p></div>\r
+<div class="paragraph"><p>Type: codec</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.dns udp flows</strong>: count of dns flows over udp discovered\r
+bool <strong>udp.deep_teredo_inspection</strong> = false: look for Teredo on all UDP ports (default is only 3544)\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ftp flows</strong>: count of ftp flows discovered\r
+bool <strong>udp.enable_gtp</strong> = false: decode GTP encapsulations\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ftps flows</strong>: count of ftps flows discovered\r
+bit_list <strong>udp.gtp_ports</strong> = 2152 3386: set GTP ports { 65535 }\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.http flows</strong>: count of http flows discovered\r
+<strong>116:95</strong> (udp) truncated UDP header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.imap flows</strong>: count of imap service flows discovered\r
+<strong>116:96</strong> (udp) invalid UDP header, length field < 8\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.imaps flows</strong>: count of imap TLS service flows discovered\r
+<strong>116:97</strong> (udp) short UDP packet, length field > payload length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.irc flows</strong>: count of irc service flows discovered\r
+<strong>116:98</strong> (udp) long UDP packet, length field < payload length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.kerberos clients</strong>: count of kerberos clients discovered\r
+<strong>116:406</strong> (udp) invalid IPv6 UDP packet, checksum zero\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.kerberos flows</strong>: count of kerberos service flows discovered\r
+<strong>116:445</strong> (udp) misc large UDP Packet\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.kerberos users</strong>: count of kerberos users discovered\r
+<strong>116:447</strong> (udp) BAD-TRAFFIC UDP port 0 traffic\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.lpr flows</strong>: count of lpr service flows discovered\r
+<strong>udp.bad checksum (ip4)</strong>: nonzero udp over ipv4 checksums\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.mdns flows</strong>: count of mdns service flows discovered\r
+<strong>udp.bad checksum (ip6)</strong>: nonzero udp over ipv6 checksums\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_vlan">vlan</h3>\r
+<div class="paragraph"><p>What: support for local area network</p></div>\r
+<div class="paragraph"><p>Type: codec</p></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.msn clients</strong>: count of msn clients discovered\r
+<strong>116:130</strong> (vlan) bad VLAN frame\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.mysql flows</strong>: count of mysql service flows discovered\r
+<strong>116:131</strong> (vlan) bad LLC header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.netbios dgm flows</strong>: count of netbios-dgm service flows discovered\r
+<strong>116:132</strong> (vlan) bad extra LLC info\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_inspector_modules">Inspector Modules</h2>\r
+<div class="sectionbody">\r
+<div class="paragraph"><p>These modules perform a variety of functions, including analysis of\r
+protocols beyond basic decoding.</p></div>\r
+<div class="sect2">\r
+<h3 id="_appid">appid</h3>\r
+<div class="paragraph"><p>What: application and service identification</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.netbios ns flows</strong>: count of netbios-ns service flows discovered\r
+string <strong>appid.conf</strong>: RNA configuration file\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.netbios ssn flows</strong>: count of netbios-ssn service flows discovered\r
+int <strong>appid.memcap</strong> = 268435456: time period for collecting and logging AppId statistics { 1048576:3221225472 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.nntp flows</strong>: count of nntp flows discovered\r
+string <strong>appid.app_stats_filename</strong>: Filename for logging AppId statistics\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ntp flows</strong>: count of ntp flows discovered\r
+int <strong>appid.app_stats_period</strong> = 300: time period for collecting and logging AppId statistics { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.pop flows</strong>: count of pop service flows discovered\r
+int <strong>appid.app_stats_rollover_size</strong> = 20971520: max file size for AppId stats before rolling over the log file { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.radius flows</strong>: count of radius flows discovered\r
+int <strong>appid.app_stats_rollover_time</strong> = 86400: max time period for collection AppId stats before rolling over the log file { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rexec flows</strong>: count of rexec flows discovered\r
+string <strong>appid.app_detector_dir</strong>: directory to load AppId detectors from\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rfb flows</strong>: count of rfb flows discovered\r
+int <strong>appid.instance_id</strong> = 0: instance id - need more details for what this is { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rlogin flows</strong>: count of rlogin flows discovered\r
+bool <strong>appid.debug</strong> = false: enable AppId debug logging\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rpc flows</strong>: count of rpc flows discovered\r
+bool <strong>appid.dump_ports</strong> = false: enable dump of AppId port information\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rshell flows</strong>: count of rshell flows discovered\r
+string <strong>appid.thirdparty_appid_dir</strong>: directory to load thirdparty AppId detectors from\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.rsync flows</strong>: count of rsync service flows discovered\r
+<strong>appid.packets</strong>: count of packets processed by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rtmp flows</strong>: count of rtmp flows discovered\r
+<strong>appid.battlefield_flows</strong>: count of battle field flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rtp clients</strong>: count of rtp clients discovered\r
+<strong>appid.bgp_flows</strong>: count of bgp flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.sip clients</strong>: count of SIP clients discovered\r
+<strong>appid.bit_clients</strong>: count of bittorrent clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.sip flows</strong>: count of SIP flows discovered\r
+<strong>appid.bit_flows</strong>: count of bittorrent flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp aol clients</strong>: count of AOL smtp clients discovered\r
+<strong>appid.bittracker_clients</strong>: count of bittorrent tracker clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp applemail clients</strong>: count of Apple Mail smtp clients discovered\r
+<strong>appid.dcerpc_tcp_flows</strong>: count of dce rpc flows over tcp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp eudora clients</strong>: count of Eudora smtp clients discovered\r
+<strong>appid.dcerpc_udp_flows</strong>: count of dce rpc flows over udp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp eudora pro clients</strong>: count of Eudora Pro smtp clients discovered\r
+<strong>appid.dns_tcp_flows</strong>: count of dns flows over tcp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp evolution clients</strong>: count of Evolution smtp clients discovered\r
+<strong>appid.dns_udp_flows</strong>: count of dns flows over udp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp kmail clients</strong>: count of KMail smtp clients discovered\r
+<strong>appid.ftp_flows</strong>: count of ftp flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp lotus notes clients</strong>: count of Lotus Notes smtp clients discovered\r
+<strong>appid.ftps_flows</strong>: count of ftps flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp microsoft outlook clients</strong>: count of Microsoft Outlook smtp clients discovered\r
+<strong>appid.imap_flows</strong>: count of imap service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp microsoft outlook express clients</strong>: count of Microsoft Outlook Express smtp clients discovered\r
+<strong>appid.imaps_flows</strong>: count of imap TLS service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp microsoft outlook imo clients</strong>: count of Microsoft Outlook IMO smtp clients discovered\r
+<strong>appid.irc_flows</strong>: count of irc service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp mutt clients</strong>: count of Mutt smtp clients discovered\r
+<strong>appid.kerberos_clients</strong>: count of kerberos clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp thunderbird clients</strong>: count of Thunderbird smtp clients discovered\r
+<strong>appid.kerberos_flows</strong>: count of kerberos service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp flows</strong>: count of smtp flows discovered\r
+<strong>appid.kerberos_users</strong>: count of kerberos users discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtps flows</strong>: count of smtps flows discovered\r
+<strong>appid.lpr_flows</strong>: count of lpr service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.snmp flows</strong>: count of snmp flows discovered\r
+<strong>appid.mdns_flows</strong>: count of mdns service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ssh clients</strong>: count of ssh clients discovered\r
+<strong>appid.mysql_flows</strong>: count of mysql service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ssh flows</strong>: count of ssh flows discovered\r
+<strong>appid.netbios_flows</strong>: count of netbios service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ssl flows</strong>: count of ssl flows discovered\r
+<strong>appid.pop_flows</strong>: count of pop service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.telnet flows</strong>: count of telnet flows discovered\r
+<strong>appid.smtp_flows</strong>: count of smtp flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.tftp flows</strong>: count of tftp flows discovered\r
+<strong>appid.smtps_flows</strong>: count of smtps flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.timbuktu flows</strong>: count of timbuktu flows discovered\r
+<strong>appid.ssh_clients</strong>: count of ssh clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.tns clients</strong>: count of tns clients discovered\r
+<strong>appid.ssh_flows</strong>: count of ssh flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.tns flows</strong>: count of tns flows discovered\r
+<strong>appid.ssl_flows</strong>: count of ssl flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.vnc clients</strong>: count of vnc clients discovered\r
+<strong>appid.telnet_flows</strong>: count of telnet flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.yahoo messenger clients</strong>: count of Yahoo Messenger clients discovered\r
+<strong>appid.timbuktu_flows</strong>: count of timbuktu flows discovered by appid\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_binder_2">binder</h3>\r
+<h3 id="_binder">binder</h3>\r
<div class="paragraph"><p>What: configure processing based on CIDRs, ports, services, etc.</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
string <strong>dce_smb.smb_invalid_shares</strong>: SMB shares to alert on\r
</p>\r
</li>\r
-<li>\r
-<p>\r
-bool <strong>dce_smb.smb_legacy_mode</strong> = false: inspect only SMBv1\r
-</p>\r
-</li>\r
</ul></div>\r
<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>133:2</strong> (dce_smb) SMB - bad NetBIOS session service session type\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:3</strong> (dce_smb) SMB - bad SMB message type\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:4</strong> (dce_smb) SMB - bad SMB Id (not \xffSMB for SMB1 or not \xfeSMB for SMB2)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:5</strong> (dce_smb) SMB - bad word count or structure size\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:6</strong> (dce_smb) SMB - bad byte count\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:7</strong> (dce_smb) SMB - bad format type\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:8</strong> (dce_smb) SMB - bad offset\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:9</strong> (dce_smb) SMB - zero total data count\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:10</strong> (dce_smb) SMB - NetBIOS data length less than SMB header length\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:12</strong> (dce_smb) SMB - remaining NetBIOS data length less than command byte count\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:13</strong> (dce_smb) SMB - remaining NetBIOS data length less than command data size\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:14</strong> (dce_smb) SMB - remaining total data count less than this command data size\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:15</strong> (dce_smb) SMB - total data sent (STDu64) greater than command total data expected\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:16</strong> (dce_smb) SMB - byte count less than command data size (STDu64)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:17</strong> (dce_smb) SMB - invalid command data size for byte count\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:18</strong> (dce_smb) SMB - excessive tree connect requests with pending tree connect responses\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:19</strong> (dce_smb) SMB - excessive read requests with pending read responses\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:20</strong> (dce_smb) SMB - excessive command chaining\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:21</strong> (dce_smb) SMB - multiple chained tree connect requests\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:22</strong> (dce_smb) SMB - multiple chained tree connect requests\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:23</strong> (dce_smb) SMB - chained/compounded login followed by logoff\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:24</strong> (dce_smb) SMB - chained/compounded tree connect followed by tree disconnect\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:25</strong> (dce_smb) SMB - chained/compounded open pipe followed by close pipe\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:26</strong> (dce_smb) SMB - invalid share access\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:27</strong> (dce_smb) connection oriented DCE/RPC - invalid major version\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:28</strong> (dce_smb) connection oriented DCE/RPC - invalid minor version\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:29</strong> (dce_smb) connection-oriented DCE/RPC - invalid PDU type\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:30</strong> (dce_smb) connection-oriented DCE/RPC - fragment length less than header size\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:32</strong> (dce_smb) connection-oriented DCE/RPC - no context items specified\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:33</strong> (dce_smb) connection-oriented DCE/RPC -no transfer syntaxes specified\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:34</strong> (dce_smb) connection-oriented DCE/RPC - fragment length on non-last fragment less than maximum negotiated fragment transmit size for client\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:35</strong> (dce_smb) connection-oriented DCE/RPC - fragment length greater than maximum negotiated fragment transmit size\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:36</strong> (dce_smb) connection-oriented DCE/RPC - alter context byte order different from bind\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:37</strong> (dce_smb) connection-oriented DCE/RPC - call id of non first/last fragment different from call id established for fragmented request\r
+<strong>133:2</strong> (dce_smb) SMB - Bad NetBIOS Session Service session type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:38</strong> (dce_smb) connection-oriented DCE/RPC - opnum of non first/last fragment different from opnum established for fragmented request\r
+<strong>133:3</strong> (dce_smb) SMB - Bad SMB message type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:39</strong> (dce_smb) connection-oriented DCE/RPC - context id of non first/last fragment different from context id established for fragmented request\r
+<strong>133:4</strong> (dce_smb) SMB - Bad SMB Id (not \xffSMB for SMB1 or not \xfeSMB for SMB2).\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:44</strong> (dce_smb) SMB - invalid SMB version 1 seen\r
+<strong>133:5</strong> (dce_smb) SMB - Bad word count or structure size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:45</strong> (dce_smb) SMB - invalid SMB version 2 seen\r
+<strong>133:6</strong> (dce_smb) SMB - Bad byte count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:46</strong> (dce_smb) SMB - invalid user, tree connect, file binding\r
+<strong>133:7</strong> (dce_smb) SMB - Bad format type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:47</strong> (dce_smb) SMB - excessive command compounding\r
+<strong>133:8</strong> (dce_smb) SMB - Bad offset.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:48</strong> (dce_smb) SMB - zero data count\r
+<strong>133:9</strong> (dce_smb) SMB - Zero total data count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:50</strong> (dce_smb) SMB - maximum number of outstanding requests exceeded\r
+<strong>133:10</strong> (dce_smb) SMB - NetBIOS data length less than SMB header length.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:51</strong> (dce_smb) SMB - outstanding requests with same MID\r
+<strong>133:12</strong> (dce_smb) SMB - Remaining NetBIOS data length less than command byte count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:52</strong> (dce_smb) SMB - deprecated dialect negotiated\r
+<strong>133:13</strong> (dce_smb) SMB - Remaining NetBIOS data length less than command data size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:53</strong> (dce_smb) SMB - deprecated command used\r
+<strong>133:14</strong> (dce_smb) SMB - Remaining total data count less than this command data size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:54</strong> (dce_smb) SMB - unusual command used\r
+<strong>133:15</strong> (dce_smb) SMB - Total data sent (STDu64) greater than command total data expected.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:55</strong> (dce_smb) SMB - invalid setup count for command\r
+<strong>133:16</strong> (dce_smb) SMB - Byte count less than command data size (STDu64)\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:56</strong> (dce_smb) SMB - client attempted multiple dialect negotiations on session\r
+<strong>133:17</strong> (dce_smb) SMB - Invalid command data size for byte count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:57</strong> (dce_smb) SMB - client attempted to create or set a file’s attributes to readonly/hidden/system\r
+<strong>133:18</strong> (dce_smb) SMB - Excessive Tree Connect requests with pending Tree Connect responses.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:58</strong> (dce_smb) SMB - file offset provided is greater than file size specified\r
+<strong>133:19</strong> (dce_smb) SMB - Excessive Read requests with pending Read responses.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:59</strong> (dce_smb) SMB - next command specified in SMB2 header is beyond payload boundary\r
+<strong>133:20</strong> (dce_smb) SMB - Excessive command chaining.\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_smb.events</strong>: total events\r
+<strong>133:21</strong> (dce_smb) SMB - Multiple chained tree connect requests.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.PDUs</strong>: total connection-oriented PDUs\r
+<strong>133:22</strong> (dce_smb) SMB - Multiple chained tree connect requests.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Binds</strong>: total connection-oriented binds\r
+<strong>133:23</strong> (dce_smb) SMB - Chained/Compounded login followed by logoff.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Bind acks</strong>: total connection-oriented binds acks\r
+<strong>133:24</strong> (dce_smb) SMB - Chained/Compounded tree connect followed by tree disconnect.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Alter contexts</strong>: total connection-oriented alter contexts\r
+<strong>133:25</strong> (dce_smb) SMB - Chained/Compounded open pipe followed by close pipe.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Alter context responses</strong>: total connection-oriented alter context responses\r
+<strong>133:26</strong> (dce_smb) SMB - Invalid share access.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Bind naks</strong>: total connection-oriented bind naks\r
+<strong>133:27</strong> (dce_smb) Connection oriented DCE/RPC - Invalid major version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Requests</strong>: total connection-oriented requests\r
+<strong>133:28</strong> (dce_smb) Connection oriented DCE/RPC - Invalid minor version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Responses</strong>: total connection-oriented responses\r
+<strong>133:29</strong> (dce_smb) Connection-oriented DCE/RPC - Invalid pdu type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Cancels</strong>: total connection-oriented cancels\r
+<strong>133:30</strong> (dce_smb) Connection-oriented DCE/RPC - Fragment length less than header size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Orphaned</strong>: total connection-oriented orphaned\r
+<strong>133:32</strong> (dce_smb) Connection-oriented DCE/RPC - No context items specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Faults</strong>: total connection-oriented faults\r
+<strong>133:33</strong> (dce_smb) Connection-oriented DCE/RPC -No transfer syntaxes specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Auth3s</strong>: total connection-oriented auth3s\r
+<strong>133:34</strong> (dce_smb) Connection-oriented DCE/RPC - Fragment length on non-last fragment less than maximum negotiated fragment transmit size for client.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Shutdowns</strong>: total connection-oriented shutdowns\r
+<strong>133:35</strong> (dce_smb) Connection-oriented DCE/RPC - Fragment length greater than maximum negotiated fragment transmit size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Rejects</strong>: total connection-oriented rejects\r
+<strong>133:36</strong> (dce_smb) Connection-oriented DCE/RPC - Alter Context byte order different from Bind\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.MS RPC/HTTP PDUs</strong>: total connection-oriented MS requests to send RPC over HTTP\r
+<strong>133:37</strong> (dce_smb) Connection-oriented DCE/RPC - Call id of non first/last fragment different from call id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Other requests</strong>: total connection-oriented other requests\r
+<strong>133:38</strong> (dce_smb) Connection-oriented DCE/RPC - Opnum of non first/last fragment different from opnum established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Other responses</strong>: total connection-oriented other responses\r
+<strong>133:39</strong> (dce_smb) Connection-oriented DCE/RPC - Context id of non first/last fragment different from context id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Request fragments</strong>: total connection-oriented request fragments\r
+<strong>133:44</strong> (dce_smb) SMB - Invalid SMB version 1 seen.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Response fragments</strong>: total connection-oriented response fragments\r
+<strong>133:45</strong> (dce_smb) SMB - Invalid SMB version 2 seen.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Client max fragment size</strong>: connection-oriented client maximum fragment size\r
+<strong>133:46</strong> (dce_smb) SMB - Invalid user, tree connect, file binding.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Client min fragment size</strong>: connection-oriented client minimum fragment size\r
+<strong>133:47</strong> (dce_smb) SMB - Excessive command compounding.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Client segs reassembled</strong>: total connection-oriented client segments reassembled\r
+<strong>133:48</strong> (dce_smb) SMB - Zero data count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Client frags reassembled</strong>: total connection-oriented client fragments reassembled\r
+<strong>133:50</strong> (dce_smb) SMB - Maximum number of outstanding requests exceeded.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Server max fragment size</strong>: connection-oriented server maximum fragment size\r
+<strong>133:51</strong> (dce_smb) SMB - Outstanding requests with same MID.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Server min fragment size</strong>: connection-oriented server minimum fragment size\r
+<strong>133:52</strong> (dce_smb) SMB - Deprecated dialect negotiated.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Server segs reassembled</strong>: total connection-oriented server segments reassembled\r
+<strong>133:53</strong> (dce_smb) SMB - Deprecated command used.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Server frags reassembled</strong>: total connection-oriented server fragments reassembled\r
+<strong>133:54</strong> (dce_smb) SMB - Unusual command used.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Sessions</strong>: total smb sessions\r
+<strong>133:55</strong> (dce_smb) SMB - Invalid setup count for command.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Packets</strong>: total smb packets\r
+<strong>133:56</strong> (dce_smb) SMB - Client attempted multiple dialect negotiations on session.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Ignored bytes</strong>: total ignored bytes\r
+<strong>133:57</strong> (dce_smb) SMB - Client attempted to create or set a file’s attributes to readonly/hidden/system.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_smb.Client segs reassembled</strong>: total smb client segments reassembled\r
+<strong>dce_smb.events</strong>: total events\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Server segs reassembled</strong>: total smb server segments reassembled\r
+<strong>dce_smb.aborted sessions</strong>: total aborted sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Max outstanding requests</strong>: total smb maximum outstanding requests\r
+<strong>dce_smb.bad autodetects</strong>: total bad autodetects\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Files processed</strong>: total smb files processed\r
+<strong>dce_smb.PDUs</strong>: total connection-oriented PDUs\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 create</strong>: total number of SMBv2 create packets seen\r
+<strong>dce_smb.Binds</strong>: total connection-oriented binds\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 write</strong>: total number of SMBv2 write packets seen\r
+<strong>dce_smb.Bind acks</strong>: total connection-oriented binds acks\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 read</strong>: total number of SMBv2 read packets seen\r
+<strong>dce_smb.Alter contexts</strong>: total connection-oriented alter contexts\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 set info</strong>: total number of SMBv2 set info packets seen\r
+<strong>dce_smb.Alter context responses</strong>: total connection-oriented alter context responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 tree connect</strong>: total number of SMBv2 tree connect packets seen\r
+<strong>dce_smb.Bind naks</strong>: total connection-oriented bind naks\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 tree disconnect</strong>: total number of SMBv2 tree disconnect packets seen\r
+<strong>dce_smb.Requests</strong>: total connection-oriented requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 close</strong>: total number of SMBv2 close packets seen\r
+<strong>dce_smb.Responses</strong>: total connection-oriented responses\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_dce_tcp">dce_tcp</h3>\r
-<div class="paragraph"><p>What: dce over tcp inspection</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>dce_tcp.disable_defrag</strong> = false: Disable DCE/RPC defragmentation\r
+<strong>dce_smb.Cancels</strong>: total connection-oriented cancels\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>dce_tcp.max_frag_len</strong> = 65535: Maximum fragment size for defragmentation { 1514:65535 }\r
+<strong>dce_smb.Orphaned</strong>: total connection-oriented orphaned\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>dce_tcp.reassemble_threshold</strong> = 0: Minimum bytes received before performing reassembly { 0:65535 }\r
+<strong>dce_smb.Faults</strong>: total connection-oriented faults\r
</p>\r
</li>\r
<li>\r
<p>\r
-enum <strong>dce_tcp.policy</strong> = WinXP: Target based policy to use { Win2000 | WinXP | WinVista | Win2003 | Win2008 | Win7 | Samba | Samba-3.0.37 | Samba-3.0.22 | Samba-3.0.20 }\r
+<strong>dce_smb.Auth3s</strong>: total connection-oriented auth3s\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>133:27</strong> (dce_tcp) connection oriented DCE/RPC - invalid major version\r
+<strong>dce_smb.Shutdowns</strong>: total connection-oriented shutdowns\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:28</strong> (dce_tcp) connection oriented DCE/RPC - invalid minor version\r
+<strong>dce_smb.Rejects</strong>: total connection-oriented rejects\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:29</strong> (dce_tcp) connection-oriented DCE/RPC - invalid PDU type\r
+<strong>dce_smb.MS RPC/HTTP PDUs</strong>: total connection-oriented MS requests to send RPC over HTTP\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:30</strong> (dce_tcp) connection-oriented DCE/RPC - fragment length less than header size\r
+<strong>dce_smb.Other requests</strong>: total connection-oriented other requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:32</strong> (dce_tcp) connection-oriented DCE/RPC - no context items specified\r
+<strong>dce_smb.Other responses</strong>: total connection-oriented other responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:33</strong> (dce_tcp) connection-oriented DCE/RPC -no transfer syntaxes specified\r
+<strong>dce_smb.Request fragments</strong>: total connection-oriented request fragments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:34</strong> (dce_tcp) connection-oriented DCE/RPC - fragment length on non-last fragment less than maximum negotiated fragment transmit size for client\r
+<strong>dce_smb.Response fragments</strong>: total connection-oriented response fragments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:35</strong> (dce_tcp) connection-oriented DCE/RPC - fragment length greater than maximum negotiated fragment transmit size\r
+<strong>dce_smb.Client max fragment size</strong>: connection-oriented client maximum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:36</strong> (dce_tcp) connection-oriented DCE/RPC - alter context byte order different from bind\r
+<strong>dce_smb.Client min fragment size</strong>: connection-oriented client minimum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:37</strong> (dce_tcp) connection-oriented DCE/RPC - call id of non first/last fragment different from call id established for fragmented request\r
+<strong>dce_smb.Client segs reassembled</strong>: total connection-oriented client segments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:38</strong> (dce_tcp) connection-oriented DCE/RPC - opnum of non first/last fragment different from opnum established for fragmented request\r
+<strong>dce_smb.Client frags reassembled</strong>: total connection-oriented client fragments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:39</strong> (dce_tcp) connection-oriented DCE/RPC - context id of non first/last fragment different from context id established for fragmented request\r
+<strong>dce_smb.Server max fragment size</strong>: connection-oriented server maximum fragment size\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_tcp.events</strong>: total events\r
+<strong>dce_smb.Server min fragment size</strong>: connection-oriented server minimum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.PDUs</strong>: total connection-oriented PDUs\r
+<strong>dce_smb.Server segs reassembled</strong>: total connection-oriented server segments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Binds</strong>: total connection-oriented binds\r
+<strong>dce_smb.Server frags reassembled</strong>: total connection-oriented server fragments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Bind acks</strong>: total connection-oriented binds acks\r
+<strong>dce_smb.Sessions</strong>: total smb sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Alter contexts</strong>: total connection-oriented alter contexts\r
+<strong>dce_smb.Packets</strong>: total smb packets\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Alter context responses</strong>: total connection-oriented alter context responses\r
+<strong>dce_smb.Client segs reassembled</strong>: total smb client segments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Bind naks</strong>: total connection-oriented bind naks\r
+<strong>dce_smb.Server segs reassembled</strong>: total smb server segments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Requests</strong>: total connection-oriented requests\r
+<strong>dce_smb.Max outstanding requests</strong>: total smb maximum outstanding requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Responses</strong>: total connection-oriented responses\r
+<strong>dce_smb.Files processed</strong>: total smb files processed\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_dce_tcp">dce_tcp</h3>\r
+<div class="paragraph"><p>What: dce over tcp inspection</p></div>\r
+<div class="paragraph"><p>Type: inspector</p></div>\r
+<div class="paragraph"><p>Configuration:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_tcp.Cancels</strong>: total connection-oriented cancels\r
+bool <strong>dce_tcp.disable_defrag</strong> = false: Disable DCE/RPC defragmentation\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Orphaned</strong>: total connection-oriented orphaned\r
+int <strong>dce_tcp.max_frag_len</strong> = 65535: Maximum fragment size for defragmentation { 1514:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Faults</strong>: total connection-oriented faults\r
+int <strong>dce_tcp.reassemble_threshold</strong> = 0: Minimum bytes received before performing reassembly { 0:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Auth3s</strong>: total connection-oriented auth3s\r
+enum <strong>dce_tcp.policy</strong> = WinXP: Target based policy to use { Win2000 | WinXP | WinVista | Win2003 | Win2008 | Win7 | Samba | Samba-3.0.37 | Samba-3.0.22 | Samba-3.0.20 }\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Rules:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_tcp.Shutdowns</strong>: total connection-oriented shutdowns\r
+<strong>133:27</strong> (dce_tcp) Connection oriented DCE/RPC - Invalid major version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Rejects</strong>: total connection-oriented rejects\r
+<strong>133:28</strong> (dce_tcp) Connection oriented DCE/RPC - Invalid minor version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.MS RPC/HTTP PDUs</strong>: total connection-oriented MS requests to send RPC over HTTP\r
+<strong>133:29</strong> (dce_tcp) Connection-oriented DCE/RPC - Invalid pdu type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Other requests</strong>: total connection-oriented other requests\r
+<strong>133:30</strong> (dce_tcp) Connection-oriented DCE/RPC - Fragment length less than header size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Other responses</strong>: total connection-oriented other responses\r
+<strong>133:32</strong> (dce_tcp) Connection-oriented DCE/RPC - No context items specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Request fragments</strong>: total connection-oriented request fragments\r
+<strong>133:33</strong> (dce_tcp) Connection-oriented DCE/RPC -No transfer syntaxes specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Response fragments</strong>: total connection-oriented response fragments\r
+<strong>133:34</strong> (dce_tcp) Connection-oriented DCE/RPC - Fragment length on non-last fragment less than maximum negotiated fragment transmit size for client.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Client max fragment size</strong>: connection-oriented client maximum fragment size\r
+<strong>133:35</strong> (dce_tcp) Connection-oriented DCE/RPC - Fragment length greater than maximum negotiated fragment transmit size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Client min fragment size</strong>: connection-oriented client minimum fragment size\r
+<strong>133:36</strong> (dce_tcp) Connection-oriented DCE/RPC - Alter Context byte order different from Bind\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Client segs reassembled</strong>: total connection-oriented client segments reassembled\r
+<strong>133:37</strong> (dce_tcp) Connection-oriented DCE/RPC - Call id of non first/last fragment different from call id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Client frags reassembled</strong>: total connection-oriented client fragments reassembled\r
+<strong>133:38</strong> (dce_tcp) Connection-oriented DCE/RPC - Opnum of non first/last fragment different from opnum established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Server max fragment size</strong>: connection-oriented server maximum fragment size\r
+<strong>133:39</strong> (dce_tcp) Connection-oriented DCE/RPC - Context id of non first/last fragment different from context id established for fragmented request.\r
</p>\r
</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Peg counts:</p></div>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_tcp.Server min fragment size</strong>: connection-oriented server minimum fragment size\r
+<strong>dce_tcp.events</strong>: total events\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Server segs reassembled</strong>: total connection-oriented server segments reassembled\r
+<strong>dce_tcp.aborted sessions</strong>: total aborted sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Server frags reassembled</strong>: total connection-oriented server fragments reassembled\r
+<strong>dce_tcp.bad autodetects</strong>: total bad autodetects\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.tcp sessions</strong>: total tcp sessions\r
+<strong>dce_tcp.PDUs</strong>: total connection-oriented PDUs\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.tcp packets</strong>: total tcp packets\r
+<strong>dce_tcp.Binds</strong>: total connection-oriented binds\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_dce_udp">dce_udp</h3>\r
-<div class="paragraph"><p>What: dce over udp inspection</p></div>\r
-<div class="paragraph"><p>Type: inspector</p></div>\r
-<div class="paragraph"><p>Configuration:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>dce_udp.disable_defrag</strong> = false: Disable DCE/RPC defragmentation\r
+<strong>dce_tcp.Bind acks</strong>: total connection-oriented binds acks\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>dce_udp.max_frag_len</strong> = 65535: Maximum fragment size for defragmentation { 1514:65535 }\r
+<strong>dce_tcp.Alter contexts</strong>: total connection-oriented alter contexts\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Rules:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>133:40</strong> (dce_udp) connection-less DCE/RPC - invalid major version\r
+<strong>dce_tcp.Alter context responses</strong>: total connection-oriented alter context responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:41</strong> (dce_udp) connection-less DCE/RPC - invalid PDU type\r
+<strong>dce_tcp.Bind naks</strong>: total connection-oriented bind naks\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:42</strong> (dce_udp) connection-less DCE/RPC - data length less than header size\r
+<strong>dce_tcp.Requests</strong>: total connection-oriented requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:43</strong> (dce_udp) connection-less DCE/RPC - bad sequence number\r
+<strong>dce_tcp.Responses</strong>: total connection-oriented responses\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Peg counts:</p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>dce_udp.events</strong>: total events\r
+<strong>dce_tcp.Cancels</strong>: total connection-oriented cancels\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.udp sessions</strong>: total udp sessions\r
+<strong>dce_tcp.Orphaned</strong>: total connection-oriented orphaned\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.udp packets</strong>: total udp packets\r
+<strong>dce_tcp.Faults</strong>: total connection-oriented faults\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Requests</strong>: total connection-less requests\r
+<strong>dce_tcp.Auth3s</strong>: total connection-oriented auth3s\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Acks</strong>: total connection-less acks\r
+<strong>dce_tcp.Shutdowns</strong>: total connection-oriented shutdowns\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Cancels</strong>: total connection-less cancels\r
+<strong>dce_tcp.Rejects</strong>: total connection-oriented rejects\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Client facks</strong>: total connection-less client facks\r
+<strong>dce_tcp.MS RPC/HTTP PDUs</strong>: total connection-oriented MS requests to send RPC over HTTP\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Ping</strong>: total connection-less ping\r
+<strong>dce_tcp.Other requests</strong>: total connection-oriented other requests\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Responses</strong>: total connection-less responses\r
+<strong>dce_tcp.Other responses</strong>: total connection-oriented other responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Rejects</strong>: total connection-less rejects\r
+<strong>dce_tcp.Request fragments</strong>: total connection-oriented request fragments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Cancel acks</strong>: total connection-less cancel acks\r
+<strong>dce_tcp.Response fragments</strong>: total connection-oriented response fragments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Server facks</strong>: total connection-less server facks\r
+<strong>dce_tcp.Client max fragment size</strong>: connection-oriented client maximum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Faults</strong>: total connection-less faults\r
+<strong>dce_tcp.Client min fragment size</strong>: connection-oriented client minimum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.No calls</strong>: total connection-less no calls\r
+<strong>dce_tcp.Client segs reassembled</strong>: total connection-oriented client segments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Working</strong>: total connection-less working\r
+<strong>dce_tcp.Client frags reassembled</strong>: total connection-oriented client fragments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Other requests</strong>: total connection-less other requests\r
+<strong>dce_tcp.Server max fragment size</strong>: connection-oriented server maximum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Other responses</strong>: total connection-less other responses\r
+<strong>dce_tcp.Server min fragment size</strong>: connection-oriented server minimum fragment size\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Fragments</strong>: total connection-less fragments\r
+<strong>dce_tcp.Server segs reassembled</strong>: total connection-oriented server segments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Max fragment size</strong>: connection-less maximum fragment size\r
+<strong>dce_tcp.Server frags reassembled</strong>: total connection-oriented server fragments reassembled\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Frags reassembled</strong>: total connection-less fragments reassembled\r
+<strong>dce_tcp.tcp sessions</strong>: total tcp sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Max seqnum</strong>: max connection-less seqnum\r
+<strong>dce_tcp.tcp packets</strong>: total tcp packets\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>145:1</strong> (dnp3) DNP3 link-layer frame contains bad CRC\r
+<strong>145:1</strong> (dnp3) DNP3 Link-Layer Frame contains bad CRC.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:2</strong> (dnp3) DNP3 link-layer frame was dropped\r
+<strong>145:2</strong> (dnp3) DNP3 Link-Layer Frame was dropped.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:3</strong> (dnp3) DNP3 transport-layer segment was dropped during reassembly\r
+<strong>145:3</strong> (dnp3) DNP3 Transport-Layer Segment was dropped during reassembly.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:4</strong> (dnp3) DNP3 reassembly buffer was cleared without reassembling a complete message\r
+<strong>145:4</strong> (dnp3) DNP3 Reassembly Buffer was cleared without reassembling a complete message.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:5</strong> (dnp3) DNP3 link-layer frame uses a reserved address\r
+<strong>145:5</strong> (dnp3) DNP3 Link-Layer Frame uses a reserved address.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:6</strong> (dnp3) DNP3 application-layer fragment uses a reserved function code\r
+<strong>145:6</strong> (dnp3) DNP3 Application-Layer Fragment uses a reserved function code.\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>131:1</strong> (dns) obsolete DNS RR types\r
+<strong>131:1</strong> (dns) Obsolete DNS RR Types\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>131:2</strong> (dns) experimental DNS RR types\r
+<strong>131:2</strong> (dns) Experimental DNS RR Types\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>131:3</strong> (dns) DNS client rdata txt overflow\r
+<strong>131:3</strong> (dns) DNS Client rdata txt Overflow\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.data_rest_cmds</strong>: check the formatting of the given commands\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
string <strong>ftp_server.data_xfer_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>http_inspect.normalize_utf</strong> = true: normalize charset utf encodings in response bodies\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>http_inspect.normalize_javascript</strong> = false: normalize javascript in response bodies\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>http_inspect.max_javascript_whitespaces</strong> = 200: maximum consecutive whitespaces allowed within the Javascript obfuscated data { 1:65535 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
bit_list <strong>http_inspect.bad_characters</strong>: alert when any of specified bytes are present in URI after percent decoding { 255 }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:52</strong> (http_inspect) not HTTP traffic\r
+<strong>119:52</strong> (http_inspect) Not HTTP traffic\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:53</strong> (http_inspect) chunk length has excessive leading zeros\r
+<strong>119:53</strong> (http_inspect) Chunk length has excessive leading zeros\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:54</strong> (http_inspect) white space before or between messages\r
+<strong>119:54</strong> (http_inspect) White space before or between messages\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:55</strong> (http_inspect) request message without URI\r
+<strong>119:55</strong> (http_inspect) Request message without URI\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:56</strong> (http_inspect) control character in reason phrase\r
+<strong>119:56</strong> (http_inspect) Control character in reason phrase\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:57</strong> (http_inspect) illegal extra whitespace in start line\r
+<strong>119:57</strong> (http_inspect) Illegal extra whitespace in start line\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:58</strong> (http_inspect) corrupted HTTP version\r
+<strong>119:58</strong> (http_inspect) Corrupted HTTP version\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:59</strong> (http_inspect) unknown HTTP version\r
+<strong>119:59</strong> (http_inspect) Unknown HTTP version\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:60</strong> (http_inspect) format error in HTTP header\r
+<strong>119:60</strong> (http_inspect) Format error in HTTP header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:61</strong> (http_inspect) chunk header options present\r
+<strong>119:61</strong> (http_inspect) Chunk header options present\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:63</strong> (http_inspect) unrecognized type of percent encoding in URI\r
+<strong>119:63</strong> (http_inspect) Unrecognized type of percent encoding in URI\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:65</strong> (http_inspect) white space following chunk length\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:66</strong> (http_inspect) white space within header name\r
+<strong>119:65</strong> (http_inspect) White space following chunk length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:67</strong> (http_inspect) excessive gzip compression\r
+<strong>119:67</strong> (http_inspect) Excessive gzip compression\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:68</strong> (http_inspect) gzip decompression failed\r
+<strong>119:68</strong> (http_inspect) Gzip decompression failed\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:71</strong> (http_inspect) message has both Content-Length and Transfer-Encoding\r
+<strong>119:71</strong> (http_inspect) Message has both Content-Length and Transfer-Encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:72</strong> (http_inspect) status code implying no body combined with Transfer-Encoding or nonzero Content-Length\r
+<strong>119:72</strong> (http_inspect) Status code implying no body combined with Transfer-Encoding or nonzero Content-Length\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:75</strong> (http_inspect) misformatted HTTP traffic\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:76</strong> (http_inspect) unsupported Transfer-Encoding or Content-Encoding used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:77</strong> (http_inspect) unknown Transfer-Encoding or Content-Encoding used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:78</strong> (http_inspect) multiple layers of compression encodings applied\r
+<strong>119:75</strong> (http_inspect) Misformatted HTTP traffic\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>imap.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
+int <strong>imap.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.bitenc_decode_depth</strong> = 1460: non-Encoded MIME attachment extraction depth { -1:65535 }\r
+int <strong>imap.bitenc_decode_depth</strong> = 1460: Non-Encoded MIME attachment extraction depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.qp_decode_depth</strong> = 1460: quoted Printable decoding depth { -1:65535 }\r
+int <strong>imap.qp_decode_depth</strong> = 1460: Quoted Printable decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
+int <strong>imap.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>141:1</strong> (imap) unknown IMAP3 command\r
+<strong>141:1</strong> (imap) Unknown IMAP3 command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:2</strong> (imap) unknown IMAP3 response\r
+<strong>141:2</strong> (imap) Unknown IMAP3 response\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:4</strong> (imap) base64 decoding failed\r
+<strong>141:4</strong> (imap) Base64 Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:5</strong> (imap) quoted-printable decoding failed\r
+<strong>141:5</strong> (imap) Quoted-Printable Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:7</strong> (imap) Unix-to-Unix decoding failed\r
+<strong>141:7</strong> (imap) Unix-to-Unix Decoding failed.\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>144:3</strong> (modbus) reserved Modbus function code in use\r
+<strong>144:3</strong> (modbus) Reserved Modbus function code in use\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-int <strong>perf_monitor.flow_ip_memcap</strong> = 52428800: maximum memory in bytes for flow tracking { 8200: }\r
+int <strong>perf_monitor.flow_ip_memcap</strong> = 52428800: maximum memory for flow tracking { 8200: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>perf_monitor.output</strong> = file: output location for stats { file | console }\r
+enum <strong>perf_monitor.output</strong> = file: Output location for stats { file | console }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>perf_monitor.format</strong> = csv: output format for stats { csv | text }\r
+enum <strong>perf_monitor.format</strong> = csv: Output format for stats { csv | text }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>perf_monitor.summary</strong> = false: output summary at shutdown\r
+bool <strong>perf_monitor.summary</strong> = false: Output summary at shutdown\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>142:1</strong> (pop) unknown POP3 command\r
+<strong>142:1</strong> (pop) Unknown POP3 command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:2</strong> (pop) unknown POP3 response\r
+<strong>142:2</strong> (pop) Unknown POP3 response\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:4</strong> (pop) base64 decoding failed\r
+<strong>142:4</strong> (pop) Base64 Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:5</strong> (pop) quoted-printable decoding failed\r
+<strong>142:5</strong> (pop) Quoted-Printable Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:7</strong> (pop) Unix-to-Unix decoding failed\r
+<strong>142:7</strong> (pop) Unix-to-Unix Decoding failed.\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>port_scan_global.memcap</strong> = 1048576: maximum tracker memory in bytes { 1: }\r
+int <strong>port_scan_global.memcap</strong> = 1048576: maximum tracker memory { 1: }\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-int <strong>reputation.memcap</strong> = 500: maximum total MB of memory allocated { 1:4095 }\r
+int <strong>reputation.memcap</strong> = 500: maximum total memory allocated { 1:4095 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>136:2</strong> (reputation) packets whitelisted\r
+<strong>136:2</strong> (reputation) Packets whitelisted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>136:3</strong> (reputation) packets monitored\r
+<strong>136:3</strong> (reputation) Packets monitored\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>reputation.memory allocated</strong>: total memory allocated\r
+<strong>reputation.memory_allocated</strong>: total memory allocated\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>140:1</strong> (sip) maximum sessions reached\r
+<strong>140:1</strong> (sip) Maximum sessions reached\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:2</strong> (sip) empty request URI\r
+<strong>140:2</strong> (sip) Empty request URI\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:4</strong> (sip) empty call-Id\r
+<strong>140:4</strong> (sip) Empty call-Id\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:7</strong> (sip) request name in CSeq is too long\r
+<strong>140:7</strong> (sip) Request name in CSeq is too long\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:8</strong> (sip) empty From header\r
+<strong>140:8</strong> (sip) Empty From header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:10</strong> (sip) empty To header\r
+<strong>140:10</strong> (sip) Empty To header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:12</strong> (sip) empty Via header\r
+<strong>140:12</strong> (sip) Empty Via header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:14</strong> (sip) empty Contact\r
+<strong>140:14</strong> (sip) Empty Contact\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:15</strong> (sip) contact is too long\r
+<strong>140:15</strong> (sip) Contact is too long\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:16</strong> (sip) content length is too large or negative\r
+<strong>140:16</strong> (sip) Content length is too large or negative\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:17</strong> (sip) multiple SIP messages in a packet\r
+<strong>140:17</strong> (sip) Multiple SIP messages in a packet\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:18</strong> (sip) content length mismatch\r
+<strong>140:18</strong> (sip) Content length mismatch\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:19</strong> (sip) request name is invalid\r
+<strong>140:19</strong> (sip) Request name is invalid\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:21</strong> (sip) illegal session information modification\r
+<strong>140:21</strong> (sip) Illegal session information modification\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:22</strong> (sip) response status code is not a 3 digit number\r
+<strong>140:22</strong> (sip) Response status code is not a 3 digit number\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:23</strong> (sip) empty Content-type header\r
+<strong>140:23</strong> (sip) Empty Content-type header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:25</strong> (sip) mismatch in METHOD of request and the CSEQ header\r
+<strong>140:25</strong> (sip) Mismatch in METHOD of request and the CSEQ header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:26</strong> (sip) method is unknown\r
+<strong>140:26</strong> (sip) Method is unknown\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:27</strong> (sip) maximum dialogs within a session reached\r
+<strong>140:27</strong> (sip) Maximum dialogs within a session reached\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>124:1</strong> (smtp) attempted command buffer overflow\r
+<strong>124:1</strong> (smtp) Attempted command buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:2</strong> (smtp) attempted data header buffer overflow\r
+<strong>124:2</strong> (smtp) Attempted data header buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:3</strong> (smtp) attempted response buffer overflow\r
+<strong>124:3</strong> (smtp) Attempted response buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:4</strong> (smtp) attempted specific command buffer overflow\r
+<strong>124:4</strong> (smtp) Attempted specific command buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:5</strong> (smtp) unknown command\r
+<strong>124:5</strong> (smtp) Unknown command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:6</strong> (smtp) illegal command\r
+<strong>124:6</strong> (smtp) Illegal command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:7</strong> (smtp) attempted header name buffer overflow\r
+<strong>124:7</strong> (smtp) Attempted header name buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:8</strong> (smtp) attempted X-Link2State command buffer overflow\r
+<strong>124:8</strong> (smtp) Attempted X-Link2State command buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:10</strong> (smtp) base64 decoding failed\r
+<strong>124:10</strong> (smtp) Base64 Decoding failed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:11</strong> (smtp) quoted-printable decoding failed\r
+<strong>124:11</strong> (smtp) Quoted-Printable Decoding failed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:13</strong> (smtp) Unix-to-Unix decoding failed\r
+<strong>124:13</strong> (smtp) Unix-to-Unix Decoding failed\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>124:15</strong> (smtp) attempted authentication command buffer overflow\r
+<strong>124:15</strong> (smtp) Attempted authentication command buffer overflow\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>128:1</strong> (ssh) challenge-response overflow exploit\r
+<strong>128:1</strong> (ssh) Challenge-Response Overflow exploit\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>128:3</strong> (ssh) server version string overflow\r
+<strong>128:3</strong> (ssh) Server version string overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>128:5</strong> (ssh) bad message direction\r
+<strong>128:5</strong> (ssh) Bad message direction\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>128:6</strong> (ssh) payload size incorrect for the given payload\r
+<strong>128:6</strong> (ssh) Payload size incorrect for the given payload\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>128:7</strong> (ssh) failed to detect SSH version string\r
+<strong>128:7</strong> (ssh) Failed to detect SSH version string\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>137:1</strong> (ssl) invalid client HELLO after server HELLO detected\r
+<strong>137:1</strong> (ssl) Invalid Client HELLO after Server HELLO Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:2</strong> (ssl) invalid server HELLO without client HELLO detected\r
+<strong>137:2</strong> (ssl) Invalid Server HELLO without Client HELLO Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:3</strong> (ssl) heartbeat read overrun attempt detected\r
+<strong>137:3</strong> (ssl) Heartbeat Read Overrun Attempt Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:4</strong> (ssl) large heartbeat response detected\r
+<strong>137:4</strong> (ssl) Large Heartbeat Response Detected\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-bool <strong>stream.ip_frags_only</strong> = false: don’t process non-frag flows\r
+int <strong>stream.ip_cache.max_sessions</strong> = 16384: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.max_sessions</strong> = 16384: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.ip_cache.pruning_timeout</strong> = 30: minimum inactive time before being eligible for pruning { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.pruning_timeout</strong> = 30: minimum inactive time before being eligible for pruning { 1: }\r
+int <strong>stream.ip_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
+int <strong>stream.ip_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.icmp_cache.max_sessions</strong> = 65536: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.icmp_cache.max_sessions</strong> = 32768: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.tcp_cache.max_sessions</strong> = 262144: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.icmp_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>stream.tcp_cache.max_sessions</strong> = 131072: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.udp_cache.max_sessions</strong> = 131072: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.tcp_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+int <strong>stream.udp_cache.max_sessions</strong> = 65536: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.udp_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.user_cache.max_sessions</strong> = 1024: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.user_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.file_cache.max_sessions</strong> = 128: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
int <strong>stream.file_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
+<li>\r
+<p>\r
+int <strong>stream.file_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
</ul></div>\r
<div class="paragraph"><p>Peg counts:</p></div>\r
<div class="ulist"><ul>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.ip idle prunes</strong>: ip sessions pruned due to timeout\r
+<strong>stream.ip timeout prunes</strong>: ip sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.ip ha prunes</strong>: ip sessions pruned by high availability sync\r
+<strong>stream.ip user prunes</strong>: ip sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.icmp idle prunes</strong>: icmp sessions pruned due to timeout\r
+<strong>stream.icmp timeout prunes</strong>: icmp sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.icmp ha prunes</strong>: icmp sessions pruned by high availability sync\r
+<strong>stream.icmp user prunes</strong>: icmp sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.tcp idle prunes</strong>: tcp sessions pruned due to timeout\r
+<strong>stream.tcp timeout prunes</strong>: tcp sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.tcp ha prunes</strong>: tcp sessions pruned by high availability sync\r
+<strong>stream.tcp user prunes</strong>: tcp sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.udp idle prunes</strong>: udp sessions pruned due to timeout\r
+<strong>stream.udp timeout prunes</strong>: udp sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.udp ha prunes</strong>: udp sessions pruned by high availability sync\r
+<strong>stream.udp user prunes</strong>: udp sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user idle prunes</strong>: user sessions pruned due to timeout\r
+<strong>stream.user timeout prunes</strong>: user sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user ha prunes</strong>: user sessions pruned by high availability sync\r
+<strong>stream.user user prunes</strong>: user sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file idle prunes</strong>: file sessions pruned due to timeout\r
+<strong>stream.file timeout prunes</strong>: file sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file ha prunes</strong>: file sessions pruned by high availability sync\r
+<strong>stream.file user prunes</strong>: file sessions pruned for other reasons\r
</p>\r
</li>\r
</ul></div>\r
int <strong>stream_ip.session_timeout</strong> = 30: session tracking timeout { 1:86400 }\r
</p>\r
</li>\r
-<li>\r
-<p>\r
-int <strong>stream_ip.trace</strong>: mask for enabling debug traces in module\r
-</p>\r
-</li>\r
</ul></div>\r
<div class="paragraph"><p>Rules:</p></div>\r
<div class="ulist"><ul>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_ip.total frags</strong>: total fragments\r
+<strong>stream_ip.total</strong>: total fragments\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_ip.current frags</strong>: current fragments\r
+<strong>stream_ip.current</strong>: current fragments\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:5</strong> (stream_tcp) bad segment, adjusted size ⇐ 0 (deprecated)\r
+<strong>129:5</strong> (stream_tcp) bad segment, adjusted size ⇐ 0\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:8</strong> (stream_tcp) data sent on stream after TCP reset sent\r
+<strong>129:8</strong> (stream_tcp) data sent on stream after TCP Reset sent\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:10</strong> (stream_tcp) TCP server possibly hijacked, different ethernet address\r
+<strong>129:10</strong> (stream_tcp) TCP Server possibly hijacked, different ethernet address\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:18</strong> (stream_tcp) data sent on stream after TCP reset received\r
+<strong>129:18</strong> (stream_tcp) data sent on stream after TCP Reset received\r
</p>\r
</li>\r
<li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_wizard_2">wizard</h3>\r
+<h3 id="_wizard">wizard</h3>\r
<div class="paragraph"><p>What: inspector that implements port-independent protocol identification</p></div>\r
<div class="paragraph"><p>Type: inspector</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
string <strong>wizard.spells[].to_client[].spell</strong>: sequence of data with wild cards (*)\r
</p>\r
</li>\r
-<li>\r
-<p>\r
-multi <strong>wizard.curses</strong>: enable service identification based on internal algorithm { dce_smb | dce_udp | dce_tcp }\r
-</p>\r
-</li>\r
</ul></div>\r
<div class="paragraph"><p>Peg counts:</p></div>\r
<div class="ulist"><ul>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-string <strong>appids.~</strong>: comma separated list of application names\r
+string <strong>appids.~</strong>: appid option\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>asn1.bitstring_overflow</strong>: detects invalid bitstring encodings that are known to be remotely exploitable\r
+implied <strong>asn1.bitstring_overflow</strong>: Detects invalid bitstring encodings that are known to be remotely exploitable.\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>asn1.double_overflow</strong>: detects a double ASCII encoding that is larger than a standard buffer\r
+implied <strong>asn1.double_overflow</strong>: Detects a double ASCII encoding that is larger than a standard buffer.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>asn1.oversize_length</strong>: compares ASN.1 type lengths with the supplied argument { 0: }\r
+int <strong>asn1.oversize_length</strong>: Compares ASN.1 type lengths with the supplied argument. { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>asn1.absolute_offset</strong>: absolute offset from the beginning of the packet { 0: }\r
+int <strong>asn1.absolute_offset</strong>: Absolute offset from the beginning of the packet. { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>asn1.relative_offset</strong>: relative offset from the cursor\r
+int <strong>asn1.relative_offset</strong>: relative offset from the cursor.\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>base64_decode.bytes</strong>: number of base64 encoded bytes to decode { 1: }\r
+int <strong>base64_decode.bytes</strong>: Number of base64 encoded bytes to decode. { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>base64_decode.offset</strong> = 0: bytes past start of buffer to start decoding { 0: }\r
+int <strong>base64_decode.offset</strong> = 0: Bytes past start of buffer to start decoding. { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>base64_decode.relative</strong>: apply offset to cursor instead of start of buffer\r
+implied <strong>base64_decode.relative</strong>: Apply offset to cursor instead of start of buffer.\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_dce_iface_2">dce_iface</h3>\r
+<h3 id="_dce_iface">dce_iface</h3>\r
<div class="paragraph"><p>What: detection option to check dcerpc interface</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_dce_opnum_2">dce_opnum</h3>\r
+<h3 id="_dce_opnum">dce_opnum</h3>\r
<div class="paragraph"><p>What: detection option to check dcerpc operation number</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
<div class="paragraph"><p>Configuration:</p></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_dce_stub_data_2">dce_stub_data</h3>\r
+<h3 id="_dce_stub_data">dce_stub_data</h3>\r
<div class="paragraph"><p>What: sets the cursor to dcerpc stub data</p></div>\r
<div class="paragraph"><p>Type: ips_option</p></div>\r
</div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_cookie.request</strong>: match against the cookie from the request message even when examining the response\r
+implied <strong>http_cookie.request</strong>: Match against the cookie from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_cookie.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_cookie.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_cookie.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_cookie.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-string <strong>http_header.field</strong>: restrict to given header. Header name is case insensitive.\r
+string <strong>http_header.field</strong>: Restrict to given header. Header name is case insensitive.\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_header.request</strong>: match against the headers from the request message even when examining the response\r
+implied <strong>http_header.request</strong>: Match against the headers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_header.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_header.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_header.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_header.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_method.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_method.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_method.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_method.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_raw_cookie.request</strong>: match against the cookie from the request message even when examining the response\r
+implied <strong>http_raw_cookie.request</strong>: Match against the cookie from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_cookie.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_cookie.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_cookie.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_cookie.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_raw_header.request</strong>: match against the headers from the request message even when examining the response\r
+implied <strong>http_raw_header.request</strong>: Match against the headers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_header.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_header.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_header.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_header.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_raw_request.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_request.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_request.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_request.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_raw_status.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_status.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_status.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_status.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_raw_trailer.request</strong>: match against the trailers from the request message even when examining the response\r
+implied <strong>http_raw_trailer.request</strong>: Match against the trailers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_trailer.with_header</strong>: parts of this rule examine HTTP response message headers (must be combined with request)\r
+implied <strong>http_raw_trailer.with_header</strong>: Parts of this rule examine HTTP response message headers (must be combined with request)\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_trailer.with_body</strong>: parts of this rule examine HTTP response message body (must be combined with request)\r
+implied <strong>http_raw_trailer.with_body</strong>: Parts of this rule examine HTTP response message body (must be combined with request)\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_raw_uri.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_uri.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_uri.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_uri.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_stat_code.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_stat_code.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_stat_code.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_stat_code.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_stat_msg.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_stat_msg.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_stat_msg.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_stat_msg.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_trailer.request</strong>: match against the trailers from the request message even when examining the response\r
+implied <strong>http_trailer.request</strong>: Match against the trailers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_trailer.with_header</strong>: parts of this rule examine HTTP response message headers (must be combined with request)\r
+implied <strong>http_trailer.with_header</strong>: Parts of this rule examine HTTP response message headers (must be combined with request)\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_trailer.with_body</strong>: parts of this rule examine HTTP message body (must be combined with request)\r
+implied <strong>http_trailer.with_body</strong>: Parts of this rule examine HTTP message body (must be combined with request)\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_uri.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_uri.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_uri.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_uri.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-implied <strong>http_version.request</strong>: match against the version from the request message even when examining the response\r
+implied <strong>http_version.request</strong>: Match against the version from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_version.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_version.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_version.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_version.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
</ul></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-int <strong>rpc.~app</strong>: application number\r
+string <strong>rpc.~app</strong>: application number\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>rpc.ver</strong>: version number or * for any\r
+string <strong>rpc.~ver</strong>: version number or * for any\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>rpc.proc</strong>: procedure number or * for any\r
+string <strong>rpc.~proc</strong>: procedure number or * for any\r
</p>\r
</li>\r
</ul></div>\r
applications and the modular nature allows you to build new modules for\r
other platforms.</p></div>\r
<div class="paragraph"><p>The DAQ library is provided as an external package on snort.org. There are\r
-a few additional modules provided with Snort 3. This section summarizes\r
+a few additional modules provided with Snort++. This section summarizes\r
the important things you need to know to use these DAQ modules. There are\r
also 3rd DAQ modules available.</p></div>\r
<div class="sect2">\r
<div class="sect2">\r
<h3 id="_dump_module">Dump Module</h3>\r
<div class="paragraph"><p>The dump DAQ allows you to test the various inline mode features available in\r
-Snort like injection and normalization.</p></div>\r
+2.9 Snort like injection and normalization.</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>./snort -i <device> --daq dump\r
<h3 id="_socket_module">Socket Module</h3>\r
<div class="paragraph"><p>The socket module provides provides a stream socket server that will accept\r
up to 2 simultaneous connections and bridge them together while also\r
-passing data to Snort for inspection. The first connection accepted is\r
+passing data to Snort++ for inspection. The first connection accepted is\r
considered the client and the second connection accepted is considered the\r
server. If there is only one connection, stream data can’t be forwarded\r
but it is still inspected.</p></div>\r
<div class="paragraph"><p>Each read from a socket of up to snaplen bytes is passed as a packet to\r
-Snort along with a DAQ_SktHdr_t pointer in DAQ_PktHdr_t→priv_ptr.\r
+Snort++ along with a DAQ_SktHdr_t pointer in DAQ_PktHdr_t→priv_ptr.\r
DAQ_SktHdr_t conveys IP4 address, ports, protocol, and direction. Socket\r
packets can be configured to be TCP or UDP. The socket DAQ can be operated\r
in inline mode and is able to block packets.</p></div>\r
-<div class="paragraph"><p>The socket DAQ uses DLT_SOCKET and requires that Snort load the socket\r
+<div class="paragraph"><p>The socket DAQ uses DLT_SOCKET and requires that Snort++ load the socket\r
codec which is included in the extra package.</p></div>\r
-<div class="paragraph"><p>To use the socket DAQ, start Snort like this:</p></div>\r
+<div class="paragraph"><p>To use the socket DAQ, start Snort++ like this:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>./snort --plugin-path /path/to/lib/snort_extra \\r
</li>\r
<li>\r
<p>\r
-This module is only supported by Snort 3. It is not compatible with\r
- Snort 2.\r
+This module is only supported by Snort++. It is not compatible with\r
+ Snort.\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-This module is only supported by Snort 3. It is not compatible with\r
- Snort 2.\r
+This module is only supported by Snort++. It is not compatible with\r
+ Snort.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-This module is only supported by Snort 3. It is not compatible with\r
- Snort 2.\r
+This module is only supported by Snort++. It is not compatible with\r
+ Snort.\r
</p>\r
</li>\r
<li>\r
</div>\r
</div>\r
<div class="sect1">\r
-<h2 id="_snort_3_vs_snort_2">Snort 3 vs Snort 2</h2>\r
+<h2 id="_snort_vs_snort">Snort++ vs Snort</h2>\r
<div class="sectionbody">\r
-<div class="paragraph"><p>Snort 3 differs from Snort 2 in the following ways:</p></div>\r
+<div class="paragraph"><p>Snort++ differs from Snort in the following ways:</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-all Snort 2 config options are grouped into Snort 3 modules\r
+all Snort config options are grouped into Snort++ modules\r
</p>\r
</li>\r
</ul></div>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_command_line_2">Command Line</h3>\r
+<h3 id="_command_line">Command Line</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-added -L none|dump|pcap\r
+added -K text; -K text/pcap is old dump/log mode\r
</p>\r
</li>\r
<li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Snort 3 has a default unicode.map\r
+Snort++ has a default unicode.map\r
</p>\r
</li>\r
<li>\r
<p>\r
-Snort 3 will not enforce an upper bound on memcaps and the like within 64 bits\r
+Snort++ will not enforce an upper bound on memcaps and the like within 64 bits\r
</p>\r
</li>\r
<li>\r
<p>\r
-Snort 3 will supply a default *_global config if not specified\r
- (Snort 2 would fatal; e.g. http_inspect_server w/o http_inspect_global)\r
+Snort++ will supply a default *_global config if not specified\r
+ (Snort would fatal; e.g. http_inspect_server w/o http_inspect_global)\r
</p>\r
</li>\r
<li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_rules_3">Rules</h3>\r
+<h3 id="_rules_2">Rules</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_output_3">Output</h3>\r
+<h3 id="_output_2">Output</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-changed default logging mode to -L none\r
+changed default logging mode to -K none\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-Snort 3 queues decoder and inspector events to the main event queue before ips policy\r
+Snort++ queues decoder and inspector events to the main event queue before ips policy\r
is selected; since some events may not be enabled, the queue needs to be sized larger\r
- than with Snort 2 which used an intermediate queue for decoder events.\r
+ than with Snort which used an intermediate queue for decoder events.\r
</p>\r
</li>\r
<li>\r
<div class="sect2">\r
<h3 id="_http_profiles">HTTP Profiles</h3>\r
<div class="paragraph"><p>This section describes the changes to the Http Inspect config option "profile".</p></div>\r
-<div class="paragraph"><p>Snort 2 allows users to select pre-defined HTTP server profiles using the\r
+<div class="paragraph"><p>Snort 2.X allows users to select pre-defined HTTP server profiles using the\r
config option "profile". The user can choose one of five predefined profiles.\r
When defined, this option will set defaults for other config options within\r
Http Inspect.</p></div>\r
-<div class="paragraph"><p>With Snort 3, the user has the flexibility of defining and fine tuning custom\r
+<div class="paragraph"><p>With Snort++, the user has the flexibility of defining and fine tuning custom\r
profiles along with the five predefined profiles.</p></div>\r
-<div class="paragraph"><p>Snort 2 conf</p></div>\r
+<div class="paragraph"><p>Snort 2.X conf</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>preprocessor http_inspect_server: server default \\r
profile apache ports { 80 3128 } max_headers 200</code></pre>\r
</div></div>\r
-<div class="paragraph"><p>Snort 3 conf</p></div>\r
+<div class="paragraph"><p>Snort 3.0 conf</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>http_inspect = { profile = http_profile_apache }\r
</tr></table>\r
</div>\r
<div class="paragraph"><p>Conversion</p></div>\r
-<div class="paragraph"><p>snort2lua can convert the existing snort.conf with the "profile" option to\r
-Snort 3 compatible "profile". Please refer to the snort2Lua post for more\r
+<div class="paragraph"><p>Snort2lua can convert the existing snort.conf with the "profile" option to\r
+Snort3.0 compatible "profile". Please refer to the Snort2Lua post for more\r
details.</p></div>\r
<div class="paragraph"><p>Examples</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>snort --help-config http_inspect | grep http_inspect.profile</code></pre>\r
</div></div>\r
+<div class="paragraph"><p>The new Http Inspect (new_http_inspect) implementation of config options is\r
+still under development.</p></div>\r
</div>\r
</div>\r
</div>\r
<div class="sect1">\r
-<h2 id="_snort2lua">Snort2Lua</h2>\r
+<h2 id="_snort2lua_2">Snort2Lua</h2>\r
<div class="sectionbody">\r
-<div class="paragraph"><p>One of the major differences between Snort 2 and Snort 3 is the\r
-configuration. Snort 2 configuration files are written in Snort-specific\r
-syntax while Snort 3 configuration files are written in Lua. Snort2Lua is\r
-a program specifically designed to convert Snort 2 configuration files\r
-into Lua files that Snort 3 can understand.</p></div>\r
-<div class="paragraph"><p>Snort2Lua reads your legacy Snort conf file(s) and generates Snort 3 Lua\r
+<div class="paragraph"><p>One of the major differences between Snort 2.9.X and Snort 3.0 is the\r
+configuration. Snort 2.9.X configuration files are written in Snort-specific\r
+syntax while Snort 3.0 configuration files are written in Lua. Snort2Lua is a\r
+program specifically designed to convert Snort 2.9.X configuration files into\r
+Lua files that Snort 3.0 can understand.</p></div>\r
+<div class="paragraph"><p>Snort2Lua reads your legacy Snort conf file(s) and generates Snort++ Lua\r
and rules files. When running this program, the only mandatory option is\r
-to provide Snort2Lua with a Snort 2 configuration file. The default\r
-output file file is snort.lua, the default error file will be snort.rej,\r
-and the default rule file is the output file (default is snort.lua). When\r
+to provide Snort2Lua with a Snort configuration file. The default output\r
+file file is snort.lua, the default error file will be snort.rej, and the\r
+default rule file is the output file (default is snort.lua). When\r
Snort2Lua finishes running, the resulting configuration file can be\r
successfully run as the Snort3.0 configuration file. The sole exception to\r
this rule is when Snort2Lua cannot find an included file. If that occurs,\r
bad. For instance, Snort2Lua will only convert preprocessors that are\r
currently supported. Therefore, any unsupported preprocessors or\r
configuration options including DCERP, SIP, and SMTP, will cause an error\r
-in Snort2Lua since Snort 3 does not support those preprocessors.\r
+in Snort2Lua since Snort3.0 does not support those preprocessors.\r
Additionally, any rule options associated with those preprocessors are also\r
-not supported. Finally, Snort2Lua expects a valid Snort 2 configuration.\r
+not supported. Finally, Snort2Lua expects a valid Snort configuration.\r
Therefore, if the configuration is invalid or has questionable syntax,\r
Snort2Lua may fail to parse the configuration file or create an invalid\r
-Snort 3 configuration file.</p></div>\r
+Snort3.0 configuration file.</p></div>\r
<div class="paragraph"><p>There are a also few peculiarities of Snort2Lua that may be confusing to a\r
first time user. Specifically, aside from an initial configuration file\r
(which is specified from the command line or as the file in ‘config\r
-binding’), every file that is included into Snort 3 must be either a Lua\r
+binding’), every file that is included into Snort3.0 must be either a Lua\r
file or a rule file; the file cannot contain both rules and Lua syntax.\r
Therefore, when parsing a file specified with the ‘include’ command,\r
Snort2Lua will output both a Lua file and a rule file. Additionally, any\r
configuration into a single rule file. Similarly, there is an option\r
pull all of the Lua syntax from every ‘include’ file into the output file.</p></div>\r
<div class="paragraph"><p>There are currently three output modes: default, quiet, and differences.\r
-As expected, quiet mode produces a Snort configuration. All errors (aside\r
-from Fatal Snort2Lua errors), differences, and comments will omitted from\r
-the final output file. Default mode will print everything. That mean you\r
-will be able to see exactly what changes have occurred between Snort 2\r
-and Snort 3 in addition to the new syntax, the original file’s comments,\r
-and all errors that have occurred. Finally, differences mode will not\r
-actually output a valid Snort 3 configuration. Instead, you can see the\r
-exact options from the input configuration that have changed.</p></div>\r
+As expected, quiet mode produces a Snort++ configuration. All errors\r
+(aside from Fatal Snort2Lua errors), differences, and comments will omitted\r
+from the final output file. Default mode will print everything. That mean\r
+you will be able to see exactly what changes have occurred between Snort and\r
+Snort++ in addition to the new syntax, the original file’s comments, and\r
+all errors that have occurred. Finally, differences mode will not actually\r
+output a valid Snort3.0 configuration. Instead, you can see the exact\r
+options from the input configuration that have changed.</p></div>\r
<div class="sect3">\r
<h4 id="_usage_snort2lua_options_8230_c_lt_snort_conf_gt_8230">Usage: snort2lua [OPTIONS]… -c <snort_conf> …</h4>\r
<div class="paragraph"><p>Converts the Snort configuration file specified by the -c or --conf-file\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Any Snort 2 ‘string’ which is dependent on a variable will no longer have\r
+Any Snort ‘string’ which is dependent on a variable will no longer have\r
that variable in the Lua string.\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_usage_2">Usage</h3>\r
-<div class="paragraph"><p>Snort2Lua is included in the Snort 3 distribution. The Snort2Lua source code\r
+<h3 id="_usage">Usage</h3>\r
+<div class="paragraph"><p>Snort2Lua is included in the Snort 3.0 distribution. The Snort2Lua source code\r
is located in the tools/snort2lua directory. The program is automatically built\r
and installed.</p></div>\r
<div class="paragraph"><p>Translating your configuration</p></div>\r
-<div class="paragraph"><p>To run Snort2Lua, the only requirement is a file containing Snort 2 syntax.\r
+<div class="paragraph"><p>To run Snort2Lua, the only requirement is a file containing Snort 2.9.X syntax.\r
Assuming your configuration file is named snort.conf, run the command</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>snort2lua –c snort.conf</code></pre>\r
</div></div>\r
<div class="paragraph"><p>Snort2Lua will output a file named snort.lua. Assuming your snort.conf file is\r
-a valid Snort 2 configuration file, than the resulting snort.lua file will\r
-always be a valid Snort 3 configuration file; any errors that occur are\r
-because Snort 3 currently does not support all of the Snort 2 options.</p></div>\r
+a valid Snort 2.9.X configuration file, than the resulting snort.lua file will\r
+always be a valid Snort 3.0 configuration file; any errors that occur are\r
+because Snort 3.0 currently does not support all of the Snort 2.9.X options.</p></div>\r
<div class="paragraph"><p>Every keyword from the Snort configuration can be found in the output file. If\r
the option or keyword has changed, then a comment containing both the option or\r
keyword’s old name and new name will be present in the output file.</p></div>\r
<div class="paragraph"><p>Translating a rule file</p></div>\r
<div class="paragraph"><p>Snort2Lua can also accommodate translating individual rule files. Assuming the\r
-Snort 2 rule file is named snort.rules and you want the new rule file to be\r
+Snort 2.9.X rule file is named snort.rules and you want the new rule file to be\r
name updated.rules, run the command</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>snort2lua –c snort.rules -r updated.rules</code></pre>\r
</div></div>\r
<div class="paragraph"><p>Snort2Lua will output a file named updated.rules. That file, updated.rules,\r
-will always be a valid Snort 3 rule file. Any rule that contains unsupported\r
+will always be a valid Snort 3.0 rule file. Any rule that contains unsupported\r
options will be a comment in the output file.</p></div>\r
<div class="paragraph"><p>Understanding the Output</p></div>\r
<div class="paragraph"><p>Although Snort2Lua outputs very little to the console, there are several things\r
that occur when Snort2Lua runs. This is a list of Snort2Lua outputs.</p></div>\r
<div class="paragraph"><p><em>The console</em>. Every line that Snort2Lua is unable to translate from the Snort\r
-2.X format to the Snort 3 format is considered an error. Upon exiting,\r
+2.9.X format to the Snort 3.0 format is considered an error. Upon exiting,\r
Snort2Lua will print the number of errors that occurred. Snort2Lua will also\r
print the name of the error file.</p></div>\r
<div class="paragraph"><p><em>The output file</em>. As previously mentioned, Snort2Lua will create a Lua file\r
-with valid Snort 3 syntax. The default Lua file is named snort.lua. This\r
-file is the equivalent of your main Snort 2 configuration file.</p></div>\r
+with valid Snort 3.0 syntax. The default Lua file is named snort.lua. This\r
+file is the equivalent of your main Snort 2.9.X configuration file.</p></div>\r
<div class="paragraph"><p><em>The rule file</em>. By default, all rules will be printed to the Lua file.\r
However, if a rule file is specified on the command line, any rules found in\r
-the Snort 2 configuration will be written to the rule file instead</p></div>\r
+the Snort 2.9.X configuration will be written to the rule file instead</p></div>\r
<div class="paragraph"><p><em>The error file</em>. By default, the error file is snort.rej. It will only be\r
created if errors exist. Every error referenced on the command line can be\r
found in this file. There are two reasons an error can occur.</p></div>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-The Snort 2 configuration file has invalid syntax. If Snort 2 cannot\r
- parse the configuration file, neither can Snort2Lua. In the example below,\r
- Snort2Lua could not convert the line <em>config bad_option</em>. Since that is not\r
- valid Snort 2 syntax, this is a syntax error.\r
+The Snort 2.9.X configuration file has invalid syntax. If Snort 2.9.X cannot\r
+ parse the configuration file, neither can Snort2Lua. In the example below,\r
+ Snort2Lua could not convert the line <em>config bad_option</em>. Since that is not\r
+ valid Snort 2.9.X syntax, this is a syntax error.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+The Snort 2.9.X configuration file contains preprocessors and rule options\r
+ that are not supported in Snort 3.0. If Snort 2.9.X can parse a line that\r
+ Snort2Lua cannot parse, than Snort 3.0 does not support something in the line.\r
+ As Snort 3.0 begins supporting these preprocessors and rule options, Snort2Lua\r
+ will also begin translating these lines. One example of such an error is\r
+ dcerpc2.\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Additional .lua and .rules files. Every time Snort2Lua parses the include or\r
+binding keyword, the program will attempt to parse the file referenced by the\r
+keyword. Snort2Lua will then create one or two new files. The new files will\r
+have a .lua or .rules extension appended to the original filename.</p></div>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_extending_snort">Extending Snort++</h2>\r
+<div class="sectionbody">\r
+<div class="sect2">\r
+<h3 id="_plugins">Plugins</h3>\r
+<div class="paragraph"><p>Snort++ uses a variety of plugins to accomplish much of its processing\r
+objectives, including:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+Codec - to decode and encode packets\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+Inspector - like the prior preprocessors, for normalization, etc.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+IpsOption - for detection in Snort++ rules\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+IpsAction - for custom actions\r
</p>\r
</li>\r
<li>\r
<p>\r
-The Snort 2 configuration file contains preprocessors and rule options\r
- that are not supported in Snort 3. If Snort 2 can parse a line that\r
- Snort2Lua cannot parse, than Snort 3 does not support something in the line.\r
- As Snort 3 begins supporting these preprocessors and rule options, Snort2Lua\r
- will also begin translating these lines. One example of such an error is\r
- dcerpc2.\r
+Logger - for handling events\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+Mpse - for fast pattern matching\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+So - for dynamic rules\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>Additional .lua and .rules files. Every time Snort2Lua parses the include or\r
-binding keyword, the program will attempt to parse the file referenced by the\r
-keyword. Snort2Lua will then create one or two new files. The new files will\r
-have a .lua or .rules extension appended to the original filename.</p></div>\r
-</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_extending_snort">Extending Snort</h2>\r
-<div class="sectionbody">\r
-<div class="sect2">\r
-<h3 id="_plugins_3">Plugins</h3>\r
<div class="paragraph"><p>Plugins have an associated API defined for each type, all of which share a\r
common <em>header</em>, called the BaseApi. A dynamic library makes its plugins\r
available by exporting the snort_plugins symbol, which is a null terminated\r
</div>\r
<div class="sect2">\r
<h3 id="_modules_2">Modules</h3>\r
+<div class="paragraph"><p>The Module is pervasive in Snort+<code>. It is how everything, including\r
+plugins, are configured. It also provides access to builtin rules. And as\r
+the glue that binds functionality to Snort</code>+, the capabilities of a Module\r
+are expected to grow to include statistics support, etc.</p></div>\r
+<div class="paragraph"><p>Module configuration is handled by a list of Parameters. Most parameters\r
+can be validated by the framework, which means for example that conversion\r
+from string to number is done in exactly one place. Providing the builtin\r
+rules allows the documentation to include them automatically and also allows\r
+for autogenerating the rules at startup.</p></div>\r
<div class="paragraph"><p>If we are defining a new Inspector called, say, gadget, it might be\r
configured in snort.lua like this:</p></div>\r
<div class="literalblock">\r
claw = 3\r
}</code></pre>\r
</div></div>\r
-<div class="paragraph"><p>When the gadget table is processed, Snort will look for a module called\r
+<div class="paragraph"><p>When the gadget table is processed, Snort++ will look for a module called\r
gadget. If that Module has an associated API, it will be used to configure\r
a new instance of the plugin. In this case, a GadgetModule would be\r
instantiated, brain and claw would be set, and the Module instance would be\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>begin()</strong> - called when Snort starts processing the associated Lua\r
+<strong>begin()</strong> - called when Snort++ starts processing the associated Lua\r
table. This is a good place to allocate any required data and set\r
defaults.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>end()</strong> - called when Snort finishes processing the associated Lua\r
+<strong>end()</strong> - called when Snort++ finishes processing the associated Lua\r
table. This is where additional integrity checks of related parameters\r
should be done.\r
</p>\r
the plugin instance which takes ownership.</p></div>\r
<div class="paragraph"><p>Note that there is at most one instance of a given Module, even if multiple\r
plugin instances are created which use that Module. (Multiple instances\r
-require Snort binding configuration.)</p></div>\r
+require Snort++ binding configuration.)</p></div>\r
</div>\r
<div class="sect2">\r
<h3 id="_inspectors">Inspectors</h3>\r
</div>\r
<div class="sect2">\r
<h3 id="_codecs">Codecs</h3>\r
-<div class="paragraph"><p>The Snort Codecs decipher raw packets. These Codecs are now completely\r
-pluggable; almost every Snort Codec can be built dynamically and replaced\r
-with an alternative, customized Codec. The pluggable nature has also made\r
-it easier to build new Codecs for protocols without having to touch the\r
-Snort code base.</p></div>\r
-<div class="paragraph"><p>The first step in creating a Codec is defining its class and protocol.\r
-Every Codec must inherit from the Snort Codec class defined in\r
-"framework/codec.h". The following is an example Codec named "example" and\r
-has an associated struct that is 14 bytes long.</p></div>\r
+<div class="paragraph"><p>The Snort3.0 Codecs decipher raw packets. These Codecs are now completely\r
+pluggable; almost every Snort3.0 Codec can be built dynamically and replaced\r
+with an alternative, customized Codec. The pluggable nature has also made it\r
+easier to build new Codecs for protocols without having to touch the Snort3.0\r
+code base.</p></div>\r
+<div class="paragraph"><p>The first step in creating a Codec is defining its class and protocol. Every\r
+Codec must inherit from the Snort3.0 Codec class defined in\r
+"framework/codec.h". The following is an example Codec named "example" and has\r
+an associated struct that is 14 bytes long.</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>#include <cstdint>\r
pointer to the raw data that has come from a wire and the length of that raw\r
data. The function takes this information and validates that there are enough\r
bytes for this protocol. If the raw data’s length is less than 14 bytes, the\r
-function returns false and Snort discards the packet; the packet is neither\r
+function returns false and Snort3.0 discards the packet; the packet is neither\r
inspected nor processed. If the length is greater than 14 bytes, the function\r
populates two fields in the CodecData struct, next_prot_id and lyr_len. The\r
-lyr_len field tells Snort the number of bytes that this layer contains. The\r
-next_prot_id field provides Snort the value of the next EtherType or IP\r
+lyr_len field tells Snort3.0 the number of bytes that this layer contains. The\r
+next_prot_id field provides Snort3.0 the value of the next EtherType or IP\r
protocol number.</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>45 00 00 38 00 01 00 00 40 06 5c ac 0a 01 02 03\r
0a 09</code></pre>\r
</div></div>\r
-<div class="paragraph"><p>How does Snort know that the IPv4 Codec has an EtherType of 0x0800? The\r
+<div class="paragraph"><p>How does Snort3.0 know that the IPv4 Codec has an EtherType of 0x0800? The\r
Codec class has a second virtual function named get_protocol_ids(). When\r
implementing the function, a Codec can register for any number of values\r
between 0x0000 - 0xFFFF. Then, if the next_proto_id is set to a value for which\r
<div class="paragraph"><p>To register a Codec for Data Link Type’s rather than protocols, the function\r
get_data_link_type() can be similarly implemented.</p></div>\r
<div class="paragraph"><p>The final step to creating a pluggable Codec is the snort_plugins array. This\r
-array is important because when Snort loads a dynamic library, the program\r
+array is important because when Snort3.0 loads a dynamic library, the program\r
only find plugins that are inside the snort_plugins array. In other words, if a\r
plugin has not been added to the snort_plugins array, that plugin will not be\r
-loaded into Snort.</p></div>\r
+loaded into Snort3.0.</p></div>\r
<div class="paragraph"><p>Although the details will not be covered in this post, the following code\r
-snippet is a basic CodecApi that Snort can load. This snippet can be copied\r
+snippet is a basic CodecApi that Snort3.0 can load. This snippet can be copied\r
and used with only three minor changes. First, in the function ctor, ExCodec\r
should be replaced with the name of the Codec that is being built. Second,\r
EX_NAME must match the Codec’s name or Snort will be unable to load this Codec.\r
Third, EX_HELP should be replaced with the general description of this Codec.\r
Once this code snippet has been added, ExCodec is ready to be compiled and\r
-plugged into Snort.</p></div>\r
+plugged into Snort3.0.</p></div>\r
<div class="literalblock">\r
<div class="content">\r
<pre><code>static Codec* ctor(Module*)\r
};</code></pre>\r
</div></div>\r
<div class="paragraph"><p>Two example Codecs are available in the extra directory on git and the extra\r
-tarball on the Snort page. One of those examples is the Token Ring Codec\r
+tarball on the Snort3.0 page. One of those examples is the Token Ring Codec\r
while the other example is the PIM Codec.</p></div>\r
<div class="paragraph"><p>As a final note, there are four more virtual functions that a Codec should\r
implement: encode, format, update, and log. If the functions are not\r
<li>\r
<p>\r
log is called when either the log_codecs logger or a custom logger that calls\r
- PacketManager::log_protocols is used when running Snort.\r
+ PacketManager::log_protocols is used when running Snort3.0.\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<code>text_rule</code>\r
+<code>text_rule</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>num_services</code>\r
+</p>\r
+</li>\r
+</ul></div>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p><strong>Flow</strong></p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<code>Flow.new() → Flow</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Flow:reset()</code>\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p><strong>Packet</strong></p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<code>Packet.new() → Packet</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet.new(string[data]) → Packet</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet.new(uint[size]) → Packet</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet.new(fields) → Packet</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet.new(RawBuffer) → Packet</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet.new(DAQHeader) → Packet</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set_decode_data(DecodeData)</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set_data(uint[offset], uint[length])</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set_flow(Flow)</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:get() → fields</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set() </code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set(string[data]) </code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set(uint[size]) </code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set(fields) </code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set(RawBuffer) </code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>Packet:set(DAQHeader) </code>\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p><code>fields</code> is a table with the following contents:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<code>packet_flags</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>xtradata_mask</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>proto_bits</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>application_protocol_ordinal</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>alt_dsize</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>num_layers</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>iplist_id</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>user_policy_id</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>ps_proto</code>\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Note: <code>Packet.new()</code> and <code>Packet:set()</code> accept multiple arguments of the\r
+types described above in any order</p></div>\r
+<div class="paragraph"><p><strong>RawBuffer</strong></p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<code>RawBuffer.new() → RawBuffer</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer.new(uint[size]) → RawBuffer</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer.new(string[data]) → RawBuffer</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:size() → int</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:resize(uint[size])</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:write(string[data])</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:write(string[data], uint[size])</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:read() → string</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:read(uint[end]) → string</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>RawBuffer:read(uint[start], uint[end]) → string</code>\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Note: calling <code>RawBuffer.new()</code> with no arguments returns a RawBuffer of size 0</p></div>\r
+<div class="paragraph"><p><strong>StreamSplitter</strong></p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<code>StreamSplitter:scan(Flow, RawBuffer) → int, int</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>StreamSplitter:scan(Flow, RawBuffer, uint[len]) → int, int</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>StreamSplitter:scan(Flow, RawBuffer, uint[len], uint[flags]) → int, int</code>\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<code>StreamSplitter:reassemble(Flow, uint[total], uint[offset], RawBuffer) → int, RawBuffer</code>\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>num_services</code>\r
+<code>StreamSplitter:reassemble(Flow, uint[total], uint[offset], RawBuffer, uint[len]) → int, RawBuffer</code>\r
</p>\r
</li>\r
-</ul></div>\r
-</li>\r
-</ul></div>\r
-<div class="paragraph"><p><strong>Flow</strong></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>Flow.new() → Flow</code>\r
+<code>StreamSplitter:reassemble(Flow, uint[total], uint[offset], RawBuffer, uint[len], uint[flags]) → int, RawBuffer</code>\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Flow:reset()</code>\r
+<code>StreamSplitter:finish(Flow) → bool</code>\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p><strong>Packet</strong></p></div>\r
+<div class="paragraph"><p>Note: StreamSplitter does not have a <code>new()</code> method, it must be created by an inspector via\r
+<code>Inspector.get_splitter()</code></p></div>\r
+</div>\r
+</div>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_coding_style">Coding Style</h2>\r
+<div class="sectionbody">\r
+<div class="paragraph"><p>All new code should try to follow these style guidelines. These are not\r
+yet firm so feedback is welcome to get something we can live with.</p></div>\r
+<div class="sect2">\r
+<h3 id="_general">General</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>Packet.new() → Packet</code>\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<code>Packet.new(string[data]) → Packet</code>\r
+Generally try to follow\r
+ <a href="http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml">http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml</a>,\r
+ but there are some differences documented here.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet.new(uint[size]) → Packet</code>\r
+Each source directory should have a dev_notes.txt file summarizing the\r
+ key points and design decisions for the code in that directory. These\r
+ are built into the developers guide.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet.new(fields) → Packet</code>\r
+Makefile.am and CMakeLists.txt should have the same files listed in alpha\r
+ order. This makes it easier to maintain both build systems.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet.new(RawBuffer) → Packet</code>\r
+All new code must come with unit tests providing 95% coverage or better.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet.new(DAQHeader) → Packet</code>\r
+Generally, Catch is preferred for tests in the source file and CppUTest\r
+ is preferred for test executables in a test subdirectory.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_c_specific">C++ Specific</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>Packet:set_decode_data(DecodeData)</code>\r
+Do not use exceptions. Exception-safe code is non-trivial and we have\r
+ ported legacy code that makes use of exceptions unwise. There are a few\r
+ exceptions to this rule for the memory manager, shell, etc. Other code\r
+ should handle errors as errors.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set_data(uint[offset], uint[length])</code>\r
+Do not use dynamic_cast or RTTI. Although compilers are getting better\r
+ all the time, there is a time and space cost to this that is easily\r
+ avoided.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set_flow(Flow)</code>\r
+Use smart pointers judiciously as they aren’t free. If you would have to\r
+ roll your own, then use a smart pointer. If you just need a dtor to\r
+ delete something, write the dtor.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:get() → fields</code>\r
+Prefer <em>and</em> over && and <em>or</em> over || for new source files.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set() </code>\r
+Use nullptr instead of NULL.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set(string[data]) </code>\r
+Use new, delete, and their [] counterparts instead of malloc and free\r
+ except where realloc must be used. But try not to use realloc. New and\r
+ delete can’t return nullptr so no need to check. And Snort’s memory\r
+ manager will ensure that we live within our memory budget.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set(uint[size]) </code>\r
+Use references in lieu of pointers wherever possible.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set(fields) </code>\r
+Use the order public, protected, private top to bottom in a class\r
+ declaration.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set(RawBuffer) </code>\r
+Keep inline functions in a class declaration very brief, preferably just\r
+ one line. If you need a more complex inline function, move the\r
+ definition below the class declaration.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>Packet:set(DAQHeader) </code>\r
+The goal is to have highly readable class declarations. The user\r
+ shouldn’t have to sift through implementation details to see what is\r
+ available to the client.\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p><code>fields</code> is a table with the following contents:</p></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_naming">Naming</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>packet_flags</code>\r
+Use camel case for namespaces, classes, and types like WhizBangPdfChecker.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>xtradata_mask</code>\r
+Use lower case identifiers with underscore separators, e.g. some_function()\r
+ and my_var.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>proto_bits</code>\r
+Use lower case filenames with underscores.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_comments">Comments</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>application_protocol_ordinal</code>\r
+Write comments sparingly with a mind towards future proofing. Often the\r
+ comments can be obviated with better code. Clear code is better than a\r
+ comment.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>alt_dsize</code>\r
+Heed Tim Ottinger’s Rule on Comments (<a href="https://disqus.com/by/tim_ottinger/">https://disqus.com/by/tim_ottinger/</a>):\r
</p>\r
-</li>\r
+<div class="olist arabic"><ol class="arabic">\r
<li>\r
<p>\r
-<code>num_layers</code>\r
+Comments should only say what the code is incapable of saying.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>iplist_id</code>\r
+Comments that repeat (or pre-state) what the code is doing must be\r
+ removed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>user_policy_id</code>\r
+If the code CAN say what the comment is saying, it must be changed at\r
+ least until rule #2 is in force.\r
</p>\r
</li>\r
+</ol></div>\r
+</li>\r
<li>\r
<p>\r
-<code>ps_proto</code>\r
+Function comment blocks are generally just noise that quickly becomes\r
+ obsolete. If you absolutely must comment on parameters, put each on a\r
+ separate line along with the comment. That way changing the signature\r
+ may prompt a change to the comments too.\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Note: <code>Packet.new()</code> and <code>Packet:set()</code> accept multiple arguments of the\r
-types described above in any order</p></div>\r
-<div class="paragraph"><p><strong>RawBuffer</strong></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>RawBuffer.new() → RawBuffer</code>\r
+Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left for a\r
+ day or even just a minute. That way we can find them easily and won’t\r
+ lose track of them.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer.new(uint[size]) → RawBuffer</code>\r
+Presently using FIXIT-X where X = P | H | M | L, indicating perf, high,\r
+ med, or low priority. For now, H, M, or L can indicate alpha 1, 2, or 3.\r
+ Perf changes fall between alpha 1 and 2.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer.new(string[data]) → RawBuffer</code>\r
+Put the copyright(s) and license in a comment block at the top of each\r
+ source file (.h and .cc). Don’t bother with trivial scripts and make\r
+ foo. Some interesting Lua code should get a comment block too. Copy and\r
+ paste exactly from src/main.h (don’t reformat).\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer:size() → int</code>\r
+Put author, description, etc. in separate comment(s) following the\r
+ license. Do not put such comments in the middle of the license foo.\r
+ Be sure to put the author line ahead of the header guard to exclude them\r
+ from the developers guide. Use the following format, and include a\r
+ mention to the original author if this is derived work:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>// ips_dnp3_obj.cc author Maya Dagon <mdagon@cisco.com>\r
+// based on work by Ryan Jordan</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer:resize(uint[size])</code>\r
+Each header should have a comment immediately after the header guard to\r
+ give an overview of the file so the user knows what’s going on.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_logging">Logging</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>RawBuffer:write(string[data])</code>\r
+Messages intended for the user should not look like debug messages. Eg,\r
+ the function name should not be included. It is generally unhelpful to\r
+ include pointers.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer:write(string[data], uint[size])</code>\r
+Most debug messages should just be deleted.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer:read() → string</code>\r
+Don’t bang your error messages (no !). The user feels bad enough about the\r
+ problem already w/o you shouting at him.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_types">Types</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>RawBuffer:read(uint[end]) → string</code>\r
+Use logical types to make the code clearer and to help the compiler catch\r
+ problems. typedef uint16_t Port; bool foo(Port) is way better than\r
+ int foo(int port).\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>RawBuffer:read(uint[start], uint[end]) → string</code>\r
+Use forward declarations (e.g. struct SnortConfig;) instead of void*.\r
</p>\r
</li>\r
-</ul></div>\r
-<div class="paragraph"><p>Note: calling <code>RawBuffer.new()</code> with no arguments returns a RawBuffer of size 0</p></div>\r
-<div class="paragraph"><p><strong>StreamSplitter</strong></p></div>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-<code>StreamSplitter:scan(Flow, RawBuffer) → int, int</code>\r
+Try not to use extern data unless absolutely necessary and then put the\r
+ extern in an appropriate header. Exceptions for things used in exactly\r
+ one place like BaseApi pointers.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>StreamSplitter:scan(Flow, RawBuffer, uint[len]) → int, int</code>\r
+Use const liberally. In most cases, const char* s = "foo" should be\r
+ const char* const s = "foo". The former goes in the initialized data\r
+ section and the latter in read only data section.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>StreamSplitter:scan(Flow, RawBuffer, uint[len], uint[flags]) → int, int</code>\r
+But use const char s[] = "foo" instead of const char* s = "foo" when\r
+ possible. The latter form allocates a pointer variable and the data\r
+ while the former allocates only the data.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>StreamSplitter:reassemble(Flow, uint[total], uint[offset], RawBuffer) → int, RawBuffer</code>\r
+Use static wherever possible to minimize public symbols and eliminate\r
+ unneeded relocations.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>StreamSplitter:reassemble(Flow, uint[total], uint[offset], RawBuffer, uint[len]) → int, RawBuffer</code>\r
+Declare functions virtual only in the parent class introducing the\r
+ function (not in a derived class that is overriding the function).\r
+ This makes it clear which class introduces the function.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>StreamSplitter:reassemble(Flow, uint[total], uint[offset], RawBuffer, uint[len], uint[flags]) → int, RawBuffer</code>\r
+Declare functions as override if they are intended to override a\r
+ function. This makes it possible to find derived implementations that\r
+ didn’t get updated and therefore won’t get called due a change in the\r
+ parent signature.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<code>StreamSplitter:finish(Flow) → bool</code>\r
+Use bool functions instead of int unless there is truly a need for\r
+ multiple error returns. The C-style use of zero for success and -1 for\r
+ error is less readable and often leads to messy code that either ignores\r
+ the various errors anyway or needlessly and ineffectively tries to do\r
+ something aobut them. Generally that code is not updated if new errors\r
+ are added.\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>Note: StreamSplitter does not have a <code>new()</code> method, it must be created by an inspector via\r
-<code>Inspector.get_splitter()</code></p></div>\r
-</div>\r
-</div>\r
</div>\r
-</div>\r
-</div>\r
-<div class="sect1">\r
-<h2 id="_coding_style">Coding Style</h2>\r
-<div class="sectionbody">\r
-<div class="paragraph"><p>All new code should try to follow these style guidelines. These are not\r
-yet firm so feedback is welcome to get something we can live with.</p></div>\r
<div class="sect2">\r
-<h3 id="_general">General</h3>\r
+<h3 id="_macros_aka_defines">Macros (aka defines)</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Generally try to follow\r
- <a href="http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml">http://google-styleguide.googlecode.com/svn/trunk/cppguide.xml</a>,\r
- but there are some differences documented here.\r
+In many cases, even in C++, use #define name "value" instead of a\r
+ const char* const name = "value" because it will eliminate a symbol from\r
+ the binary.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Each source directory should have a dev_notes.txt file summarizing the\r
- key points and design decisions for the code in that directory. These\r
- are built into the developers guide.\r
+Use inline functions instead of macros where possible (pretty much all\r
+ cases except where stringification is necessary). Functions offer better\r
+ typing, avoid re-expansions, and a debugger can break there.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Makefile.am and CMakeLists.txt should have the same files listed in alpha\r
- order. This makes it easier to maintain both build systems.\r
+All macros except simple const values should be wrapped in () and all\r
+ args should be wrapped in () too to avoid surprises upon expansion.\r
+ Example:\r
+</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>#define SEQ_LT(a,b) ((int)((a) - (b)) < 0)</code></pre>\r
+</div></div>\r
+</li>\r
+<li>\r
+<p>\r
+Multiline macros should be blocked (i.e. inside { }) to avoid if-else type\r
+ surprises.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_formatting">Formatting</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-All new code must come with unit tests providing 95% coverage or better.\r
+Try to keep all source files under 2500 lines. 3000 is the max allowed.\r
+ If you need more lines, chances are that the code needs to be refactored.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Generally, Catch is preferred for tests in the source file and CppUTest\r
- is preferred for test executables in a test subdirectory.\r
+Indent 4 space chars … no tabs!\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_c_specific">C++ Specific</h3>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Do not use exceptions. Exception-safe code is non-trivial and we have\r
- ported legacy code that makes use of exceptions unwise. There are a few\r
- exceptions to this rule for the memory manager, shell, etc. Other code\r
- should handle errors as errors.\r
+If you need to indent many times, something could be rewritten or\r
+ restructured to make it clearer. Fewer indents is generally easier to\r
+ write, easier to read, and overall better code.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Do not use dynamic_cast or RTTI. Although compilers are getting better\r
- all the time, there is a time and space cost to this that is easily\r
- avoided.\r
+Braces go on the line immediately following a new scope (function\r
+ signature, if, else, loop, switch, etc.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use smart pointers judiciously as they aren’t free. If you would have to\r
- roll your own, then use a smart pointer. If you just need a dtor to\r
- delete something, write the dtor.\r
+Use consistent spacing and line breaks. Always indent 4 spaces from the\r
+ breaking line. Keep lines less than 100 chars; it greatly helps\r
+ readability.\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>No:\r
+ calling_a_func_with_a_long_name(arg1,\r
+ arg2,\r
+ arg3);</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>Yes:\r
+ calling_a_func_with_a_long_name(\r
+ arg1, arg2, arg3);</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Prefer <em>and</em> over && and <em>or</em> over || for new source files.\r
+Put function signature on one line, except when breaking for the arg\r
+ list:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>No:\r
+ inline\r
+ bool foo()\r
+ { // ...</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>Yes:\r
+ inline bool foo()\r
+ { // ...</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Use nullptr instead of NULL.\r
+Put conditional code on the line following the if so it is easy to break\r
+ on the conditional block:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>No:\r
+ if ( test ) foo();</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>Yes:\r
+ if ( test )\r
+ foo();</code></pre>\r
+</div></div>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_headers">Headers</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-Use new, delete, and their [] counterparts instead of malloc and free\r
- except where realloc must be used. But try not to use realloc. New and\r
- delete can’t return nullptr so no need to check. And Snort’s memory\r
- manager will ensure that we live within our memory budget.\r
+Don’t hesitate to create a new header if it is needed. Don’t lump\r
+ unrelated stuff into an header because it is convenient.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use references in lieu of pointers wherever possible.\r
+Write header guards like this (leading underscores are reserved for\r
+ system stuff). In my_header.h:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>#ifndef MY_HEADER_H\r
+#define MY_HEADER_H\r
+// ...\r
+#endif</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Use the order public, protected, private top to bottom in a class\r
- declaration.\r
+Includes from a different directory should specify parent directory.\r
+ This makes it clear exactly what is included and avoids the primordial\r
+ soup that results from using -I this -I that -I the_other_thing … .\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>// given:\r
+src/foo/foo.cc\r
+src/bar/bar.cc\r
+src/bar/baz.cc</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>// in baz.cc\r
+#include "bar.h"</code></pre>\r
+</div></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>// in foo.cc\r
+#include "bar/bar.h"</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Keep inline functions in a class declaration very brief, preferably just\r
- one line. If you need a more complex inline function, move the\r
- definition below the class declaration.\r
+Includes within installed headers should specify parent directory.\r
</p>\r
</li>\r
<li>\r
<p>\r
-The goal is to have highly readable class declarations. The user\r
- shouldn’t have to sift through implementation details to see what is\r
- available to the client.\r
+Just because it is a #define doesn’t mean it goes in a header.\r
+ Everything should be scoped as tightly as possible. Shared\r
+ implementation declarations should go in a separate header from the\r
+ interface. And so on.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Any using statements in source files should be added only after all\r
- includes have been declared.\r
+A .cc should include its own .h before any others (including\r
+ system headers). This ensures that the header stands on its own and can\r
+ be used by clients without include prerequisites and the developer will\r
+ be the first to find a dependency problem.\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_naming">Naming</h3>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Use camel case for namespaces, classes, and types like WhizBangPdfChecker.\r
+Include required headers, all required headers, and nothing but required\r
+ headers. Don’t just clone a bunch of headers because it is convenient.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use lower case identifiers with underscore separators, e.g. some_function()\r
- and my_var.\r
+Try to keep includes in alpha order. This makes it easier to maintain,\r
+ avoid duplicates, etc.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Do not start or end variable names with an underscore. This has a good\r
- chance of conflicting with macro and/or system definitions.\r
+Any file depending on #ifdefs should include config.h as shown below. A\r
+ .h should include it before any other includes, and a .cc should include\r
+ it immediately after the include of its own .h.\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>#ifdef HAVE_CONFIG_H\r
+#include "config.h"\r
+#endif</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Use lower case filenames with underscores.\r
+Do not put using statements in headers unless they are tightly scoped.\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_comments">Comments</h3>\r
+<h3 id="_warnings">Warnings</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-Write comments sparingly with a mind towards future proofing. Often the\r
- comments can be obviated with better code. Clear code is better than a\r
- comment.\r
+With g++, use at least these compiler flags:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>-Wall -Wextra -pedantic -Wformat -Wformat-security\r
+-Wunused-but-set-variable -Wno-deprecated-declarations\r
+-fsanitize=address -fno-omit-frame-pointer</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Heed Tim Ottinger’s Rule on Comments (<a href="https://disqus.com/by/tim_ottinger/">https://disqus.com/by/tim_ottinger/</a>):\r
-</p>\r
-<div class="olist arabic"><ol class="arabic">\r
-<li>\r
-<p>\r
-Comments should only say what the code is incapable of saying.\r
+With clang, use at least these compiler flags:\r
</p>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>-Wall -Wextra -pedantic -Wformat -Wformat-security\r
+-Wno-deprecated-declarations\r
+-fsanitize=address -fno-omit-frame-pointer</code></pre>\r
+</div></div>\r
</li>\r
<li>\r
<p>\r
-Comments that repeat (or pre-state) what the code is doing must be\r
- removed.\r
+Then Fix All Warnings and Aborts. None Allowed.\r
</p>\r
</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_uncrustify">Uncrustify</h3>\r
+<div class="paragraph"><p>Currently using uncrustify from at <a href="https://github.com/bengardner/uncrustify">https://github.com/bengardner/uncrustify</a>\r
+to reformat legacy code and anything that happens to need a makeover at\r
+some point.</p></div>\r
+<div class="paragraph"><p>The working config is crusty.cfg in the top level directory. It does well\r
+but will munge some things. Specially formatted INDENT-OFF comments were\r
+added in 2 places to avoid a real mess.</p></div>\r
+<div class="paragraph"><p>You can use uncrustify something like this:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>uncrustify -c crusty.cfg --replace file.cc</code></pre>\r
+</div></div>\r
+</div>\r
+</div>\r
+</div>\r
+<div class="sect1">\r
+<h2 id="_reference_2">Reference</h2>\r
+<div class="sectionbody">\r
+<div class="sect2">\r
+<h3 id="_terminology">Terminology</h3>\r
+<div class="ulist"><ul>\r
<li>\r
<p>\r
-If the code CAN say what the comment is saying, it must be changed at\r
- least until rule #2 is in force.\r
+<strong>basic module</strong>: a module integrated into Snort that does not come from a\r
+ plugin.\r
</p>\r
</li>\r
-</ol></div>\r
-</li>\r
<li>\r
<p>\r
-Function comment blocks are generally just noise that quickly becomes\r
- obsolete. If you absolutely must comment on parameters, put each on a\r
- separate line along with the comment. That way changing the signature\r
- may prompt a change to the comments too.\r
+<strong>binder</strong>: inspector that maps configuration to traffic\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use FIXIT (not FIXTHIS or TODO or whatever) to mark things left for a\r
- day or even just a minute. That way we can find them easily and won’t\r
- lose track of them.\r
+<strong>builtin rules</strong>: codec and inspector rules for anomalies detected\r
+ internally.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Presently using FIXIT-X where X = A | W | P | H | M | L, indicating analysis,\r
- warning, perf, high, med, or low priority. Place A and W comments on the\r
- exact warning line so we can match up comments and build output. Supporting\r
- comments can be added above.\r
+<strong>codec</strong>: short for coder / decoder. These plugins are used for basic\r
+ protocol decoding, anomaly detection, and construction of active responses.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Put the copyright(s) and license in a comment block at the top of each\r
- source file (.h and .cc). Don’t bother with trivial scripts and make\r
- foo. Some interesting Lua code should get a comment block too. Copy and\r
- paste exactly from src/main.h (don’t reformat).\r
+<strong>data module</strong>: an adjunct configuration plugin for use with certain inspectors.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Put author, description, etc. in separate comment(s) following the\r
- license. Do not put such comments in the middle of the license foo.\r
- Be sure to put the author line ahead of the header guard to exclude them\r
- from the developers guide. Use the following format, and include a\r
- mention to the original author if this is derived work:\r
+<strong>dynamic rules</strong>: plugin rules loaded at runtime. See SO rules.\r
</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>// ips_dnp3_obj.cc author Maya Dagon <mdagon@cisco.com>\r
-// based on work by Ryan Jordan</code></pre>\r
-</div></div>\r
</li>\r
<li>\r
<p>\r
-Each header should have a comment immediately after the header guard to\r
- give an overview of the file so the reader knows what’s going on.\r
+<strong>fast pattern</strong>: the content in an IPS rule that must be found by the\r
+ search engine in order for a rule to be evaluated.\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_logging">Logging</h3>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Messages intended for the user should not look like debug messages. Eg,\r
- the function name should not be included. It is generally unhelpful to\r
- include pointers.\r
+<strong>fast pattern matcher</strong>: see search engine.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Most debug messages should just be deleted.\r
+<strong>hex</strong>: a type of protocol magic that the wizard uses to identify binary\r
+ protocols.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Don’t bang your error messages (no !). The user feels bad enough about the\r
- problem already w/o you shouting at him.\r
+<strong>inspector</strong>: plugin that processes packets (similar to the legacy Snort\r
+ preprocessor)\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_types">Types</h3>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-Use logical types to make the code clearer and to help the compiler catch\r
- problems. typedef uint16_t Port; bool foo(Port) is way better than\r
- int foo(int port).\r
+<strong>IPS</strong>: intrusion prevention system, like Snort.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use forward declarations (e.g. struct SnortConfig;) instead of void*.\r
+<strong>IPS action</strong>: plugin that allows you to perform custom actions when\r
+ events are generated. Unlike loggers, these are invoked before\r
+ thresholding and can be used to control external agents or send active\r
+ responses.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Try not to use extern data unless absolutely necessary and then put the\r
- extern in an appropriate header. Exceptions for things used in exactly\r
- one place like BaseApi pointers.\r
+<strong>IPS option</strong>: this plugin is the building blocks of IPS rules.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use const liberally. In most cases, const char* s = "foo" should be\r
- const char* const s = "foo". The former goes in the initialized data\r
- section and the latter in read only data section.\r
+<strong>logger</strong>: a plugin that performs output of events and packets. Events\r
+ are thresholded before reaching loggers.\r
</p>\r
</li>\r
<li>\r
<p>\r
-But use const char s[] = "foo" instead of const char* s = "foo" when\r
- possible. The latter form allocates a pointer variable and the data\r
- while the former allocates only the data.\r
+<strong>module</strong>: the user facing portion of a Snort component. Modules chiefly\r
+ provide configuration parameters, but may also provide commands, builtin\r
+ rules, profiling statistics, peg counts, etc. Note that not all modules\r
+ are plugins and not all plugins have modules.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use static wherever possible to minimize public symbols and eliminate\r
- unneeded relocations.\r
+<strong>peg count</strong>: the number of times a given event or condition occurs.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Declare functions virtual only in the parent class introducing the\r
- function (not in a derived class that is overriding the function).\r
- This makes it clear which class introduces the function.\r
+<strong>plugin</strong>: one of several types of software components that can be loaded\r
+ from a dynamic library when Snort starts up. Some plugins are coupled\r
+ with the main engine in such a way that they must be built statically,\r
+ but a newer version can be loaded dynamically.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Declare functions as override if they are intended to override a\r
- function. This makes it possible to find derived implementations that\r
- didn’t get updated and therefore won’t get called due a change in the\r
- parent signature.\r
+<strong>search engine</strong>: a plugin that performs multipattern searching of packets\r
+ and payload to find rules that should be evaluated. There are currently\r
+ no specific modules, although there are several search engine plugins.\r
+ Related configuration is done with the basic detection module. Aka fast\r
+ pattern matcher.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use bool functions instead of int unless there is truly a need for\r
- multiple error returns. The C-style use of zero for success and -1 for\r
- error is less readable and often leads to messy code that either ignores\r
- the various errors anyway or needlessly and ineffectively tries to do\r
- something aobut them. Generally that code is not updated if new errors\r
- are added.\r
+<strong>SO rule</strong>: a IPS rule plugin that performs custom detection that can’t\r
+ be done by a text rule. These rules typically do not have associated\r
+ modules. SO comes from shared object, meaning dynamic library.\r
</p>\r
</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_macros_aka_defines">Macros (aka defines)</h3>\r
-<div class="ulist"><ul>\r
<li>\r
<p>\r
-In many cases, even in C++, use #define name "value" instead of a\r
- const char* const name = "value" because it will eliminate a symbol from\r
- the binary.\r
+<strong>spell</strong>: a type of protocol magic that the wizard uses to identify ASCII\r
+ protocols.\r
</p>\r
</li>\r
<li>\r
<p>\r
-Use inline functions instead of macros where possible (pretty much all\r
- cases except where stringification is necessary). Functions offer better\r
- typing, avoid re-expansions, and a debugger can break there.\r
+<strong>text rule</strong>: a rule loaded from the configuration that has a header and\r
+ body. The header specifies action, protocol, source and destination IP\r
+ addresses and ports, and direction. The body specifies detection and\r
+ non-detection options.\r
</p>\r
</li>\r
<li>\r
<p>\r
-All macros except simple const values should be wrapped in () and all\r
- args should be wrapped in () too to avoid surprises upon expansion.\r
- Example:\r
+<strong>wizard</strong>: inspector that applies protocol magic to determine which\r
+ inspectors should be bound to traffic absent a port specific binding.\r
+ See hex and spell.\r
</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_usage_2">Usage</h3>\r
+<div class="paragraph"><p>For the following examples "$my_path" is assumed to be the path to the\r
+Snort++ install directory. Additionally, it is assumed that "$my_path/bin"\r
+is in your PATH.</p></div>\r
+<div class="sect3">\r
+<h4 id="_environment">Environment</h4>\r
+<div class="paragraph"><p>LUA_PATH is used directly by Lua to load and run required libraries.\r
+SNORT_LUA_PATH is used by Snort to load supplemental configuration files.</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>export LUA_PATH=$my_path/include/snort/lua/\?.lua\;\;\r
+export SNORT_LUA_PATH=$my_path/etc/snort</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_help_2">Help</h4>\r
+<div class="paragraph"><p>Print the help summary:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Get help on a specific module ("stream", for example):</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-module stream</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Get help on the "-A" command line option:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-options A</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Grep for help on threads:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-config | grep thread</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Output help on "rule" options in AsciiDoc format:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --markup --help-options rule</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">Snort++ stops reading command-line options after the "--help-<strong>" and\r
+"--list-</strong>" options, so any other options should be placed before them.</td>\r
+</tr></table>\r
+</div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_sniffing_and_logging">Sniffing and Logging</h4>\r
+<div class="paragraph"><p>Read a pcap:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -r /path/to/my.pcap</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Dump the packets to stdout:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -r /path/to/my.pcap -L dump</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Dump packets with application data and layer 2 headers</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -r /path/to/my.pcap -L dump -d -e</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">Command line options must be specified separately. "snort -de" won’t\r
+work. You can still concatenate options and their arguments, however, so\r
+"snort -Ldump" will work.</td>\r
+</tr></table>\r
+</div>\r
+<div class="paragraph"><p>Dump packets from all pcaps in a directory:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -d -e</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log packets to a directory:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --pcap-dir /path/to/pcap/dir --pcap-filter '*.pcap' -L dump -l /path/to/log/dir</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_configuration_2">Configuration</h4>\r
+<div class="paragraph"><p>Validate a configuration file:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Validate a configuration file and a separate rules file:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -R $my_path/etc/snort/sample.rules</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Read rules from stdin and validate:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --stdin-rules < $my_path/etc/snort/sample.rules</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Enable warnings for Lua configurations and make warnings fatal:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --warn-all --pedantic</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Tell Snort++ where to look for additional Lua scripts:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --script-path /path/to/script/dir</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_ids_mode">IDS mode</h4>\r
+<div class="paragraph"><p>Run Snort++ in IDS mode, reading packets from a pcap:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log any generated alerts to the console using the "-A" option:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A alert_full</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Add or modify a configuration from the command line using the "--lua" option:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A cmg \\r
+ --lua 'ips = { enable_builtin_rules = true }'</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">The "--lua" option can be specified multiple times.</td>\r
+</tr></table>\r
+</div>\r
+<div class="paragraph"><p>Run Snort++ in IDS mode on an entire directory of pcaps, processing each\r
+input source on a separate thread:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
+ --pcap-filter '*.pcap' --max-packet-threads 8</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Run Snort++ on 2 interfaces, eth0 and eth1:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -i "eth0 eth1" -z 2 -A cmg</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Run Snort++ inline with the afpacket DAQ:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --daq afpacket -i "eth0:eth1" \\r
+ -A cmg</code></pre>\r
+</div></div>\r
+</div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_plugins_2">Plugins</h3>\r
+<div class="paragraph"><p>Load external plugins and use the "ex" alert:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --plugin-path $my_path/lib/snort_extra \\r
+ -A alert_ex -r /path/to/my.pcap</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Test the LuaJIT rule option <em>find</em> loaded from stdin:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --script-path $my_path/lib/snort_extra \\r
+ --stdin-rules -A cmg -r /path/to/my.pcap << END\r
+alert tcp any any -> any 80 (\r
+ sid:3; msg:"found"; content:"GET";\r
+ find:"pat='HTTP/1%.%d'" ; )\r
+END</code></pre>\r
+</div></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_output_files">Output Files</h3>\r
+<div class="paragraph"><p>To make it simple to configure outputs when you run with multiple packet\r
+threads, output files are not explicitly configured. Instead, you can use\r
+the options below to format the paths:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>#define SEQ_LT(a,b) ((int)((a) - (b)) < 0)</code></pre>\r
+<pre><code><logdir>/[<run_prefix>][<id#>][<X>]<name></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Multiline macros should be blocked (i.e. inside { }) to avoid if-else type\r
- surprises.\r
-</p>\r
-</li>\r
-</ul></div>\r
+<div class="paragraph"><p>Log to unified in the current directory:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log to unified in the current directory with a different prefix:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 \\r
+ --run-prefix take2</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Log to unified in /tmp:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -r /path/to/my.pcap -A unified2 -l /tmp</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Run 4 packet threads and log with thread number prefix (0-3):</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
+ --pcap-filter '*.pcap' -z 4 -A unified2</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Run 4 packet threads and log in thread number subdirs (0-3):</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua --pcap-dir /path/to/pcap/dir \\r
+ --pcap-filter '*.pcap' -z 4 -A unified2 --id-subdir</code></pre>\r
+</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">subdirectories are created automatically if required. Log filename\r
+is based on module name that writes the file. All text mode outputs\r
+default to stdout. These options can be combined.</td>\r
+</tr></table>\r
</div>\r
-<div class="sect2">\r
-<h3 id="_formatting">Formatting</h3>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Try to keep all source files under 2500 lines. 3000 is the max allowed.\r
- If you need more lines, chances are that the code needs to be refactored.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Indent 4 space chars … no tabs!\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-If you need to indent many times, something could be rewritten or\r
- restructured to make it clearer. Fewer indents is generally easier to\r
- write, easier to read, and overall better code.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Braces go on the line immediately following a new scope (function\r
- signature, if, else, loop, switch, etc.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Use consistent spacing and line breaks. Always indent 4 spaces from the\r
- breaking line. Keep lines less than 100 chars; it greatly helps\r
- readability.\r
-</p>\r
+<div class="sect3">\r
+<h4 id="_daq_alternatives">DAQ Alternatives</h4>\r
+<div class="paragraph"><p>Process hext packets from stdin:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>No:\r
- calling_a_func_with_a_long_name(arg1,\r
- arg2,\r
- arg3);</code></pre>\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --daq-dir $my_path/lib/snort/daqs --daq hext -i tty << END\r
+$packet 10.1.2.3 48620 -> 10.9.8.7 80\r
+"GET / HTTP/1.1\r\n"\r
+"Host: localhost\r\n"\r
+"\r\n"\r
+END</code></pre>\r
</div></div>\r
+<div class="paragraph"><p>Process raw ethernet from hext file:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>Yes:\r
- calling_a_func_with_a_long_name(\r
- arg1, arg2, arg3);</code></pre>\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --daq-dir $my_path/lib/snort/daqs --daq hext \\r
+ --daq-var dlt=1 -r <hext-file></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Put function signature on one line, except when breaking for the arg\r
- list:\r
-</p>\r
+<div class="paragraph"><p>Process a directory of plain files (ie non-pcap) with 4 threads with 8K\r
+buffers:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>No:\r
- inline\r
- bool foo()\r
- { // ...</code></pre>\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --daq-dir $my_path/lib/snort/daqs --daq file \\r
+ --pcap-dir path/to/files -z 4 -s 8192</code></pre>\r
</div></div>\r
+<div class="paragraph"><p>Bridge two TCP connections on port 8000 and inspect the traffic:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>Yes:\r
- inline bool foo()\r
- { // ...</code></pre>\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --daq-dir $my_path/lib/snort/daqs --daq socket</code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Put conditional code on the line following the if so it is easy to break\r
- on the conditional block:\r
-</p>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_logger_alternatives">Logger Alternatives</h4>\r
+<div class="paragraph"><p>Dump TCP stream payload in hext mode:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>No:\r
- if ( test ) foo();</code></pre>\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -L hext</code></pre>\r
</div></div>\r
+<div class="paragraph"><p>Output timestamp, pkt_num, proto, pkt_gen, dgm_len, dir, src_ap, dst_ap,\r
+rule, action for each alert:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>Yes:\r
- if ( test )\r
- foo();</code></pre>\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua -A csv</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>Output the old test format alerts:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort -c $my_path/etc/snort/snort.lua \\r
+ --lua "alert_csv = { fields = 'pkt_num gid sid rev', separator = '\t' }"</code></pre>\r
</div></div>\r
-</li>\r
-</ul></div>\r
</div>\r
-<div class="sect2">\r
-<h3 id="_headers">Headers</h3>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Don’t hesitate to create a new header if it is needed. Don’t lump\r
- unrelated stuff into an header because it is convenient.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Write header guards like this (leading underscores are reserved for\r
- system stuff). In my_header.h:\r
-</p>\r
+<div class="sect3">\r
+<h4 id="_shell">Shell</h4>\r
+<div class="paragraph"><p>You must build with --enable-shell to make the command line shell available.</p></div>\r
+<div class="paragraph"><p>Enable shell mode:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>#ifndef MY_HEADER_H\r
-#define MY_HEADER_H\r
-// ...\r
-#endif</code></pre>\r
+<pre><code>snort --shell <args></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Includes from a different directory should specify parent directory.\r
- This makes it clear exactly what is included and avoids the primordial\r
- soup that results from using -I this -I that -I the_other_thing … .\r
-</p>\r
+<div class="paragraph"><p>You will see the shell mode command prompt, which looks like this:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>// given:\r
-src/foo/foo.cc\r
-src/bar/bar.cc\r
-src/bar/baz.cc</code></pre>\r
+<pre><code>o")~</code></pre>\r
</div></div>\r
+<div class="paragraph"><p>(The prompt can be changed with the SNORT_PROMPT environment variable.)</p></div>\r
+<div class="paragraph"><p>You can pause immediately after loading the configuration and again before\r
+exiting with:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>// in baz.cc\r
-#include "bar.h"</code></pre>\r
+<pre><code>snort --shell --pause <args></code></pre>\r
</div></div>\r
+<div class="paragraph"><p>In that case you must issue the resume() command to continue. Enter quit()\r
+to terminate Snort or detach() to exit the shell. You can list the\r
+available commands with help().</p></div>\r
+<div class="paragraph"><p>To enable local telnet access on port 12345:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>// in foo.cc\r
-#include "bar/bar.h"</code></pre>\r
+<pre><code>snort --shell -j 12345 <args></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Includes within installed headers should specify parent directory.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Just because it is a #define doesn’t mean it goes in a header.\r
- Everything should be scoped as tightly as possible. Shared\r
- implementation declarations should go in a separate header from the\r
- interface. And so on.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-A .cc should include its own .h before any others (including\r
- system headers). This ensures that the header stands on its own and can\r
- be used by clients without include prerequisites and the developer will\r
- be the first to find a dependency problem.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Include required headers, all required headers, and nothing but required\r
- headers. Don’t just clone a bunch of headers because it is convenient.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Try to keep includes in alpha order. This makes it easier to maintain,\r
- avoid duplicates, etc.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Any file depending on #ifdefs should include config.h as shown below. A\r
- .h should include it before any other includes, and a .cc should include\r
- it immediately after the include of its own .h.\r
-</p>\r
+<div class="paragraph"><p>The command line interface is still under development. Suggestions are\r
+welcome.</p></div>\r
+</div>\r
+<div class="sect3">\r
+<h4 id="_signals">Signals</h4>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">The following examples assume that Snort++ is currently running and\r
+has a process ID of <pid>.</td>\r
+</tr></table>\r
+</div>\r
+<div class="paragraph"><p>Modify and Reload Configuration:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>#ifdef HAVE_CONFIG_H\r
-#include "config.h"\r
-#endif</code></pre>\r
+<pre><code>echo 'suppress = { { gid = 1, sid = 2215 } }' >> $my_path/etc/snort/snort.lua\r
+kill -hup <pid></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Do not put using statements in headers unless they are tightly scoped.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_warnings">Warnings</h3>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-With g++, use at least these compiler flags:\r
-</p>\r
+<div class="paragraph"><p>Dump stats to stdout:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>-Wall -Wextra -pedantic -Wformat -Wformat-security\r
--Wunused-but-set-variable -Wno-deprecated-declarations\r
--fsanitize=address -fno-omit-frame-pointer</code></pre>\r
+<pre><code>kill -usr1 <pid></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-With clang, use at least these compiler flags:\r
-</p>\r
+<div class="paragraph"><p>Shutdown normally:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>-Wall -Wextra -pedantic -Wformat -Wformat-security\r
--Wno-deprecated-declarations\r
--fsanitize=address -fno-omit-frame-pointer</code></pre>\r
+<pre><code>kill -term <pid></code></pre>\r
</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Two macros (PADDING_GUARD_BEGIN and PADDING_GUARD_END) are provided by\r
- utils/cpp_macros.h. These should be used to surround any structure used as\r
- a hash key with a raw comparator or that would otherwise suffer from\r
- unintentional padding. A compiler warning will be generated if any structure\r
- definition is automatically padded between the macro invocations.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Then Fix All Warnings and Aborts. None Allowed.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_uncrustify">Uncrustify</h3>\r
-<div class="paragraph"><p>Currently using uncrustify from at <a href="https://github.com/bengardner/uncrustify">https://github.com/bengardner/uncrustify</a>\r
-to reformat legacy code and anything that happens to need a makeover at\r
-some point.</p></div>\r
-<div class="paragraph"><p>The working config is crusty.cfg in the top level directory. It does well\r
-but will munge some things. Specially formatted INDENT-OFF comments were\r
-added in 2 places to avoid a real mess.</p></div>\r
-<div class="paragraph"><p>You can use uncrustify something like this:</p></div>\r
+<div class="paragraph"><p>Exit without flushing packets:</p></div>\r
<div class="literalblock">\r
<div class="content">\r
-<pre><code>uncrustify -c crusty.cfg --replace file.cc</code></pre>\r
+<pre><code>kill -quit <pid></code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>List available signals:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>snort --help-signals</code></pre>\r
</div></div>\r
+<div class="admonitionblock">\r
+<table><tr>\r
+<td class="icon">\r
+<img src="./images/icons/note.png" alt="Note" />\r
+</td>\r
+<td class="content">The available signals may vary from platform to platform.</td>\r
+</tr></table>\r
</div>\r
</div>\r
</div>\r
-<div class="sect1">\r
-<h2 id="_reference_2">Reference</h2>\r
-<div class="sectionbody">\r
<div class="sect2">\r
-<h3 id="_build_options_2">Build Options</h3>\r
-<div class="paragraph"><p>The options listed below must be explicitly enabled so they are built\r
-into the Snort binary. For a full list of build options, run ./configure\r
+<h3 id="_optional_features">Optional Features</h3>\r
+<div class="paragraph"><p>The features listed below must be explicitly enabled so they are built\r
+into the Snort binary. For a full list of build features, run ./configure\r
--help.</p></div>\r
<div class="ulist"><ul>\r
<li>\r
</p>\r
</li>\r
</ul></div>\r
-<div class="paragraph"><p>These options are built only if the required libraries and headers are\r
+<div class="paragraph"><p>These features are built only if the required libraries and headers are\r
present. There is no need to explicitly enable.</p></div>\r
<div class="ulist"><ul>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>-w</strong> dump 802.11 management and control frames\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>-W</strong> lists available interfaces\r
</p>\r
</li>\r
</ul></div>\r
</div>\r
<div class="sect2">\r
-<h3 id="_configuration_4">Configuration</h3>\r
+<h3 id="_parameters">Parameters</h3>\r
+<div class="paragraph"><p>Parameters are given with this format:</p></div>\r
+<div class="literalblock">\r
+<div class="content">\r
+<pre><code>type name = default: help { range }</code></pre>\r
+</div></div>\r
+<div class="paragraph"><p>The following types are used:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+<strong>addr</strong>: any valid IP4 or IP6 address or CIDR\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>addr_list</strong>: a space separated list of addr values\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>bit_list</strong>: a list of consecutive integer values from 1 to the range\r
+ maximum\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>bool</strong>: true or false\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>dynamic</strong>: a select type determined by loaded plugins\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>enum</strong>: a string selected from the given range\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>implied</strong>: an IPS rule option that takes no value but means true\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>int</strong>: a whole number in the given range\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>ip4</strong>: an IP4 address or CIDR\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>mac</strong>: an ethernet address with the form 01:02:03:04:05:06\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>multi</strong>: one or more space separated strings from the given range\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>port</strong>: an int in the range 0:65535 indicating a TCP or UDP port number\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>real</strong>: a real number in the given range\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>select</strong>: a string selected from the given range\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+<strong>string</strong>: any string with no more than the given length, if any\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>The parameter name may be adorned in various ways to indicate additional\r
+information about the type and use of the parameter:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+For Lua configuration (not IPS rules), if the name ends with [] it is\r
+ a list item and can be repeated.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+For IPS rules only, names starting with ~ indicate positional\r
+ parameters. The names of such parameters do not appear in the rule.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+IPS rules may also have a wild card parameter, which is indicated by a\r
+ *. Only used for metadata that Snort ignores.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+The snort module has command line options starting with a -.\r
+</p>\r
+</li>\r
+</ul></div>\r
+<div class="paragraph"><p>Some additional details to note:</p></div>\r
+<div class="ulist"><ul>\r
+<li>\r
+<p>\r
+Table and variable names are case sensitive; use lower case only.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+String values are case sensitive too; use lower case only.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+Numeric ranges may be of the form low:high where low and high are\r
+ bounds included in the range. If either is omitted, there is no hard\r
+ bound. E.g. 0: means any x where x >= 0.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+Strings may have a numeric range indicating a length limit; otherwise\r
+ there is no hard limit.\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
+bit_list is typically used to store a set of byte, port, or VLAN ID\r
+ values.\r
+</p>\r
+</li>\r
+</ul></div>\r
+</div>\r
+<div class="sect2">\r
+<h3 id="_configuration_3">Configuration</h3>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-int <strong>alerts.detection_filter_memcap</strong> = 1048576: set available bytes of memory for detection_filters { 0: }\r
+int <strong>alerts.detection_filter_memcap</strong> = 1048576: set available memory for filters { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>alerts.event_filter_memcap</strong> = 1048576: set available bytes of memory for event_filters { 0: }\r
+int <strong>alerts.event_filter_memcap</strong> = 1048576: set available memory for filters { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>alerts.rate_filter_memcap</strong> = 1048576: set available bytes of memory for rate_filters { 0: }\r
+int <strong>alerts.rate_filter_memcap</strong> = 1048576: set available memory for filters { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-string <strong>appid.app_detector_dir</strong>: directory to load appid detectors from\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.app_stats_period</strong> = 300: time period for collecting and logging appid statistics { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.app_stats_rollover_size</strong> = 20971520: max file size for appid stats before rolling over the log file { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.app_stats_rollover_time</strong> = 86400: max time period for collection appid stats before rolling over the log file { 0: }\r
+string <strong>appid.app_detector_dir</strong>: directory to load AppId detectors from\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>appid.debug</strong> = false: enable appid debug logging\r
+string <strong>appid.app_stats_filename</strong>: Filename for logging AppId statistics\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>appid.dump_ports</strong> = false: enable dump of appid port information\r
+int <strong>appid.app_stats_period</strong> = 300: time period for collecting and logging AppId statistics { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>appid.instance_id</strong> = 0: instance id - need more details for what this is { 0: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>appid.log_stats</strong> = false: enable logging of appid statistics\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>appid.memcap</strong> = 0: disregard - not implemented { 0: }\r
+int <strong>appid.app_stats_rollover_size</strong> = 20971520: max file size for AppId stats before rolling over the log file { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>appids.~</strong>: comma separated list of application names\r
+int <strong>appid.app_stats_rollover_time</strong> = 86400: max time period for collection AppId stats before rolling over the log file { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-addr <strong>appid.session_log_filter.dst_ip</strong> = 0.0.0.0/32: destination ip address in CIDR format\r
+string <strong>appid.conf</strong>: RNA configuration file\r
</p>\r
</li>\r
<li>\r
<p>\r
-port <strong>appid.session_log_filter.dst_port</strong>: destination port { 1: }\r
+bool <strong>appid.debug</strong> = false: enable AppId debug logging\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>appid.session_log_filter.log_all_sessions</strong> = false: enable logging for all appid sessions\r
+bool <strong>appid.dump_ports</strong> = false: enable dump of AppId port information\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>appid.session_log_filter.protocol</strong>: ip protocol\r
+int <strong>appid.instance_id</strong> = 0: instance id - need more details for what this is { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-addr <strong>appid.session_log_filter.src_ip</strong> = 0.0.0.0/32: source ip address in CIDR format\r
+int <strong>appid.memcap</strong> = 268435456: time period for collecting and logging AppId statistics { 1048576:3221225472 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-port <strong>appid.session_log_filter.src_port</strong>: source port { 1: }\r
+string <strong>appids.~</strong>: appid option\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>appid.thirdparty_appid_dir</strong>: directory to load thirdparty appid detectors from\r
+string <strong>appid.thirdparty_appid_dir</strong>: directory to load thirdparty AppId detectors from\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>asn1.absolute_offset</strong>: absolute offset from the beginning of the packet { 0: }\r
+int <strong>asn1.absolute_offset</strong>: Absolute offset from the beginning of the packet. { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>asn1.bitstring_overflow</strong>: detects invalid bitstring encodings that are known to be remotely exploitable\r
+implied <strong>asn1.bitstring_overflow</strong>: Detects invalid bitstring encodings that are known to be remotely exploitable.\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>asn1.double_overflow</strong>: detects a double ASCII encoding that is larger than a standard buffer\r
+implied <strong>asn1.double_overflow</strong>: Detects a double ASCII encoding that is larger than a standard buffer.\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>asn1.oversize_length</strong>: compares ASN.1 type lengths with the supplied argument { 0: }\r
+int <strong>asn1.oversize_length</strong>: Compares ASN.1 type lengths with the supplied argument. { 0: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>asn1.relative_offset</strong>: relative offset from the cursor\r
+int <strong>asn1.relative_offset</strong>: relative offset from the cursor.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>base64_decode.bytes</strong>: number of base64 encoded bytes to decode { 1: }\r
+int <strong>base64_decode.bytes</strong>: Number of base64 encoded bytes to decode. { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>base64_decode.offset</strong> = 0: bytes past start of buffer to start decoding { 0: }\r
+int <strong>base64_decode.offset</strong> = 0: Bytes past start of buffer to start decoding. { 0: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>base64_decode.relative</strong>: apply offset to cursor instead of start of buffer\r
+implied <strong>base64_decode.relative</strong>: Apply offset to cursor instead of start of buffer.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>dce_smb.smb_fingerprint_policy</strong> = none: Target based SMB policy to use { none | client | server | both }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>dce_smb.smb_invalid_shares</strong>: SMB shares to alert on\r
+enum <strong>dce_smb.smb_fingerprint_policy</strong> = none: Target based SMB policy to use { none | client | server | both }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>dce_smb.smb_legacy_mode</strong> = false: inspect only SMBv1\r
+string <strong>dce_smb.smb_invalid_shares</strong>: SMB shares to alert on\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>dce_udp.disable_defrag</strong> = false: Disable DCE/RPC defragmentation\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-int <strong>dce_udp.max_frag_len</strong> = 65535: Maximum fragment size for defragmentation { 1514:65535 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>detection.asn1</strong> = 256: maximum decode nodes { 1: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-int <strong>file_id.max_files_cached</strong> = 65536: maximal number of files cached in memory { 8: }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>file_id.show_data_depth</strong> = 100: print this many octets { 0: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>ftp_server.data_rest_cmds</strong>: check the formatting of the given commands\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
string <strong>ftp_server.data_xfer_cmds</strong>: check the formatting of the given commands\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_cookie.request</strong>: match against the cookie from the request message even when examining the response\r
+implied <strong>http_cookie.request</strong>: Match against the cookie from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_cookie.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_cookie.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_cookie.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_cookie.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-string <strong>http_header.field</strong>: restrict to given header. Header name is case insensitive.\r
+string <strong>http_header.field</strong>: Restrict to given header. Header name is case insensitive.\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_header.request</strong>: match against the headers from the request message even when examining the response\r
+implied <strong>http_header.request</strong>: Match against the headers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_header.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_header.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_header.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_header.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>http_inspect.max_javascript_whitespaces</strong> = 200: maximum consecutive whitespaces allowed within the Javascript obfuscated data { 1:65535 }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>http_inspect.normalize_javascript</strong> = false: normalize javascript in response bodies\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-bool <strong>http_inspect.normalize_utf</strong> = true: normalize charset utf encodings in response bodies\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>http_inspect.oversize_dir_length</strong> = 300: maximum length for URL directory { 1:65535 }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_method.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_method.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_method.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_method.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_cookie.request</strong>: match against the cookie from the request message even when examining the response\r
+implied <strong>http_raw_cookie.request</strong>: Match against the cookie from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_cookie.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_cookie.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_cookie.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_cookie.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_header.request</strong>: match against the headers from the request message even when examining the response\r
+implied <strong>http_raw_header.request</strong>: Match against the headers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_header.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_header.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_header.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_header.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_request.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_request.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_request.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_request.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_status.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_status.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_status.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_status.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_trailer.request</strong>: match against the trailers from the request message even when examining the response\r
+implied <strong>http_raw_trailer.request</strong>: Match against the trailers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_trailer.with_body</strong>: parts of this rule examine HTTP response message body (must be combined with request)\r
+implied <strong>http_raw_trailer.with_body</strong>: Parts of this rule examine HTTP response message body (must be combined with request)\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_trailer.with_header</strong>: parts of this rule examine HTTP response message headers (must be combined with request)\r
+implied <strong>http_raw_trailer.with_header</strong>: Parts of this rule examine HTTP response message headers (must be combined with request)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_uri.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_raw_uri.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_raw_uri.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_raw_uri.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_stat_code.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_stat_code.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_stat_code.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_stat_code.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_stat_msg.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_stat_msg.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_stat_msg.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_stat_msg.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_trailer.request</strong>: match against the trailers from the request message even when examining the response\r
+implied <strong>http_trailer.request</strong>: Match against the trailers from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_trailer.with_body</strong>: parts of this rule examine HTTP message body (must be combined with request)\r
+implied <strong>http_trailer.with_body</strong>: Parts of this rule examine HTTP message body (must be combined with request)\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_trailer.with_header</strong>: parts of this rule examine HTTP response message headers (must be combined with request)\r
+implied <strong>http_trailer.with_header</strong>: Parts of this rule examine HTTP response message headers (must be combined with request)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_uri.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_uri.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_uri.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_uri.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_version.request</strong>: match against the version from the request message even when examining the response\r
+implied <strong>http_version.request</strong>: Match against the version from the request message even when examining the response\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_version.with_body</strong>: parts of this rule examine HTTP message body\r
+implied <strong>http_version.with_body</strong>: Parts of this rule examine HTTP message body\r
</p>\r
</li>\r
<li>\r
<p>\r
-implied <strong>http_version.with_trailer</strong>: parts of this rule examine HTTP message trailers\r
+implied <strong>http_version.with_trailer</strong>: Parts of this rule examine HTTP message trailers\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
+int <strong>imap.b64_decode_depth</strong> = 1460: base64 decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.bitenc_decode_depth</strong> = 1460: non-Encoded MIME attachment extraction depth { -1:65535 }\r
+int <strong>imap.bitenc_decode_depth</strong> = 1460: Non-Encoded MIME attachment extraction depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.qp_decode_depth</strong> = 1460: quoted Printable decoding depth { -1:65535 }\r
+int <strong>imap.qp_decode_depth</strong> = 1460: Quoted Printable decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>imap.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
+int <strong>imap.uu_decode_depth</strong> = 1460: Unix-to-Unix decoding depth { -1:65535 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>latency.packet.action</strong> = none: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }\r
+enum <strong>latency.packet.action</strong> = alert_and_log: event action if packet times out and is fastpathed { none | alert | log | alert_and_log }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>latency.rule.action</strong> = none: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }\r
+enum <strong>latency.rule.action</strong> = alert_and_log: event action for rule latency enable and suspend events { none | alert | log | alert_and_log }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>network.layers</strong> = 40: the maximum number of protocols that Snort can correctly decode { 3:255 }\r
+int <strong>network.layers</strong> = 40: The maximum number of protocols that Snort can correctly decode { 3:255 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>network.max_ip6_extensions</strong> = 0: the maximum number of IP6 options Snort will process for a given IPv6 layer before raising 116:456 (0 = unlimited) { 0:255 }\r
+int <strong>network.max_ip6_extensions</strong> = 0: The number of IP6 options Snort will process for a given IPv6 layer. If this limit is hit, rule 116:456 may fire. 0 = unlimited { 0:255 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>network.max_ip_layers</strong> = 0: the maximum number of IP layers Snort will process for a given packet before raising 116:293 (0 = unlimited) { 0:255 }\r
+int <strong>network.max_ip_layers</strong> = 0: The maximum number of IP layers Snort will process for a given packet If this limit is hit, rule 116:293 may fire. 0 = unlimited { 0:255 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>output.obfuscate_pii</strong> = false: mask all but the last 4 characters of credit card and social security numbers\r
+bool <strong>output.obfuscate_pii</strong> = false: Mask all but the last 4 characters of credit card and social security numbers\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>perf_monitor.flow_ip_memcap</strong> = 52428800: maximum memory in bytes for flow tracking { 8200: }\r
+int <strong>perf_monitor.flow_ip_memcap</strong> = 52428800: maximum memory for flow tracking { 8200: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>perf_monitor.format</strong> = csv: output format for stats { csv | text }\r
+enum <strong>perf_monitor.format</strong> = csv: Output format for stats { csv | text }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>perf_monitor.output</strong> = file: output location for stats { file | console }\r
+enum <strong>perf_monitor.output</strong> = file: Output location for stats { file | console }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>perf_monitor.summary</strong> = false: output summary at shutdown\r
+bool <strong>perf_monitor.summary</strong> = false: Output summary at shutdown\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>port_scan_global.memcap</strong> = 1048576: maximum tracker memory in bytes { 1: }\r
+int <strong>port_scan_global.memcap</strong> = 1048576: maximum tracker memory { 1: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-enum <strong>rate_filter[].new_action</strong> = alert: take this action on future hits until timeout { log | pass | alert | drop | block | reset }\r
+select <strong>rate_filter[].new_action</strong> = alert: take this action on future hits until timeout { alert | drop | log | pass | | reject | sdrop }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>reputation.memcap</strong> = 500: maximum total MB of memory allocated { 1:4095 }\r
+int <strong>reputation.memcap</strong> = 500: maximum total memory allocated { 1:4095 }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>rpc.~app</strong>: application number\r
+string <strong>rpc.~app</strong>: application number\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>rpc.proc</strong>: procedure number or * for any\r
+string <strong>rpc.~proc</strong>: procedure number or * for any\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>rpc.ver</strong>: version number or * for any\r
+string <strong>rpc.~ver</strong>: version number or * for any\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+bool <strong>search_engine.debug_print_fast_pattern</strong> = false: print fast pattern info for each rule\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
bool <strong>search_engine.debug_print_nocontent_rule_tests</strong> = false: print rule group info during packet evaluation\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-bool <strong>search_engine.show_fast_patterns</strong> = false: print fast pattern info for each rule\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
bool <strong>search_engine.split_any_any</strong> = false: evaluate any-any rules separately to save memory\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>side_channel.connector</strong>: connector handle\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
string <strong>side_channel.connectors[].connector</strong>: connector handle\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+implied <strong>snort.-w</strong>: dump 802.11 management and control frames\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
implied <strong>snort.-W</strong>: lists available interfaces\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.file_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.file_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.icmp_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.icmp_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.icmp_cache.max_sessions</strong> = 65536: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.icmp_cache.max_sessions</strong> = 32768: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
+int <strong>stream.ip_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.max_sessions</strong> = 16384: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.ip_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.ip_cache.pruning_timeout</strong> = 30: minimum inactive time before being eligible for pruning { 1: }\r
+int <strong>stream.ip_cache.max_sessions</strong> = 16384: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-bool <strong>stream.ip_frags_only</strong> = false: don’t process non-frag flows\r
+int <strong>stream.ip_cache.pruning_timeout</strong> = 30: minimum inactive time before being eligible for pruning { 1: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream_ip.trace</strong>: mask for enabling debug traces in module\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
enum <strong>stream_reassemble.action</strong>: stop or start stream reassembly { disable|enable }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.tcp_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.tcp_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.tcp_cache.max_sessions</strong> = 262144: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.tcp_cache.max_sessions</strong> = 131072: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.udp_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.udp_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
<li>\r
<p>\r
-int <strong>stream.udp_cache.max_sessions</strong> = 131072: maximum simultaneous sessions tracked before pruning { 2: }\r
+int <strong>stream.udp_cache.max_sessions</strong> = 65536: maximum simultaneous sessions tracked before pruning { 2: }\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+int <strong>stream.user_cache.cleanup_pct</strong> = 5: percent of cache to clean when max_sessions is reached { 1:100 }\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
int <strong>stream.user_cache.idle_timeout</strong> = 180: maximum inactive time before retiring session tracker { 1: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-string <strong>tcp_connector.address</strong>: address\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-port <strong>tcp_connector.base_port</strong>: base port number\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-string <strong>tcp_connector.connector</strong>: connector name\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-enum <strong>tcp_connector.setup</strong>: stream establishment { call | answer }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
int <strong>telnet.ayt_attack_thresh</strong> = -1: alert on this number of consecutive telnet AYT commands { -1: }\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-multi <strong>wizard.curses</strong>: enable service identification based on internal algorithm { dce_smb | dce_udp | dce_tcp }\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
bool <strong>wizard.hexes[].client_first</strong> = true: which end initiates data transfer\r
</p>\r
</li>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
-<strong>appid.aim clients</strong>: count of aim clients discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.battlefield flows</strong>: count of battle field flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.bgp flows</strong>: count of bgp flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.bit clients</strong>: count of bittorrent clients discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.bit flows</strong>: count of bittorrent flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.bittracker clients</strong>: count of bittorrent tracker clients discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.bootp flows</strong>: count of bootp flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.dcerpc tcp flows</strong>: count of dce rpc flows over tcp discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.dcerpc udp flows</strong>: count of dce rpc flows over udp discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.direct connect flows</strong>: count of direct connect flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.dns tcp flows</strong>: count of dns flows over tcp discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.dns udp flows</strong>: count of dns flows over udp discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.ftp flows</strong>: count of ftp flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.ftps flows</strong>: count of ftps flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.http flows</strong>: count of http flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.ignored packets</strong>: count of packets ignored\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.imap flows</strong>: count of imap service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.imaps flows</strong>: count of imap TLS service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.irc flows</strong>: count of irc service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.kerberos clients</strong>: count of kerberos clients discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.kerberos flows</strong>: count of kerberos service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.kerberos users</strong>: count of kerberos users discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.lpr flows</strong>: count of lpr service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.mdns flows</strong>: count of mdns service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.msn clients</strong>: count of msn clients discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.mysql flows</strong>: count of mysql service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.netbios dgm flows</strong>: count of netbios-dgm service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.netbios ns flows</strong>: count of netbios-ns service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.netbios ssn flows</strong>: count of netbios-ssn service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.nntp flows</strong>: count of nntp flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.ntp flows</strong>: count of ntp flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.packets</strong>: count of packets received\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.pop flows</strong>: count of pop service flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.processed packets</strong>: count of packets processed\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.radius flows</strong>: count of radius flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.rexec flows</strong>: count of rexec flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.rfb flows</strong>: count of rfb flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.rlogin flows</strong>: count of rlogin flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.rpc flows</strong>: count of rpc flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.rshell flows</strong>: count of rshell flows discovered\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>appid.rsync flows</strong>: count of rsync service flows discovered\r
+<strong>appid.battlefield_flows</strong>: count of battle field flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rtmp flows</strong>: count of rtmp flows discovered\r
+<strong>appid.bgp_flows</strong>: count of bgp flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.rtp clients</strong>: count of rtp clients discovered\r
+<strong>appid.bit_clients</strong>: count of bittorrent clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.sip clients</strong>: count of SIP clients discovered\r
+<strong>appid.bit_flows</strong>: count of bittorrent flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.sip flows</strong>: count of SIP flows discovered\r
+<strong>appid.bittracker_clients</strong>: count of bittorrent tracker clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp aol clients</strong>: count of AOL smtp clients discovered\r
+<strong>appid.dcerpc_tcp_flows</strong>: count of dce rpc flows over tcp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp applemail clients</strong>: count of Apple Mail smtp clients discovered\r
+<strong>appid.dcerpc_udp_flows</strong>: count of dce rpc flows over udp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp eudora clients</strong>: count of Eudora smtp clients discovered\r
+<strong>appid.dns_tcp_flows</strong>: count of dns flows over tcp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp eudora pro clients</strong>: count of Eudora Pro smtp clients discovered\r
+<strong>appid.dns_udp_flows</strong>: count of dns flows over udp discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp evolution clients</strong>: count of Evolution smtp clients discovered\r
+<strong>appid.ftp_flows</strong>: count of ftp flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp flows</strong>: count of smtp flows discovered\r
+<strong>appid.ftps_flows</strong>: count of ftps flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp kmail clients</strong>: count of KMail smtp clients discovered\r
+<strong>appid.imap_flows</strong>: count of imap service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp lotus notes clients</strong>: count of Lotus Notes smtp clients discovered\r
+<strong>appid.imaps_flows</strong>: count of imap TLS service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp microsoft outlook clients</strong>: count of Microsoft Outlook smtp clients discovered\r
+<strong>appid.irc_flows</strong>: count of irc service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp microsoft outlook express clients</strong>: count of Microsoft Outlook Express smtp clients discovered\r
+<strong>appid.kerberos_clients</strong>: count of kerberos clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp microsoft outlook imo clients</strong>: count of Microsoft Outlook IMO smtp clients discovered\r
+<strong>appid.kerberos_flows</strong>: count of kerberos service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp mutt clients</strong>: count of Mutt smtp clients discovered\r
+<strong>appid.kerberos_users</strong>: count of kerberos users discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtps flows</strong>: count of smtps flows discovered\r
+<strong>appid.lpr_flows</strong>: count of lpr service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.smtp thunderbird clients</strong>: count of Thunderbird smtp clients discovered\r
+<strong>appid.mdns_flows</strong>: count of mdns service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.snmp flows</strong>: count of snmp flows discovered\r
+<strong>appid.mysql_flows</strong>: count of mysql service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ssh clients</strong>: count of ssh clients discovered\r
+<strong>appid.netbios_flows</strong>: count of netbios service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ssh flows</strong>: count of ssh flows discovered\r
+<strong>appid.packets</strong>: count of packets processed by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.ssl flows</strong>: count of ssl flows discovered\r
+<strong>appid.pop_flows</strong>: count of pop service flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.telnet flows</strong>: count of telnet flows discovered\r
+<strong>appid.smtp_flows</strong>: count of smtp flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.tftp flows</strong>: count of tftp flows discovered\r
+<strong>appid.smtps_flows</strong>: count of smtps flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.timbuktu flows</strong>: count of timbuktu flows discovered\r
+<strong>appid.ssh_clients</strong>: count of ssh clients discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.tns clients</strong>: count of tns clients discovered\r
+<strong>appid.ssh_flows</strong>: count of ssh flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.tns flows</strong>: count of tns flows discovered\r
+<strong>appid.ssl_flows</strong>: count of ssl flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.vnc clients</strong>: count of vnc clients discovered\r
+<strong>appid.telnet_flows</strong>: count of telnet flows discovered by appid\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>appid.yahoo messenger clients</strong>: count of Yahoo Messenger clients discovered\r
+<strong>appid.timbuktu_flows</strong>: count of timbuktu flows discovered by appid\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>dce_smb.aborted sessions</strong>: total aborted sessions\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>dce_smb.Alter context responses</strong>: total connection-oriented alter context responses\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>dce_smb.bad autodetects</strong>: total bad autodetects\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>dce_smb.Bind acks</strong>: total connection-oriented binds acks\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.Ignored bytes</strong>: total ignored bytes\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>dce_smb.Max outstanding requests</strong>: total smb maximum outstanding requests\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 close</strong>: total number of SMBv2 close packets seen\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_smb.SMBv2 create</strong>: total number of SMBv2 create packets seen\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_smb.SMBv2 read</strong>: total number of SMBv2 read packets seen\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_smb.SMBv2 set info</strong>: total number of SMBv2 set info packets seen\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_smb.SMBv2 tree connect</strong>: total number of SMBv2 tree connect packets seen\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_smb.SMBv2 tree disconnect</strong>: total number of SMBv2 tree disconnect packets seen\r
+<strong>dce_tcp.aborted sessions</strong>: total aborted sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_smb.SMBv2 write</strong>: total number of SMBv2 write packets seen\r
+<strong>dce_tcp.Alter context responses</strong>: total connection-oriented alter context responses\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Alter context responses</strong>: total connection-oriented alter context responses\r
+<strong>dce_tcp.Alter contexts</strong>: total connection-oriented alter contexts\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Alter contexts</strong>: total connection-oriented alter contexts\r
+<strong>dce_tcp.Auth3s</strong>: total connection-oriented auth3s\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_tcp.Auth3s</strong>: total connection-oriented auth3s\r
+<strong>dce_tcp.bad autodetects</strong>: total bad autodetects\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp.Acks</strong>: total connection-less acks\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Cancel acks</strong>: total connection-less cancel acks\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Cancels</strong>: total connection-less cancels\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Client facks</strong>: total connection-less client facks\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.events</strong>: total events\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Faults</strong>: total connection-less faults\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Fragments</strong>: total connection-less fragments\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Frags reassembled</strong>: total connection-less fragments reassembled\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Max fragment size</strong>: connection-less maximum fragment size\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Max seqnum</strong>: max connection-less seqnum\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.No calls</strong>: total connection-less no calls\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Other requests</strong>: total connection-less other requests\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Other responses</strong>: total connection-less other responses\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Ping</strong>: total connection-less ping\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Rejects</strong>: total connection-less rejects\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Requests</strong>: total connection-less requests\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Responses</strong>: total connection-less responses\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Server facks</strong>: total connection-less server facks\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.udp packets</strong>: total udp packets\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.udp sessions</strong>: total udp sessions\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>dce_udp.Working</strong>: total connection-less working\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>detection.alert limit</strong>: events previously triggered on same PDU\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>detection.hard evals</strong>: non-fast pattern rule evaluations\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>detection.header searches</strong>: fast pattern searches in header buffer\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>detection.slow searches</strong>: non-fast pattern rule evaluations\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>detection.total alerts</strong>: alerts including IP reputation\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>file_id.cache failures</strong>: number of file cache add failures\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>file_id.total file data</strong>: number of file data bytes processed\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>file_id.total files</strong>: number of files processed\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>file_log.total events</strong>: total file events\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.max usecs</strong>: maximum usecs elapsed\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>latency.packet timeouts</strong>: packets that timed out\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>latency.rule eval timeouts</strong>: rule evals that timed out\r
+<strong>latency.packet_timeouts</strong>: packets that timed out\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.rule tree enables</strong>: rule tree re-enables\r
+<strong>latency.rule_eval_timeouts</strong>: rule evals that timed out\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.total packets</strong>: total packets monitored\r
+<strong>latency.rule_tree_enables</strong>: rule tree re-enables\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.total rule evals</strong>: total rule evals monitored\r
+<strong>latency.total_packets</strong>: total packets monitored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>latency.total usecs</strong>: total usecs elapsed\r
+<strong>latency.total_rule_evals</strong>: total rule evals monitored\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>reputation.memory allocated</strong>: total memory allocated\r
+<strong>reputation.memory_allocated</strong>: total memory allocated\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file ha prunes</strong>: file sessions pruned by high availability sync\r
+<strong>stream.file memcap prunes</strong>: file sessions pruned due to memcap\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file idle prunes</strong>: file sessions pruned due to timeout\r
+<strong>stream.file preemptive prunes</strong>: file sessions pruned during preemptive pruning\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file memcap prunes</strong>: file sessions pruned due to memcap\r
+<strong>stream.file timeout prunes</strong>: file sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file preemptive prunes</strong>: file sessions pruned during preemptive pruning\r
+<strong>stream.file total prunes</strong>: total file sessions pruned\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file total prunes</strong>: total file sessions pruned\r
+<strong>stream.file uni prunes</strong>: file uni sessions pruned\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.file uni prunes</strong>: file uni sessions pruned\r
+<strong>stream.file user prunes</strong>: file sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.icmp ha prunes</strong>: icmp sessions pruned by high availability sync\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>stream.icmp idle prunes</strong>: icmp sessions pruned due to timeout\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>stream_icmp.max</strong>: max icmp sessions\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>stream.icmp timeout prunes</strong>: icmp sessions pruned due to timeout\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream_icmp.timeouts</strong>: icmp session timeouts\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>stream.icmp user prunes</strong>: icmp sessions pruned for other reasons\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream_ip.alerts</strong>: alerts generated\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_ip.current frags</strong>: current fragments\r
+<strong>stream_ip.current</strong>: current fragments\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.ip ha prunes</strong>: ip sessions pruned by high availability sync\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>stream.ip idle prunes</strong>: ip sessions pruned due to timeout\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>stream_ip.max frags</strong>: max fragments\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_ip.timeouts</strong>: ip session timeouts\r
+<strong>stream.ip timeout prunes</strong>: ip sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_ip.total frags</strong>: total fragments\r
+<strong>stream_ip.timeouts</strong>: ip session timeouts\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>stream_ip.total</strong>: total fragments\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream_ip.trackers added</strong>: datagram trackers created\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
+<strong>stream.ip user prunes</strong>: ip sessions pruned for other reasons\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream_tcp.3way trackers</strong>: tcp session tracking started on ack\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.tcp ha prunes</strong>: tcp sessions pruned by high availability sync\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>stream.tcp idle prunes</strong>: tcp sessions pruned due to timeout\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>stream_tcp.ignored</strong>: tcp packets ignored\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_tcp.timeouts</strong>: tcp session timeouts\r
+<strong>stream.tcp timeout prunes</strong>: tcp sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.tcp total prunes</strong>: total tcp sessions pruned\r
+<strong>stream_tcp.timeouts</strong>: tcp session timeouts\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.tcp uni prunes</strong>: tcp uni sessions pruned\r
+<strong>stream.tcp total prunes</strong>: total tcp sessions pruned\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_tcp.untracked</strong>: tcp packets not tracked\r
+<strong>stream.tcp uni prunes</strong>: tcp uni sessions pruned\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream_udp.created</strong>: udp session trackers created\r
+<strong>stream_tcp.untracked</strong>: tcp packets not tracked\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.udp excess prunes</strong>: udp sessions pruned due to excess\r
+<strong>stream.tcp user prunes</strong>: tcp sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.udp flows</strong>: total udp sessions\r
+<strong>stream_udp.created</strong>: udp session trackers created\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.udp ha prunes</strong>: udp sessions pruned by high availability sync\r
+<strong>stream.udp excess prunes</strong>: udp sessions pruned due to excess\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.udp idle prunes</strong>: udp sessions pruned due to timeout\r
+<strong>stream.udp flows</strong>: total udp sessions\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
+<strong>stream.udp timeout prunes</strong>: udp sessions pruned due to timeout\r
+</p>\r
+</li>\r
+<li>\r
+<p>\r
<strong>stream_udp.timeouts</strong>: udp session timeouts\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user excess prunes</strong>: user sessions pruned due to excess\r
+<strong>stream.udp user prunes</strong>: udp sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user flows</strong>: total user sessions\r
+<strong>stream.user excess prunes</strong>: user sessions pruned due to excess\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user ha prunes</strong>: user sessions pruned by high availability sync\r
+<strong>stream.user flows</strong>: total user sessions\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user idle prunes</strong>: user sessions pruned due to timeout\r
+<strong>stream.user memcap prunes</strong>: user sessions pruned due to memcap\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user memcap prunes</strong>: user sessions pruned due to memcap\r
+<strong>stream.user preemptive prunes</strong>: user sessions pruned during preemptive pruning\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>stream.user preemptive prunes</strong>: user sessions pruned during preemptive pruning\r
+<strong>stream.user timeout prunes</strong>: user sessions pruned due to timeout\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>tcp.bad checksum (ip4)</strong>: nonzero tcp over ip checksums\r
+<strong>stream.user user prunes</strong>: user sessions pruned for other reasons\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>tcp.bad checksum (ip6)</strong>: nonzero tcp over ipv6 checksums\r
+<strong>tcp.bad checksum (ip4)</strong>: nonzero tcp over ip checksums\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>tcp_connector.messages</strong>: total messages\r
+<strong>tcp.bad checksum (ip6)</strong>: nonzero tcp over ipv6 checksums\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116</strong>: ciscometadata\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>116</strong>: decode\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>133</strong>: dce_udp\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>134</strong>: latency\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:1</strong> (ipv4) not IPv4 datagram\r
+<strong>116:1</strong> (ipv4) Not IPv4 datagram\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:2</strong> (ipv4) IPv4 header length < minimum\r
+<strong>116:2</strong> (ipv4) hlen < minimum\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:3</strong> (ipv4) IPv4 datagram length < header field\r
+<strong>116:3</strong> (ipv4) IP dgm len < IP Hdr len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:4</strong> (ipv4) IPv4 options found with bad lengths\r
+<strong>116:4</strong> (ipv4) Ipv4 Options found with bad lengths\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:5</strong> (ipv4) truncated IPv4 options\r
+<strong>116:5</strong> (ipv4) Truncated Ipv4 Options\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:6</strong> (ipv4) IPv4 datagram length > captured length\r
+<strong>116:6</strong> (ipv4) IP dgm len > captured len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:45</strong> (tcp) TCP packet length is smaller than 20 bytes\r
+<strong>116:45</strong> (tcp) TCP packet len is smaller than 20 bytes\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:150</strong> (decode) loopback IP\r
+<strong>116:150</strong> (decode) bad traffic loopback IP\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:151</strong> (decode) same src/dst IP\r
+<strong>116:151</strong> (decode) bad traffic same src/dst IP\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:272</strong> (ipv6) IPv6 truncated extension header\r
+<strong>116:272</strong> (ipv6) IPV6 truncated extension header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:273</strong> (ipv6) IPv6 truncated header\r
+<strong>116:273</strong> (ipv6) IPV6 truncated header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:274</strong> (ipv6) IPv6 datagram length < header field\r
+<strong>116:274</strong> (ipv6) IP dgm len < IP Hdr len\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:275</strong> (ipv6) IPv6 datagram length > captured length\r
+<strong>116:275</strong> (ipv6) IP dgm len > captured len\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:403</strong> (tcp) SYN to multicast address\r
+<strong>116:403</strong> (tcp) bad traffic SYN to multicast address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:404</strong> (ipv4) IPv4 packet with zero TTL\r
+<strong>116:404</strong> (ipv4) IPV4 packet with zero TTL\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:405</strong> (ipv4) IPv4 packet with bad frag bits (both MF and DF set)\r
+<strong>116:405</strong> (ipv4) IPV4 packet with bad frag bits (both MF and DF set)\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:407</strong> (ipv4) IPv4 packet frag offset + length exceed maximum\r
+<strong>116:407</strong> (ipv4) IPV4 packet frag offset + length exceed maximum\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:408</strong> (ipv4) IPv4 packet from <em>current net</em> source address\r
+<strong>116:408</strong> (ipv4) IPV4 packet from <em>current net</em> source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:409</strong> (ipv4) IPv4 packet to <em>current net</em> dest address\r
+<strong>116:409</strong> (ipv4) IPV4 packet to <em>current net</em> dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:410</strong> (ipv4) IPv4 packet from multicast source address\r
+<strong>116:410</strong> (ipv4) IPV4 packet from multicast source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:411</strong> (ipv4) IPv4 packet from reserved source address\r
+<strong>116:411</strong> (ipv4) IPV4 packet from reserved source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:412</strong> (ipv4) IPv4 packet to reserved dest address\r
+<strong>116:412</strong> (ipv4) IPV4 packet to reserved dest address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:413</strong> (ipv4) IPv4 packet from broadcast source address\r
+<strong>116:413</strong> (ipv4) IPV4 packet from broadcast source address\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:414</strong> (ipv4) IPv4 packet to broadcast dest address\r
+<strong>116:414</strong> (ipv4) IPV4 packet to broadcast dest address\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:424</strong> (eth) truncated ethernet header\r
+<strong>116:424</strong> (eth) truncated eth header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:425</strong> (ipv4) truncated IPv4 header\r
+<strong>116:425</strong> (ipv4) truncated IP4 header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:428</strong> (ipv4) IPv4 packet below TTL limit\r
+<strong>116:428</strong> (ipv4) IPV4 packet below TTL limit\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:429</strong> (ipv6) IPv6 packet has zero hop limit\r
+<strong>116:429</strong> (ipv6) IPV6 packet has zero hop limit\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:430</strong> (ipv4) IPv4 packet both DF and offset set\r
+<strong>116:430</strong> (ipv4) IPV4 packet both DF and offset set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:431</strong> (icmp6) ICMPv6 type not decoded\r
+<strong>116:431</strong> (icmp6) ICMP6 type not decoded\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:432</strong> (icmp6) ICMPv6 packet to multicast address\r
+<strong>116:432</strong> (icmp6) ICMP6 packet to multicast address\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:434</strong> (icmp4) ICMP ping Nmap\r
+<strong>116:434</strong> (icmp4) ICMP ping NMAP\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:444</strong> (ipv4) IPv4 option set\r
+<strong>116:444</strong> (ipv4) MISC IP option set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:445</strong> (udp) large UDP packet (> 4000 bytes)\r
+<strong>116:445</strong> (udp) misc large UDP Packet\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:446</strong> (tcp) TCP port 0 traffic\r
+<strong>116:446</strong> (tcp) BAD-TRAFFIC TCP port 0 traffic\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:447</strong> (udp) UDP port 0 traffic\r
+<strong>116:447</strong> (udp) BAD-TRAFFIC UDP port 0 traffic\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:448</strong> (ipv4) IPv4 reserved bit set\r
+<strong>116:448</strong> (ipv4) BAD-TRAFFIC IP reserved bit set\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:449</strong> (decode) unassigned/reserved IP protocol\r
+<strong>116:449</strong> (decode) BAD-TRAFFIC unassigned/reserved IP protocol\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:450</strong> (decode) bad IP protocol\r
+<strong>116:450</strong> (decode) BAD-TRAFFIC bad IP protocol\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:452</strong> (icmp4) Linux ICMP header DOS attempt\r
+<strong>116:452</strong> (icmp4) BAD-TRAFFIC Linux ICMP header DOS attempt\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:453</strong> (ipv6) ISATAP-addressed IPv6 traffic spoofing attempt\r
+<strong>116:453</strong> (ipv6) BAD-TRAFFIC ISATAP-addressed IPv6 traffic spoofing attempt\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:454</strong> (pgm) PGM nak list overflow attempt\r
+<strong>116:454</strong> (pgm) BAD-TRAFFIC PGM nak list overflow attempt\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:456</strong> (ipv6) too many IPv6 extension headers\r
+<strong>116:456</strong> (ipv6) too many IP6 extension headers\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>116:461</strong> (ipv6) IPv6 routing type 0 extension header\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:462</strong> (erspan2) ERSpan header version mismatch\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:463</strong> (erspan2) captured length < ERSpan type2 header length\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:464</strong> (erspan3) captured < ERSpan type3 header length\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>116:465</strong> (auth) truncated authentication header\r
+<strong>116:461</strong> (ipv6) IPV6 routing type 0 extension header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:466</strong> (auth) bad authentication header length\r
+<strong>116:462</strong> (erspan2) ERSpan header version mismatch\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:467</strong> (fabricpath) truncated FabricPath header\r
+<strong>116:463</strong> (erspan2) captured < ERSpan type2 header length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:468</strong> (ciscometadata) truncated Cisco Metadata header\r
+<strong>116:464</strong> (erspan3) captured < ERSpan type3 header length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:469</strong> (ciscometadata) invalid Cisco Metadata option length\r
+<strong>116:465</strong> (auth) truncated authentication header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:470</strong> (ciscometadata) invalid Cisco Metadata option type\r
+<strong>116:466</strong> (auth) bad authentication header length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:471</strong> (ciscometadata) invalid Cisco Metadata SGT\r
+<strong>116:467</strong> (fabricpath) truncated FabricPath header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>116:472</strong> (decode) too many protocols present\r
+<strong>116:468</strong> (decode) too many protocols present\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:52</strong> (http_inspect) not HTTP traffic\r
+<strong>119:52</strong> (http_inspect) Not HTTP traffic\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:53</strong> (http_inspect) chunk length has excessive leading zeros\r
+<strong>119:53</strong> (http_inspect) Chunk length has excessive leading zeros\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:54</strong> (http_inspect) white space before or between messages\r
+<strong>119:54</strong> (http_inspect) White space before or between messages\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:55</strong> (http_inspect) request message without URI\r
+<strong>119:55</strong> (http_inspect) Request message without URI\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:56</strong> (http_inspect) control character in reason phrase\r
+<strong>119:56</strong> (http_inspect) Control character in reason phrase\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:57</strong> (http_inspect) illegal extra whitespace in start line\r
+<strong>119:57</strong> (http_inspect) Illegal extra whitespace in start line\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:58</strong> (http_inspect) corrupted HTTP version\r
+<strong>119:58</strong> (http_inspect) Corrupted HTTP version\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:59</strong> (http_inspect) unknown HTTP version\r
+<strong>119:59</strong> (http_inspect) Unknown HTTP version\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:60</strong> (http_inspect) format error in HTTP header\r
+<strong>119:60</strong> (http_inspect) Format error in HTTP header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:61</strong> (http_inspect) chunk header options present\r
+<strong>119:61</strong> (http_inspect) Chunk header options present\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:63</strong> (http_inspect) unrecognized type of percent encoding in URI\r
+<strong>119:63</strong> (http_inspect) Unrecognized type of percent encoding in URI\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:65</strong> (http_inspect) white space following chunk length\r
+<strong>119:65</strong> (http_inspect) White space following chunk length\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:66</strong> (http_inspect) white space within header name\r
+<strong>119:67</strong> (http_inspect) Excessive gzip compression\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:67</strong> (http_inspect) excessive gzip compression\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:68</strong> (http_inspect) gzip decompression failed\r
+<strong>119:68</strong> (http_inspect) Gzip decompression failed\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:71</strong> (http_inspect) message has both Content-Length and Transfer-Encoding\r
+<strong>119:71</strong> (http_inspect) Message has both Content-Length and Transfer-Encoding\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>119:72</strong> (http_inspect) status code implying no body combined with Transfer-Encoding or nonzero Content-Length\r
+<strong>119:72</strong> (http_inspect) Status code implying no body combined with Transfer-Encoding or nonzero Content-Length\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>119:75</strong> (http_inspect) misformatted HTTP traffic\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:76</strong> (http_inspect) unsupported Transfer-Encoding or Content-Encoding used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:77</strong> (http_inspect) unknown Transfer-Encoding or Content-Encoding used\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>119:78</strong> (http_inspect) multiple layers of compression encodings applied\r
+<strong>119:75</strong> (http_inspect) Misformatted HTTP traffic\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>124:1</strong> (smtp) attempted command buffer overflow\r
+<strong>124:1</strong> (smtp) Attempted command buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:2</strong> (smtp) attempted data header buffer overflow\r
+<strong>124:2</strong> (smtp) Attempted data header buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:3</strong> (smtp) attempted response buffer overflow\r
+<strong>124:3</strong> (smtp) Attempted response buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:4</strong> (smtp) attempted specific command buffer overflow\r
+<strong>124:4</strong> (smtp) Attempted specific command buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:5</strong> (smtp) unknown command\r
+<strong>124:5</strong> (smtp) Unknown command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:6</strong> (smtp) illegal command\r
+<strong>124:6</strong> (smtp) Illegal command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:7</strong> (smtp) attempted header name buffer overflow\r
+<strong>124:7</strong> (smtp) Attempted header name buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:8</strong> (smtp) attempted X-Link2State command buffer overflow\r
+<strong>124:8</strong> (smtp) Attempted X-Link2State command buffer overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:10</strong> (smtp) base64 decoding failed\r
+<strong>124:10</strong> (smtp) Base64 Decoding failed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:11</strong> (smtp) quoted-printable decoding failed\r
+<strong>124:11</strong> (smtp) Quoted-Printable Decoding failed\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>124:13</strong> (smtp) Unix-to-Unix decoding failed\r
+<strong>124:13</strong> (smtp) Unix-to-Unix Decoding failed\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>124:15</strong> (smtp) attempted authentication command buffer overflow\r
+<strong>124:15</strong> (smtp) Attempted authentication command buffer overflow\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>128:1</strong> (ssh) challenge-response overflow exploit\r
+<strong>128:1</strong> (ssh) Challenge-Response Overflow exploit\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>128:3</strong> (ssh) server version string overflow\r
+<strong>128:3</strong> (ssh) Server version string overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>128:5</strong> (ssh) bad message direction\r
+<strong>128:5</strong> (ssh) Bad message direction\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>128:6</strong> (ssh) payload size incorrect for the given payload\r
+<strong>128:6</strong> (ssh) Payload size incorrect for the given payload\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>128:7</strong> (ssh) failed to detect SSH version string\r
+<strong>128:7</strong> (ssh) Failed to detect SSH version string\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:5</strong> (stream_tcp) bad segment, adjusted size ⇐ 0 (deprecated)\r
+<strong>129:5</strong> (stream_tcp) bad segment, adjusted size ⇐ 0\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:8</strong> (stream_tcp) data sent on stream after TCP reset sent\r
+<strong>129:8</strong> (stream_tcp) data sent on stream after TCP Reset sent\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:10</strong> (stream_tcp) TCP server possibly hijacked, different ethernet address\r
+<strong>129:10</strong> (stream_tcp) TCP Server possibly hijacked, different ethernet address\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>129:18</strong> (stream_tcp) data sent on stream after TCP reset received\r
+<strong>129:18</strong> (stream_tcp) data sent on stream after TCP Reset received\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>131:1</strong> (dns) obsolete DNS RR types\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>131:2</strong> (dns) experimental DNS RR types\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>131:3</strong> (dns) DNS client rdata txt overflow\r
+<strong>131:1</strong> (dns) Obsolete DNS RR Types\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:2</strong> (dce_smb) SMB - bad NetBIOS session service session type\r
+<strong>131:2</strong> (dns) Experimental DNS RR Types\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:3</strong> (dce_smb) SMB - bad SMB message type\r
+<strong>131:3</strong> (dns) DNS Client rdata txt Overflow\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:4</strong> (dce_smb) SMB - bad SMB Id (not \xffSMB for SMB1 or not \xfeSMB for SMB2)\r
+<strong>133:2</strong> (dce_smb) SMB - Bad NetBIOS Session Service session type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:5</strong> (dce_smb) SMB - bad word count or structure size\r
+<strong>133:3</strong> (dce_smb) SMB - Bad SMB message type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:6</strong> (dce_smb) SMB - bad byte count\r
+<strong>133:4</strong> (dce_smb) SMB - Bad SMB Id (not \xffSMB for SMB1 or not \xfeSMB for SMB2).\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:7</strong> (dce_smb) SMB - bad format type\r
+<strong>133:5</strong> (dce_smb) SMB - Bad word count or structure size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:8</strong> (dce_smb) SMB - bad offset\r
+<strong>133:6</strong> (dce_smb) SMB - Bad byte count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:9</strong> (dce_smb) SMB - zero total data count\r
+<strong>133:7</strong> (dce_smb) SMB - Bad format type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:10</strong> (dce_smb) SMB - NetBIOS data length less than SMB header length\r
+<strong>133:8</strong> (dce_smb) SMB - Bad offset.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:12</strong> (dce_smb) SMB - remaining NetBIOS data length less than command byte count\r
+<strong>133:9</strong> (dce_smb) SMB - Zero total data count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:13</strong> (dce_smb) SMB - remaining NetBIOS data length less than command data size\r
+<strong>133:10</strong> (dce_smb) SMB - NetBIOS data length less than SMB header length.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:14</strong> (dce_smb) SMB - remaining total data count less than this command data size\r
+<strong>133:12</strong> (dce_smb) SMB - Remaining NetBIOS data length less than command byte count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:15</strong> (dce_smb) SMB - total data sent (STDu64) greater than command total data expected\r
+<strong>133:13</strong> (dce_smb) SMB - Remaining NetBIOS data length less than command data size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:16</strong> (dce_smb) SMB - byte count less than command data size (STDu64)\r
+<strong>133:14</strong> (dce_smb) SMB - Remaining total data count less than this command data size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:17</strong> (dce_smb) SMB - invalid command data size for byte count\r
+<strong>133:15</strong> (dce_smb) SMB - Total data sent (STDu64) greater than command total data expected.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:18</strong> (dce_smb) SMB - excessive tree connect requests with pending tree connect responses\r
+<strong>133:16</strong> (dce_smb) SMB - Byte count less than command data size (STDu64)\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:19</strong> (dce_smb) SMB - excessive read requests with pending read responses\r
+<strong>133:17</strong> (dce_smb) SMB - Invalid command data size for byte count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:20</strong> (dce_smb) SMB - excessive command chaining\r
+<strong>133:18</strong> (dce_smb) SMB - Excessive Tree Connect requests with pending Tree Connect responses.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:21</strong> (dce_smb) SMB - multiple chained tree connect requests\r
+<strong>133:19</strong> (dce_smb) SMB - Excessive Read requests with pending Read responses.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:22</strong> (dce_smb) SMB - multiple chained tree connect requests\r
+<strong>133:20</strong> (dce_smb) SMB - Excessive command chaining.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:23</strong> (dce_smb) SMB - chained/compounded login followed by logoff\r
+<strong>133:21</strong> (dce_smb) SMB - Multiple chained tree connect requests.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:24</strong> (dce_smb) SMB - chained/compounded tree connect followed by tree disconnect\r
+<strong>133:22</strong> (dce_smb) SMB - Multiple chained tree connect requests.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:25</strong> (dce_smb) SMB - chained/compounded open pipe followed by close pipe\r
+<strong>133:23</strong> (dce_smb) SMB - Chained/Compounded login followed by logoff.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:26</strong> (dce_smb) SMB - invalid share access\r
+<strong>133:24</strong> (dce_smb) SMB - Chained/Compounded tree connect followed by tree disconnect.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:27</strong> (dce_smb) connection oriented DCE/RPC - invalid major version\r
+<strong>133:25</strong> (dce_smb) SMB - Chained/Compounded open pipe followed by close pipe.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:27</strong> (dce_tcp) connection oriented DCE/RPC - invalid major version\r
+<strong>133:26</strong> (dce_smb) SMB - Invalid share access.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:28</strong> (dce_smb) connection oriented DCE/RPC - invalid minor version\r
+<strong>133:27</strong> (dce_smb) Connection oriented DCE/RPC - Invalid major version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:28</strong> (dce_tcp) connection oriented DCE/RPC - invalid minor version\r
+<strong>133:27</strong> (dce_tcp) Connection oriented DCE/RPC - Invalid major version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:29</strong> (dce_smb) connection-oriented DCE/RPC - invalid PDU type\r
+<strong>133:28</strong> (dce_smb) Connection oriented DCE/RPC - Invalid minor version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:29</strong> (dce_tcp) connection-oriented DCE/RPC - invalid PDU type\r
+<strong>133:28</strong> (dce_tcp) Connection oriented DCE/RPC - Invalid minor version.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:30</strong> (dce_smb) connection-oriented DCE/RPC - fragment length less than header size\r
+<strong>133:29</strong> (dce_smb) Connection-oriented DCE/RPC - Invalid pdu type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:30</strong> (dce_tcp) connection-oriented DCE/RPC - fragment length less than header size\r
+<strong>133:29</strong> (dce_tcp) Connection-oriented DCE/RPC - Invalid pdu type.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:32</strong> (dce_smb) connection-oriented DCE/RPC - no context items specified\r
+<strong>133:30</strong> (dce_smb) Connection-oriented DCE/RPC - Fragment length less than header size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:32</strong> (dce_tcp) connection-oriented DCE/RPC - no context items specified\r
+<strong>133:30</strong> (dce_tcp) Connection-oriented DCE/RPC - Fragment length less than header size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:33</strong> (dce_smb) connection-oriented DCE/RPC -no transfer syntaxes specified\r
+<strong>133:32</strong> (dce_smb) Connection-oriented DCE/RPC - No context items specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:33</strong> (dce_tcp) connection-oriented DCE/RPC -no transfer syntaxes specified\r
+<strong>133:32</strong> (dce_tcp) Connection-oriented DCE/RPC - No context items specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:34</strong> (dce_smb) connection-oriented DCE/RPC - fragment length on non-last fragment less than maximum negotiated fragment transmit size for client\r
+<strong>133:33</strong> (dce_smb) Connection-oriented DCE/RPC -No transfer syntaxes specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:34</strong> (dce_tcp) connection-oriented DCE/RPC - fragment length on non-last fragment less than maximum negotiated fragment transmit size for client\r
+<strong>133:33</strong> (dce_tcp) Connection-oriented DCE/RPC -No transfer syntaxes specified.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:35</strong> (dce_smb) connection-oriented DCE/RPC - fragment length greater than maximum negotiated fragment transmit size\r
+<strong>133:34</strong> (dce_smb) Connection-oriented DCE/RPC - Fragment length on non-last fragment less than maximum negotiated fragment transmit size for client.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:35</strong> (dce_tcp) connection-oriented DCE/RPC - fragment length greater than maximum negotiated fragment transmit size\r
+<strong>133:34</strong> (dce_tcp) Connection-oriented DCE/RPC - Fragment length on non-last fragment less than maximum negotiated fragment transmit size for client.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:36</strong> (dce_smb) connection-oriented DCE/RPC - alter context byte order different from bind\r
+<strong>133:35</strong> (dce_smb) Connection-oriented DCE/RPC - Fragment length greater than maximum negotiated fragment transmit size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:36</strong> (dce_tcp) connection-oriented DCE/RPC - alter context byte order different from bind\r
+<strong>133:35</strong> (dce_tcp) Connection-oriented DCE/RPC - Fragment length greater than maximum negotiated fragment transmit size.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:37</strong> (dce_smb) connection-oriented DCE/RPC - call id of non first/last fragment different from call id established for fragmented request\r
+<strong>133:36</strong> (dce_smb) Connection-oriented DCE/RPC - Alter Context byte order different from Bind\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:37</strong> (dce_tcp) connection-oriented DCE/RPC - call id of non first/last fragment different from call id established for fragmented request\r
+<strong>133:36</strong> (dce_tcp) Connection-oriented DCE/RPC - Alter Context byte order different from Bind\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:38</strong> (dce_smb) connection-oriented DCE/RPC - opnum of non first/last fragment different from opnum established for fragmented request\r
+<strong>133:37</strong> (dce_smb) Connection-oriented DCE/RPC - Call id of non first/last fragment different from call id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:38</strong> (dce_tcp) connection-oriented DCE/RPC - opnum of non first/last fragment different from opnum established for fragmented request\r
+<strong>133:37</strong> (dce_tcp) Connection-oriented DCE/RPC - Call id of non first/last fragment different from call id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:39</strong> (dce_smb) connection-oriented DCE/RPC - context id of non first/last fragment different from context id established for fragmented request\r
+<strong>133:38</strong> (dce_smb) Connection-oriented DCE/RPC - Opnum of non first/last fragment different from opnum established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:39</strong> (dce_tcp) connection-oriented DCE/RPC - context id of non first/last fragment different from context id established for fragmented request\r
+<strong>133:38</strong> (dce_tcp) Connection-oriented DCE/RPC - Opnum of non first/last fragment different from opnum established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:40</strong> (dce_udp) connection-less DCE/RPC - invalid major version\r
+<strong>133:39</strong> (dce_smb) Connection-oriented DCE/RPC - Context id of non first/last fragment different from context id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:41</strong> (dce_udp) connection-less DCE/RPC - invalid PDU type\r
+<strong>133:39</strong> (dce_tcp) Connection-oriented DCE/RPC - Context id of non first/last fragment different from context id established for fragmented request.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:42</strong> (dce_udp) connection-less DCE/RPC - data length less than header size\r
+<strong>133:44</strong> (dce_smb) SMB - Invalid SMB version 1 seen.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:43</strong> (dce_udp) connection-less DCE/RPC - bad sequence number\r
+<strong>133:45</strong> (dce_smb) SMB - Invalid SMB version 2 seen.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:44</strong> (dce_smb) SMB - invalid SMB version 1 seen\r
+<strong>133:46</strong> (dce_smb) SMB - Invalid user, tree connect, file binding.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:45</strong> (dce_smb) SMB - invalid SMB version 2 seen\r
+<strong>133:47</strong> (dce_smb) SMB - Excessive command compounding.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:46</strong> (dce_smb) SMB - invalid user, tree connect, file binding\r
+<strong>133:48</strong> (dce_smb) SMB - Zero data count.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:47</strong> (dce_smb) SMB - excessive command compounding\r
+<strong>133:50</strong> (dce_smb) SMB - Maximum number of outstanding requests exceeded.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:48</strong> (dce_smb) SMB - zero data count\r
+<strong>133:51</strong> (dce_smb) SMB - Outstanding requests with same MID.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:50</strong> (dce_smb) SMB - maximum number of outstanding requests exceeded\r
+<strong>133:52</strong> (dce_smb) SMB - Deprecated dialect negotiated.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:51</strong> (dce_smb) SMB - outstanding requests with same MID\r
+<strong>133:53</strong> (dce_smb) SMB - Deprecated command used.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:52</strong> (dce_smb) SMB - deprecated dialect negotiated\r
+<strong>133:54</strong> (dce_smb) SMB - Unusual command used.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:53</strong> (dce_smb) SMB - deprecated command used\r
+<strong>133:55</strong> (dce_smb) SMB - Invalid setup count for command.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:54</strong> (dce_smb) SMB - unusual command used\r
+<strong>133:56</strong> (dce_smb) SMB - Client attempted multiple dialect negotiations on session.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>133:55</strong> (dce_smb) SMB - invalid setup count for command\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:56</strong> (dce_smb) SMB - client attempted multiple dialect negotiations on session\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:57</strong> (dce_smb) SMB - client attempted to create or set a file’s attributes to readonly/hidden/system\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:58</strong> (dce_smb) SMB - file offset provided is greater than file size specified\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-<strong>133:59</strong> (dce_smb) SMB - next command specified in SMB2 header is beyond payload boundary\r
+<strong>133:57</strong> (dce_smb) SMB - Client attempted to create or set a file’s attributes to readonly/hidden/system.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>136:2</strong> (reputation) packets whitelisted\r
+<strong>136:2</strong> (reputation) Packets whitelisted\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>136:3</strong> (reputation) packets monitored\r
+<strong>136:3</strong> (reputation) Packets monitored\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:1</strong> (ssl) invalid client HELLO after server HELLO detected\r
+<strong>137:1</strong> (ssl) Invalid Client HELLO after Server HELLO Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:2</strong> (ssl) invalid server HELLO without client HELLO detected\r
+<strong>137:2</strong> (ssl) Invalid Server HELLO without Client HELLO Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:3</strong> (ssl) heartbeat read overrun attempt detected\r
+<strong>137:3</strong> (ssl) Heartbeat Read Overrun Attempt Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>137:4</strong> (ssl) large heartbeat response detected\r
+<strong>137:4</strong> (ssl) Large Heartbeat Response Detected\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:1</strong> (sip) maximum sessions reached\r
+<strong>140:1</strong> (sip) Maximum sessions reached\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:2</strong> (sip) empty request URI\r
+<strong>140:2</strong> (sip) Empty request URI\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:4</strong> (sip) empty call-Id\r
+<strong>140:4</strong> (sip) Empty call-Id\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:7</strong> (sip) request name in CSeq is too long\r
+<strong>140:7</strong> (sip) Request name in CSeq is too long\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:8</strong> (sip) empty From header\r
+<strong>140:8</strong> (sip) Empty From header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:10</strong> (sip) empty To header\r
+<strong>140:10</strong> (sip) Empty To header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:12</strong> (sip) empty Via header\r
+<strong>140:12</strong> (sip) Empty Via header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:14</strong> (sip) empty Contact\r
+<strong>140:14</strong> (sip) Empty Contact\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:15</strong> (sip) contact is too long\r
+<strong>140:15</strong> (sip) Contact is too long\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:16</strong> (sip) content length is too large or negative\r
+<strong>140:16</strong> (sip) Content length is too large or negative\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:17</strong> (sip) multiple SIP messages in a packet\r
+<strong>140:17</strong> (sip) Multiple SIP messages in a packet\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:18</strong> (sip) content length mismatch\r
+<strong>140:18</strong> (sip) Content length mismatch\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:19</strong> (sip) request name is invalid\r
+<strong>140:19</strong> (sip) Request name is invalid\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:21</strong> (sip) illegal session information modification\r
+<strong>140:21</strong> (sip) Illegal session information modification\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:22</strong> (sip) response status code is not a 3 digit number\r
+<strong>140:22</strong> (sip) Response status code is not a 3 digit number\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:23</strong> (sip) empty Content-type header\r
+<strong>140:23</strong> (sip) Empty Content-type header\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>140:25</strong> (sip) mismatch in METHOD of request and the CSEQ header\r
+<strong>140:25</strong> (sip) Mismatch in METHOD of request and the CSEQ header\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:26</strong> (sip) method is unknown\r
+<strong>140:26</strong> (sip) Method is unknown\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>140:27</strong> (sip) maximum dialogs within a session reached\r
+<strong>140:27</strong> (sip) Maximum dialogs within a session reached\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:1</strong> (imap) unknown IMAP3 command\r
+<strong>141:1</strong> (imap) Unknown IMAP3 command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:2</strong> (imap) unknown IMAP3 response\r
+<strong>141:2</strong> (imap) Unknown IMAP3 response\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:4</strong> (imap) base64 decoding failed\r
+<strong>141:4</strong> (imap) Base64 Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:5</strong> (imap) quoted-printable decoding failed\r
+<strong>141:5</strong> (imap) Quoted-Printable Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>141:7</strong> (imap) Unix-to-Unix decoding failed\r
+<strong>141:7</strong> (imap) Unix-to-Unix Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:1</strong> (pop) unknown POP3 command\r
+<strong>142:1</strong> (pop) Unknown POP3 command\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:2</strong> (pop) unknown POP3 response\r
+<strong>142:2</strong> (pop) Unknown POP3 response\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:4</strong> (pop) base64 decoding failed\r
+<strong>142:4</strong> (pop) Base64 Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:5</strong> (pop) quoted-printable decoding failed\r
+<strong>142:5</strong> (pop) Quoted-Printable Decoding failed.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>142:7</strong> (pop) Unix-to-Unix decoding failed\r
+<strong>142:7</strong> (pop) Unix-to-Unix Decoding failed.\r
</p>\r
</li>\r
<li>\r
</li>\r
<li>\r
<p>\r
-<strong>144:3</strong> (modbus) reserved Modbus function code in use\r
+<strong>144:3</strong> (modbus) Reserved Modbus function code in use\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:1</strong> (dnp3) DNP3 link-layer frame contains bad CRC\r
+<strong>145:1</strong> (dnp3) DNP3 Link-Layer Frame contains bad CRC.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:2</strong> (dnp3) DNP3 link-layer frame was dropped\r
+<strong>145:2</strong> (dnp3) DNP3 Link-Layer Frame was dropped.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:3</strong> (dnp3) DNP3 transport-layer segment was dropped during reassembly\r
+<strong>145:3</strong> (dnp3) DNP3 Transport-Layer Segment was dropped during reassembly.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:4</strong> (dnp3) DNP3 reassembly buffer was cleared without reassembling a complete message\r
+<strong>145:4</strong> (dnp3) DNP3 Reassembly Buffer was cleared without reassembling a complete message.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:5</strong> (dnp3) DNP3 link-layer frame uses a reserved address\r
+<strong>145:5</strong> (dnp3) DNP3 Link-Layer Frame uses a reserved address.\r
</p>\r
</li>\r
<li>\r
<p>\r
-<strong>145:6</strong> (dnp3) DNP3 application-layer fragment uses a reserved function code\r
+<strong>145:6</strong> (dnp3) DNP3 Application-Layer Fragment uses a reserved function code.\r
</p>\r
</li>\r
</ul></div>\r
</li>\r
<li>\r
<p>\r
-<strong>ciscometadata</strong> (codec): support for cisco metadata\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>classifications</strong> (basic): define rule categories with priority\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>dce_udp</strong> (inspector): dce over udp inspection\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>decode</strong> (basic): general decoder rules\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>tcp_connector</strong> (connector): implement the tcp stream connector\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>telnet</strong> (inspector): telnet inspection and normalization\r
</p>\r
</li>\r
<li>\r
<p>\r
<strong>wizard</strong> (inspector): inspector that implements port-independent protocol identification\r
+:leveloffset: 0\r
</p>\r
</li>\r
</ul></div>\r
-</div>\r
-<div class="sect2">\r
-<h3 id="_plugin_listing">Plugin Listing</h3>\r
+<div class="sect3">\r
+<h4 id="_plugin_listing">Plugin Listing</h4>\r
<div class="ulist"><ul>\r
<li>\r
<p>\r
</li>\r
<li>\r
<p>\r
-<strong>codec::ciscometadata</strong>: support for cisco metadata\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>codec::erspan2</strong>: support for encapsulated remote switched port analyzer - type 2\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>connector::tcp_connector</strong>: implement the tcp stream connector\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>inspector::appid</strong>: application and service identification\r
</p>\r
</li>\r
</li>\r
<li>\r
<p>\r
-<strong>inspector::dce_udp</strong>: dce over udp inspection\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
<strong>inspector::dnp3</strong>: dnp3 inspection\r
</p>\r
</li>\r
</li>\r
</ul></div>\r
</div>\r
-<div class="sect2">\r
-<h3 id="_bugs">Bugs</h3>\r
-<div class="sect3">\r
-<h4 id="_build">Build</h4>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Enabling large pcap may erroneously affect the number of packets processed\r
- from pcaps.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Enabling debug messages may erroneously affect the number of packets\r
- processed from pcaps.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-g++ 4.9.2 with -O3 reports:\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>src/service_inspectors/back_orifice/back_orifice.cc:231:25: warning:\r
-iteration 930u invokes undefined behavior [-Waggressive-loop-optimizations]</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Building with clang and autotools on Linux will show the following\r
- warning many times. Please ignore.\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>clang: warning: argument unused during compilation: '-pthread'</code></pre>\r
-</div></div>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_config">Config</h4>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-Parsing issue with IP lists. can’t parse rules with $EXTERNAL_NET\r
- defined as below because of the space between ! and 10.\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>HOME_NET = [[ 10.0.17.0/24 10.0.14.0/24 10.247.0.0/16 10.246.0.0/16 ]]\r
-EXTERNAL_NET = '! ' .. HOME_NET</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Multiple versions of luajit scripts are not handled correctly. The\r
- first loaded version will always be executed even though plugin manager\r
- saves the correct version.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-When using -c and -L together, the last on the command line wins (-c -L\r
- will dump; -L -c will analyze).\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Modules instantiated by command line only will not get default settings\r
- unless hard-coded. This notably applies to -A and -L options.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
---lua can only be used in addition to, not in place of, a -c config.\r
- Ideally, --lua could be used in lieu of -c.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_rules_4">Rules</h4>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-metdata:service foo; metadata:service foo; won’t cause a duplicate service\r
- warning as does metadata:service foo, service foo;\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-ip_proto doesn’t work properly with reassembled packets so it can’t be\r
- used to restrict the protocol of service rules.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_snort2lua_2">snort2lua</h4>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
-uricontent:"foo"; content:"bar"; → http_uri; content:"foo"; content:"bar";\r
- (missing pkt_data)\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-stream_tcp ports and protocols both go into a single binder.when; this is\r
- incorrect as the when fields are logically anded together (ie must all be\r
- true). Should create 2 separate bindings.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-There is a bug in pps_stream_tcp.cc.. when stream_tcp: is specified\r
- without any arguments, snort2lua doesn’t convert it. Same for\r
- stream_udp.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Loses the ip list delimiters [ ]; change to ( )\r
-</p>\r
-<div class="literalblock">\r
-<div class="content">\r
-<pre><code>in snort.conf: var HOME_NET [A,B,C]\r
-in snort.lua: HOME_NET = [[A B C]]</code></pre>\r
-</div></div>\r
-</li>\r
-<li>\r
-<p>\r
-Won’t convert packet rules (alert tcp etc.) to service rules (alert http\r
- etc.).\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-alert_fast and alert_full: output configuration includes "file =\r
- <em>foo.bar</em>", but file is a bool and you cannot specify an output file name\r
- in the configuration.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-preprocessor ports option: ports <number> not supported.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
-<div class="sect3">\r
-<h4 id="_runtime">Runtime</h4>\r
-<div class="ulist"><ul>\r
-<li>\r
-<p>\r
--B <mask> feature does not work. It does ordinary IP address obfuscation\r
- instead of using the mask.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-Obfuscation does not work for csv format.\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-The hext DAQ will append a newline to text lines (starting with <em>"</em>).\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-The hext DAQ does not support embedded quotes in text lines (use hex\r
- lines as a workaround).\r
-</p>\r
-</li>\r
-<li>\r
-<p>\r
-stream_tcp alert squash mechanism incorrectly squashes alerts for\r
- different TCP packets.\r
-</p>\r
-</li>\r
-</ul></div>\r
-</div>\r
</div>\r
</div>\r
</div>\r
<div id="footnotes"><hr /></div>\r
<div id="footer">\r
<div id="footer-text">\r
-Last updated 2016-12-20 23:07:29 EST\r
+Last updated 2016-08-11 02:38:58 EDT\r
</div>\r
</div>\r
</body>\r
6.7. detection
6.8. event_filter
6.9. event_queue
- 6.10. file_id
- 6.11. high_availability
- 6.12. host_cache
- 6.13. host_tracker
- 6.14. hosts
- 6.15. ips
- 6.16. latency
- 6.17. memory
- 6.18. network
- 6.19. output
- 6.20. packets
- 6.21. process
- 6.22. profiler
- 6.23. rate_filter
- 6.24. references
- 6.25. rule_state
- 6.26. search_engine
- 6.27. side_channel
- 6.28. snort
- 6.29. suppress
+ 6.10. high_availability
+ 6.11. host_cache
+ 6.12. host_tracker
+ 6.13. hosts
+ 6.14. ips
+ 6.15. latency
+ 6.16. memory
+ 6.17. network
+ 6.18. output
+ 6.19. packets
+ 6.20. process
+ 6.21. profiler
+ 6.22. rate_filter
+ 6.23. references
+ 6.24. rule_state
+ 6.25. search_engine
+ 6.26. side_channel
+ 6.27. snort
+ 6.28. suppress
7. Codec Modules
8.2. arp_spoof
8.3. back_orifice
8.4. binder
- 8.5. dce_smb
- 8.6. dce_tcp
- 8.7. dce_udp
- 8.8. dnp3
- 8.9. dns
- 8.10. file_log
- 8.11. ftp_client
- 8.12. ftp_data
- 8.13. ftp_server
- 8.14. gtp_inspect
- 8.15. http_inspect
- 8.16. imap
- 8.17. modbus
- 8.18. normalizer
- 8.19. packet_capture
- 8.20. perf_monitor
- 8.21. pop
- 8.22. port_scan
- 8.23. port_scan_global
- 8.24. reputation
- 8.25. rpc_decode
- 8.26. sip
- 8.27. smtp
- 8.28. ssh
- 8.29. ssl
- 8.30. stream
- 8.31. stream_file
- 8.32. stream_icmp
- 8.33. stream_ip
- 8.34. stream_tcp
- 8.35. stream_udp
- 8.36. stream_user
- 8.37. telnet
- 8.38. wizard
+ 8.5. dce_http_proxy
+ 8.6. dce_http_server
+ 8.7. dce_smb
+ 8.8. dce_tcp
+ 8.9. dce_udp
+ 8.10. dnp3
+ 8.11. dns
+ 8.12. file_id
+ 8.13. file_log
+ 8.14. ftp_client
+ 8.15. ftp_data
+ 8.16. ftp_server
+ 8.17. gtp_inspect
+ 8.18. http_inspect
+ 8.19. imap
+ 8.20. modbus
+ 8.21. normalizer
+ 8.22. packet_capture
+ 8.23. perf_monitor
+ 8.24. pop
+ 8.25. port_scan
+ 8.26. port_scan_global
+ 8.27. reputation
+ 8.28. rpc_decode
+ 8.29. sip
+ 8.30. smtp
+ 8.31. ssh
+ 8.32. ssl
+ 8.33. stream
+ 8.34. stream_file
+ 8.35. stream_icmp
+ 8.36. stream_ip
+ 8.37. stream_tcp
+ 8.38. stream_udp
+ 8.39. stream_user
+ 8.40. telnet
+ 8.41. wizard
9. IPS Action Modules
15.4. Rules
15.5. Output
15.6. HTTP Profiles
+ 15.7. SDF Preprocessor
16. Snort2Lua
Snorty
,,_ -*> Snort++ <*-
-o" )~ Version 3.0.0-a4 (Build 222) from 2.9.8-383
+o" )~ Version 3.0.0-a4 (Build 224) from 2.9.8-383
'''' By Martin Roesch & The Snort Team
http://snort.org/contact#team
Copyright (C) 2014-2016 Cisco and/or its affiliates. All rights reserved.
* daq.whitelist: total whitelist verdicts
* daq.blacklist: total blacklist verdicts
* daq.ignore: total ignore verdicts
- * daq.internal blacklist: packets blacklisted internally due to
+ * daq.internal_blacklist: packets blacklisted internally due to
lack of DAQ support
- * daq.internal whitelist: packets whitelisted internally due to
+ * daq.internal_whitelist: packets whitelisted internally due to
lack of DAQ support
* daq.skipped: packets skipped at startup
* daq.idle: attempts to acquire from DAQ without available packets
Peg counts:
* detection.analyzed: packets sent to detection
- * detection.hard evals: non-fast pattern rule evaluations
- * detection.raw searches: fast pattern searches in raw packet data
- * detection.cooked searches: fast pattern searches in cooked packet
+ * detection.hard_evals: non-fast pattern rule evaluations
+ * detection.raw_searches: fast pattern searches in raw packet data
+ * detection.cooked_searches: fast pattern searches in cooked packet
data
- * detection.pkt searches: fast pattern searches in packet data
- * detection.alt searches: alt fast pattern searches in packet data
- * detection.key searches: fast pattern searches in key buffer
- * detection.header searches: fast pattern searches in header buffer
- * detection.body searches: fast pattern searches in body buffer
- * detection.file searches: fast pattern searches in file buffer
+ * detection.pkt_searches: fast pattern searches in packet data
+ * detection.alt_searches: alt fast pattern searches in packet data
+ * detection.key_searches: fast pattern searches in key buffer
+ * detection.header_searches: fast pattern searches in header buffer
+ * detection.body_searches: fast pattern searches in body buffer
+ * detection.file_searches: fast pattern searches in file buffer
* detection.alerts: alerts not including IP reputation
- * detection.total alerts: alerts including IP reputation
+ * detection.total_alerts: alerts including IP reputation
* detection.logged: logged packets
* detection.passed: passed packets
- * detection.match limit: fast pattern matches not processed
- * detection.queue limit: events not queued because queue full
- * detection.log limit: events queued but not logged
- * detection.event limit: events filtered
- * detection.alert limit: events previously triggered on same PDU
+ * detection.match_limit: fast pattern matches not processed
+ * detection.queue_limit: events not queued because queue full
+ * detection.log_limit: events queued but not logged
+ * detection.event_limit: events filtered
+ * detection.alert_limit: events previously triggered on same PDU
6.8. event_filter
action group or all action groups
-6.10. file_id
-
---------------
-
-What: configure file identification
-
-Type: basic
-
-Configuration:
-
- * int file_id.type_depth = 1460: stop type ID at this point { 0: }
- * int file_id.signature_depth = 10485760: stop signature at this
- point { 0: }
- * int file_id.block_timeout = 86400: stop blocking after this many
- seconds { 0: }
- * int file_id.lookup_timeout = 2: give up on lookup after this many
- seconds { 0: }
- * bool file_id.block_timeout_lookup = false: block if lookup times
- out
- * int file_id.capture_memcap = 100: memcap for file capture in
- megabytes { 0: }
- * int file_id.capture_max_size = 1048576: stop file capture beyond
- this point { 0: }
- * int file_id.capture_min_size = 0: stop file capture if file size
- less than this { 0: }
- * int file_id.capture_block_size = 32768: file capture block size
- in bytes { 8: }
- * int file_id.max_files_cached = 65536: maximal number of files
- cached in memory { 8: }
- * bool file_id.enable_type = false: enable type ID
- * bool file_id.enable_signature = false: enable signature
- calculation
- * bool file_id.enable_capture = false: enable file capture
- * int file_id.show_data_depth = 100: print this many octets { 0: }
- * int file_id.file_rules[].rev = 0: rule revision { 0: }
- * string file_id.file_rules[].msg: information about the file type
- * string file_id.file_rules[].type: file type name
- * int file_id.file_rules[].id = 0: file type id { 0: }
- * string file_id.file_rules[].category: file type category
- * string file_id.file_rules[].version: file type version
- * string file_id.file_rules[].magic[].content: file magic content
- * int file_id.file_rules[].magic[].offset = 0: file magic offset {
- 0: }
- * int file_id.file_policy[].when.file_type_id = 0: unique ID for
- file type in file magic rule { 0: }
- * string file_id.file_policy[].when.sha256: SHA 256
- * enum file_id.file_policy[].use.verdict = unknown: what to do with
- matching traffic { unknown | log | stop | block | reset }
- * bool file_id.file_policy[].use.enable_file_type = false: true/
- false → enable/disable file type identification
- * bool file_id.file_policy[].use.enable_file_signature = false:
- true/false → enable/disable file signature
- * bool file_id.file_policy[].use.enable_file_capture = false: true/
- false → enable/disable file capture
- * bool file_id.trace_type = false: enable runtime dump of type info
- * bool file_id.trace_signature = false: enable runtime dump of
- signature info
- * bool file_id.trace_stream = false: enable runtime dump of file
- data
-
-Peg counts:
-
- * file_id.total files: number of files processed
- * file_id.total file data: number of file data bytes processed
- * file_id.cache failures: number of file cache add failures
-
-
-6.11. high_availability
+6.10. high_availability
--------------
* real high_availability.min_sync = 1.0: minimum interval between
HA updates { 0.0:100.0 }
-Peg counts:
-
-6.12. host_cache
+6.11. host_cache
--------------
Peg counts:
- * host_cache.lru cache adds: lru cache added new entry
- * host_cache.lru cache replaces: lru cache replaced existing entry
- * host_cache.lru cache prunes: lru cache pruned entry to make space
+ * host_cache.lru_cache_adds: lru cache added new entry
+ * host_cache.lru_cache_replaces: lru cache replaced existing entry
+ * host_cache.lru_cache_prunes: lru cache pruned entry to make space
for new entry
- * host_cache.lru cache find hits: lru cache found entry in cache
- * host_cache.lru cache find misses: lru cache did not find entry in
+ * host_cache.lru_cache_find_hits: lru cache found entry in cache
+ * host_cache.lru_cache_find_misses: lru cache did not find entry in
cache
- * host_cache.lru cache removes: lru cache found entry and removed
+ * host_cache.lru_cache_removes: lru cache found entry and removed
it
- * host_cache.lru cache clears: lru cache clear API calls
+ * host_cache.lru_cache_clears: lru cache clear API calls
-6.13. host_tracker
+6.12. host_tracker
--------------
Peg counts:
- * host_tracker.service adds: host service adds
- * host_tracker.service finds: host service finds
- * host_tracker.service removes: host service removes
+ * host_tracker.service_adds: host service adds
+ * host_tracker.service_finds: host service finds
+ * host_tracker.service_removes: host service removes
-6.14. hosts
+6.13. hosts
--------------
* port hosts[].services[].port: port number
-6.15. ips
+6.14. ips
--------------
* string ips.rules: snort rules and includes
-6.16. latency
+6.15. latency
--------------
Peg counts:
- * latency.total packets: total packets monitored
- * latency.total usecs: total usecs elapsed
- * latency.max usecs: maximum usecs elapsed
- * latency.packet timeouts: packets that timed out
- * latency.total rule evals: total rule evals monitored
- * latency.rule eval timeouts: rule evals that timed out
- * latency.rule tree enables: rule tree re-enables
+ * latency.total_packets: total packets monitored
+ * latency.total_usecs: total usecs elapsed
+ * latency.max_usecs: maximum usecs elapsed
+ * latency.packet_timeouts: packets that timed out
+ * latency.total_rule_evals: total rule evals monitored
+ * latency.rule_eval_timeouts: rule evals that timed out
+ * latency.rule_tree_enables: rule tree re-enables
-6.17. memory
+6.16. memory
--------------
preemptive cleanup actions (percent, 0 to disable) { 0: }
-6.18. network
+6.17. network
--------------
unlimited) { 0:255 }
-6.19. output
+6.18. output
--------------
* bool output.verbose = false: be verbose (same as -v)
-6.20. packets
+6.19. packets
--------------
is used to track fragments and connections
-6.21. process
+6.20. process
--------------
timestamps
-6.22. profiler
+6.21. profiler
--------------
avg_match | avg_no_match }
-6.23. rate_filter
+6.22. rate_filter
--------------
according to track
-6.24. references
+6.23. references
--------------
* string references[].url: where this reference is defined
-6.25. rule_state
+6.24. rule_state
--------------
policies
-6.26. search_engine
+6.25. search_engine
--------------
Peg counts:
- * search_engine.max queued: maximum fast pattern matches queued for
+ * search_engine.max_queued: maximum fast pattern matches queued for
further evaluation
- * search_engine.total flushed: fast pattern matches discarded due
+ * search_engine.total_flushed: fast pattern matches discarded due
to overflow
- * search_engine.total inserts: total fast pattern hits
- * search_engine.total unique: total unique fast pattern hits
- * search_engine.non-qualified events: total non-qualified events
- * search_engine.qualified events: total qualified events
+ * search_engine.total_inserts: total fast pattern hits
+ * search_engine.total_unique: total unique fast pattern hits
+ * search_engine.non_qualified_events: total non-qualified events
+ * search_engine.qualified_events: total qualified events
-6.27. side_channel
+6.26. side_channel
--------------
* string side_channel.connectors[].connector: connector handle
* string side_channel.connector: connector handle
-Peg counts:
-
-6.28. snort
+6.27. snort
--------------
Peg counts:
- * snort.local commands: total local commands processed
- * snort.remote commands: total remote commands processed
+ * snort.local_commands: total local commands processed
+ * snort.remote_commands: total remote commands processed
* snort.signals: total signals processed
- * snort.conf reloads: number of times configuration was reloaded
- * snort.attribute table reloads: number of times hosts table was
+ * snort.conf_reloads: number of times configuration was reloaded
+ * snort.attribute_table_reloads: number of times hosts table was
reloaded
- * snort.attribute table hosts: total number of hosts in table
+ * snort.attribute_table_hosts: total number of hosts in table
-6.29. suppress
+6.28. suppress
--------------
Peg counts:
- * icmp4.bad checksum: non-zero icmp checksums
+ * icmp4.bad_checksum: non-zero icmp checksums
7.12. icmp6
Peg counts:
- * icmp6.bad checksum (ip4): nonzero ipcm4 checksums
- * icmp6.bad checksum (ip6): nonzero ipcm6 checksums
+ * icmp6.bad_icmp4_checksum: nonzero ipcm4 checksums
+ * icmp6.bad_icmp6_checksum: nonzero ipcm6 checksums
7.13. igmp
Peg counts:
- * ipv4.bad checksum: nonzero ip checksums
+ * ipv4.bad_checksum: nonzero ip checksums
7.15. ipv6
Peg counts:
- * mpls.total packets: total mpls labeled packets processed
- * mpls.total bytes: total mpls labeled bytes processed
+ * mpls.total_packets: total mpls labeled packets processed
+ * mpls.total_bytes: total mpls labeled bytes processed
7.17. pgm
Peg counts:
- * tcp.bad checksum (ip4): nonzero tcp over ip checksums
- * tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums
+ * tcp.bad_tcp4_checksum: nonzero tcp over ip checksums
+ * tcp.bad_tcp6_checksum: nonzero tcp over ipv6 checksums
7.20. udp
Peg counts:
- * udp.bad checksum (ip4): nonzero udp over ipv4 checksums
- * udp.bad checksum (ip6): nonzero udp over ipv6 checksums
+ * udp.bad_udp4_checksum: nonzero udp over ipv4 checksums
+ * udp.bad_udp6_checksum: nonzero udp over ipv6 checksums
7.21. vlan
* bool appid.debug = false: enable appid debug logging
* bool appid.dump_ports = false: enable dump of appid port
information
- * string appid.thirdparty_appid_dir: directory to load thirdparty
- appid detectors from
* addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip
address in CIDR format
* addr appid.session_log_filter.dst_ip = 0.0.0.0/32: destination ip
Peg counts:
* appid.packets: count of packets received
- * appid.processed packets: count of packets processed
- * appid.ignored packets: count of packets ignored
- * appid.aim clients: count of aim clients discovered
- * appid.battlefield flows: count of battle field flows discovered
- * appid.bgp flows: count of bgp flows discovered
- * appid.bit clients: count of bittorrent clients discovered
- * appid.bit flows: count of bittorrent flows discovered
- * appid.bittracker clients: count of bittorrent tracker clients
+ * appid.processed_packets: count of packets processed
+ * appid.ignored_packets: count of packets ignored
+ * appid.aim_clients: count of aim clients discovered
+ * appid.battlefield_flows: count of battle field flows discovered
+ * appid.bgp_flows: count of bgp flows discovered
+ * appid.bit_clients: count of bittorrent clients discovered
+ * appid.bit_flows: count of bittorrent flows discovered
+ * appid.bittracker_clients: count of bittorrent tracker clients
discovered
- * appid.bootp flows: count of bootp flows discovered
- * appid.dcerpc tcp flows: count of dce rpc flows over tcp
+ * appid.bootp_flows: count of bootp flows discovered
+ * appid.dcerpc_tcp_flows: count of dce rpc flows over tcp
discovered
- * appid.dcerpc udp flows: count of dce rpc flows over udp
+ * appid.dcerpc_udp_flows: count of dce rpc flows over udp
discovered
- * appid.direct connect flows: count of direct connect flows
+ * appid.direct_connect_flows: count of direct connect flows
discovered
- * appid.dns tcp flows: count of dns flows over tcp discovered
- * appid.dns udp flows: count of dns flows over udp discovered
- * appid.ftp flows: count of ftp flows discovered
- * appid.ftps flows: count of ftps flows discovered
- * appid.http flows: count of http flows discovered
- * appid.imap flows: count of imap service flows discovered
- * appid.imaps flows: count of imap TLS service flows discovered
- * appid.irc flows: count of irc service flows discovered
- * appid.kerberos clients: count of kerberos clients discovered
- * appid.kerberos flows: count of kerberos service flows discovered
- * appid.kerberos users: count of kerberos users discovered
- * appid.lpr flows: count of lpr service flows discovered
- * appid.mdns flows: count of mdns service flows discovered
- * appid.msn clients: count of msn clients discovered
- * appid.mysql flows: count of mysql service flows discovered
- * appid.netbios dgm flows: count of netbios-dgm service flows
+ * appid.dns_tcp_flows: count of dns flows over tcp discovered
+ * appid.dns_udp_flows: count of dns flows over udp discovered
+ * appid.ftp_flows: count of ftp flows discovered
+ * appid.ftps_flows: count of ftps flows discovered
+ * appid.http_flows: count of http flows discovered
+ * appid.imap_flows: count of imap service flows discovered
+ * appid.imaps_flows: count of imap TLS service flows discovered
+ * appid.irc_flows: count of irc service flows discovered
+ * appid.kerberos_clients: count of kerberos clients discovered
+ * appid.kerberos_flows: count of kerberos service flows discovered
+ * appid.kerberos_users: count of kerberos users discovered
+ * appid.lpr_flows: count of lpr service flows discovered
+ * appid.mdns_flows: count of mdns service flows discovered
+ * appid.msn_clients: count of msn clients discovered
+ * appid.mysql_flows: count of mysql service flows discovered
+ * appid.netbios_dgm_flows: count of netbios-dgm service flows
discovered
- * appid.netbios ns flows: count of netbios-ns service flows
+ * appid.netbios_ns_flows: count of netbios-ns service flows
discovered
- * appid.netbios ssn flows: count of netbios-ssn service flows
+ * appid.netbios_ssn_flows: count of netbios-ssn service flows
discovered
- * appid.nntp flows: count of nntp flows discovered
- * appid.ntp flows: count of ntp flows discovered
- * appid.pop flows: count of pop service flows discovered
- * appid.radius flows: count of radius flows discovered
- * appid.rexec flows: count of rexec flows discovered
- * appid.rfb flows: count of rfb flows discovered
- * appid.rlogin flows: count of rlogin flows discovered
- * appid.rpc flows: count of rpc flows discovered
- * appid.rshell flows: count of rshell flows discovered
- * appid.rsync flows: count of rsync service flows discovered
- * appid.rtmp flows: count of rtmp flows discovered
- * appid.rtp clients: count of rtp clients discovered
- * appid.sip clients: count of SIP clients discovered
- * appid.sip flows: count of SIP flows discovered
- * appid.smtp aol clients: count of AOL smtp clients discovered
- * appid.smtp applemail clients: count of Apple Mail smtp clients
+ * appid.nntp_flows: count of nntp flows discovered
+ * appid.ntp_flows: count of ntp flows discovered
+ * appid.pop_flows: count of pop service flows discovered
+ * appid.pop3_clients: count of pop3 clients discovered
+ * appid.pop3s_clients: count of pop3s clients discovered
+ * appid.radius_flows: count of radius flows discovered
+ * appid.rexec_flows: count of rexec flows discovered
+ * appid.rfb_flows: count of rfb flows discovered
+ * appid.rlogin_flows: count of rlogin flows discovered
+ * appid.rpc_flows: count of rpc flows discovered
+ * appid.rshell_flows: count of rshell flows discovered
+ * appid.rsync_flows: count of rsync service flows discovered
+ * appid.rtmp_flows: count of rtmp flows discovered
+ * appid.rtp_clients: count of rtp clients discovered
+ * appid.sip_clients: count of SIP clients discovered
+ * appid.sip_flows: count of SIP flows discovered
+ * appid.smtp_aol_clients: count of AOL smtp clients discovered
+ * appid.smtp_applemail_clients: count of Apple Mail smtp clients
discovered
- * appid.smtp eudora clients: count of Eudora smtp clients
+ * appid.smtp_eudora_clients: count of Eudora smtp clients
discovered
- * appid.smtp eudora pro clients: count of Eudora Pro smtp clients
+ * appid.smtp_eudora_pro_clients: count of Eudora Pro smtp clients
discovered
- * appid.smtp evolution clients: count of Evolution smtp clients
+ * appid.smtp_evolution_clients: count of Evolution smtp clients
discovered
- * appid.smtp kmail clients: count of KMail smtp clients discovered
- * appid.smtp lotus notes clients: count of Lotus Notes smtp clients
+ * appid.smtp_kmail_clients: count of KMail smtp clients discovered
+ * appid.smtp_lotus_notes_clients: count of Lotus Notes smtp clients
discovered
- * appid.smtp microsoft outlook clients: count of Microsoft Outlook
+ * appid.smtp_microsoft_outlook_clients: count of Microsoft Outlook
smtp clients discovered
- * appid.smtp microsoft outlook express clients: count of Microsoft
+ * appid.smtp_microsoft_outlook_express_clients: count_of Microsoft
Outlook Express smtp clients discovered
- * appid.smtp microsoft outlook imo clients: count of Microsoft
+ * appid.smtp_microsoft_outlook_imo_clients: count of Microsoft
Outlook IMO smtp clients discovered
- * appid.smtp mutt clients: count of Mutt smtp clients discovered
- * appid.smtp thunderbird clients: count of Thunderbird smtp clients
+ * appid.smtp_mutt_clients: count of Mutt smtp clients discovered
+ * appid.smtp_thunderbird_clients: count of Thunderbird smtp clients
discovered
- * appid.smtp flows: count of smtp flows discovered
- * appid.smtps flows: count of smtps flows discovered
- * appid.snmp flows: count of snmp flows discovered
- * appid.ssh clients: count of ssh clients discovered
- * appid.ssh flows: count of ssh flows discovered
- * appid.ssl flows: count of ssl flows discovered
- * appid.telnet flows: count of telnet flows discovered
- * appid.tftp flows: count of tftp flows discovered
- * appid.timbuktu flows: count of timbuktu flows discovered
- * appid.tns clients: count of tns clients discovered
- * appid.tns flows: count of tns flows discovered
- * appid.vnc clients: count of vnc clients discovered
- * appid.yahoo messenger clients: count of Yahoo Messenger clients
+ * appid.smtp_flows: count of smtp flows discovered
+ * appid.smtps_flows: count of smtps flows discovered
+ * appid.snmp_flows: count of snmp flows discovered
+ * appid.ssh_clients: count of ssh clients discovered
+ * appid.ssh_flows: count of ssh flows discovered
+ * appid.ssl_flows: count of ssl flows discovered
+ * appid.telnet_flows: count of telnet flows discovered
+ * appid.tftp_flows: count of tftp flows discovered
+ * appid.timbuktu_clients: count of timbuktu clients discovered
+ * appid.timbuktu_flows: count of timbuktu flows discovered
+ * appid.tns_clients: count of tns clients discovered
+ * appid.tns_flows: count of tns flows discovered
+ * appid.vnc_clients: count of vnc clients discovered
+ * appid.yahoo_messenger_clients: count of Yahoo Messenger clients
discovered
* binder.inspects: inspect bindings
-8.5. dce_smb
+8.5. dce_http_proxy
+
+--------------
+
+What: dce over http inspection - client to/from proxy
+
+Type: inspector
+
+Peg counts:
+
+ * dce_http_proxy.http_proxy_sessions: successful http proxy
+ sessions
+ * dce_http_proxy.http_proxy_session_failures: failed http proxy
+ sessions
+
+
+8.6. dce_http_server
+
+--------------
+
+What: dce over http inspection - proxy to/from server
+
+Type: inspector
+
+Peg counts:
+
+ * dce_http_server.http_server_sessions: successful http server
+ sessions
+ * dce_http_server.http_server_session_failures: failed http server
+ sessions
+
+
+8.7. dce_smb
--------------
Peg counts:
* dce_smb.events: total events
- * dce_smb.PDUs: total connection-oriented PDUs
- * dce_smb.Binds: total connection-oriented binds
- * dce_smb.Bind acks: total connection-oriented binds acks
- * dce_smb.Alter contexts: total connection-oriented alter contexts
- * dce_smb.Alter context responses: total connection-oriented alter
+ * dce_smb.pdus: total connection-oriented PDUs
+ * dce_smb.binds: total connection-oriented binds
+ * dce_smb.bind_acks: total connection-oriented binds acks
+ * dce_smb.alter_contexts: total connection-oriented alter contexts
+ * dce_smb.alter_context_responses: total connection-oriented alter
context responses
- * dce_smb.Bind naks: total connection-oriented bind naks
- * dce_smb.Requests: total connection-oriented requests
- * dce_smb.Responses: total connection-oriented responses
- * dce_smb.Cancels: total connection-oriented cancels
- * dce_smb.Orphaned: total connection-oriented orphaned
- * dce_smb.Faults: total connection-oriented faults
- * dce_smb.Auth3s: total connection-oriented auth3s
- * dce_smb.Shutdowns: total connection-oriented shutdowns
- * dce_smb.Rejects: total connection-oriented rejects
- * dce_smb.MS RPC/HTTP PDUs: total connection-oriented MS requests
+ * dce_smb.bind_naks: total connection-oriented bind naks
+ * dce_smb.requests: total connection-oriented requests
+ * dce_smb.responses: total connection-oriented responses
+ * dce_smb.cancels: total connection-oriented cancels
+ * dce_smb.orphaned: total connection-oriented orphaned
+ * dce_smb.faults: total connection-oriented faults
+ * dce_smb.auth3s: total connection-oriented auth3s
+ * dce_smb.shutdowns: total connection-oriented shutdowns
+ * dce_smb.rejects: total connection-oriented rejects
+ * dce_smb.ms_rpc_http_pdus: total connection-oriented MS requests
to send RPC over HTTP
- * dce_smb.Other requests: total connection-oriented other requests
- * dce_smb.Other responses: total connection-oriented other
+ * dce_smb.other_requests: total connection-oriented other requests
+ * dce_smb.other_responses: total connection-oriented other
responses
- * dce_smb.Request fragments: total connection-oriented request
+ * dce_smb.request_fragments: total connection-oriented request
fragments
- * dce_smb.Response fragments: total connection-oriented response
+ * dce_smb.response_fragments: total connection-oriented response
fragments
- * dce_smb.Client max fragment size: connection-oriented client
+ * dce_smb.client_max_fragment_size: connection-oriented client
maximum fragment size
- * dce_smb.Client min fragment size: connection-oriented client
+ * dce_smb.client_min_fragment_size: connection-oriented client
minimum fragment size
- * dce_smb.Client segs reassembled: total connection-oriented client
+ * dce_smb.client_segs_reassembled: total connection-oriented client
segments reassembled
- * dce_smb.Client frags reassembled: total connection-oriented
+ * dce_smb.client_frags_reassembled: total connection-oriented
client fragments reassembled
- * dce_smb.Server max fragment size: connection-oriented server
+ * dce_smb.server_max_fragment_size: connection-oriented server
maximum fragment size
- * dce_smb.Server min fragment size: connection-oriented server
+ * dce_smb.server_min_fragment_size: connection-oriented server
minimum fragment size
- * dce_smb.Server segs reassembled: total connection-oriented server
+ * dce_smb.server_segs_reassembled: total connection-oriented server
segments reassembled
- * dce_smb.Server frags reassembled: total connection-oriented
+ * dce_smb.server_frags_reassembled: total connection-oriented
server fragments reassembled
- * dce_smb.Sessions: total smb sessions
- * dce_smb.Packets: total smb packets
- * dce_smb.Ignored bytes: total ignored bytes
- * dce_smb.Client segs reassembled: total smb client segments
+ * dce_smb.sessions: total smb sessions
+ * dce_smb.packets: total smb packets
+ * dce_smb.ignored_bytes: total ignored bytes
+ * dce_smb.client_segs_reassembled: total smb client segments
reassembled
- * dce_smb.Server segs reassembled: total smb server segments
+ * dce_smb.server_segs_reassembled: total smb server segments
reassembled
- * dce_smb.Max outstanding requests: total smb maximum outstanding
+ * dce_smb.max_outstanding_requests: total smb maximum outstanding
requests
- * dce_smb.Files processed: total smb files processed
- * dce_smb.SMBv2 create: total number of SMBv2 create packets seen
- * dce_smb.SMBv2 write: total number of SMBv2 write packets seen
- * dce_smb.SMBv2 read: total number of SMBv2 read packets seen
- * dce_smb.SMBv2 set info: total number of SMBv2 set info packets
+ * dce_smb.files_processed: total smb files processed
+ * dce_smb.smbv2_create: total number of SMBv2 create packets seen
+ * dce_smb.smbv2_write: total number of SMBv2 write packets seen
+ * dce_smb.smbv2_read: total number of SMBv2 read packets seen
+ * dce_smb.smbv2_set_info: total number of SMBv2 set info packets
seen
- * dce_smb.SMBv2 tree connect: total number of SMBv2 tree connect
+ * dce_smb.smbv2_tree_connect: total number of SMBv2 tree connect
packets seen
- * dce_smb.SMBv2 tree disconnect: total number of SMBv2 tree
+ * dce_smb.smbv2_tree_disconnect: total number of SMBv2 tree
disconnect packets seen
- * dce_smb.SMBv2 close: total number of SMBv2 close packets seen
+ * dce_smb.smbv2_close: total number of SMBv2 close packets seen
-8.6. dce_tcp
+8.8. dce_tcp
--------------
Peg counts:
* dce_tcp.events: total events
- * dce_tcp.PDUs: total connection-oriented PDUs
- * dce_tcp.Binds: total connection-oriented binds
- * dce_tcp.Bind acks: total connection-oriented binds acks
- * dce_tcp.Alter contexts: total connection-oriented alter contexts
- * dce_tcp.Alter context responses: total connection-oriented alter
+ * dce_tcp.pdus: total connection-oriented PDUs
+ * dce_tcp.binds: total connection-oriented binds
+ * dce_tcp.bind_acks: total connection-oriented binds acks
+ * dce_tcp.alter_contexts: total connection-oriented alter contexts
+ * dce_tcp.alter_context_responses: total connection-oriented alter
context responses
- * dce_tcp.Bind naks: total connection-oriented bind naks
- * dce_tcp.Requests: total connection-oriented requests
- * dce_tcp.Responses: total connection-oriented responses
- * dce_tcp.Cancels: total connection-oriented cancels
- * dce_tcp.Orphaned: total connection-oriented orphaned
- * dce_tcp.Faults: total connection-oriented faults
- * dce_tcp.Auth3s: total connection-oriented auth3s
- * dce_tcp.Shutdowns: total connection-oriented shutdowns
- * dce_tcp.Rejects: total connection-oriented rejects
- * dce_tcp.MS RPC/HTTP PDUs: total connection-oriented MS requests
+ * dce_tcp.bind_naks: total connection-oriented bind naks
+ * dce_tcp.requests: total connection-oriented requests
+ * dce_tcp.responses: total connection-oriented responses
+ * dce_tcp.cancels: total connection-oriented cancels
+ * dce_tcp.orphaned: total connection-oriented orphaned
+ * dce_tcp.faults: total connection-oriented faults
+ * dce_tcp.auth3s: total connection-oriented auth3s
+ * dce_tcp.shutdowns: total connection-oriented shutdowns
+ * dce_tcp.rejects: total connection-oriented rejects
+ * dce_tcp.ms_rpc_http_pdus: total connection-oriented MS requests
to send RPC over HTTP
- * dce_tcp.Other requests: total connection-oriented other requests
- * dce_tcp.Other responses: total connection-oriented other
+ * dce_tcp.other_requests: total connection-oriented other requests
+ * dce_tcp.other_responses: total connection-oriented other
responses
- * dce_tcp.Request fragments: total connection-oriented request
+ * dce_tcp.request_fragments: total connection-oriented request
fragments
- * dce_tcp.Response fragments: total connection-oriented response
+ * dce_tcp.response_fragments: total connection-oriented response
fragments
- * dce_tcp.Client max fragment size: connection-oriented client
+ * dce_tcp.client_max_fragment_size: connection-oriented client
maximum fragment size
- * dce_tcp.Client min fragment size: connection-oriented client
+ * dce_tcp.client_min_fragment_size: connection-oriented client
minimum fragment size
- * dce_tcp.Client segs reassembled: total connection-oriented client
+ * dce_tcp.client_segs_reassembled: total connection-oriented client
segments reassembled
- * dce_tcp.Client frags reassembled: total connection-oriented
+ * dce_tcp.client_frags_reassembled: total connection-oriented
client fragments reassembled
- * dce_tcp.Server max fragment size: connection-oriented server
+ * dce_tcp.server_max_fragment_size: connection-oriented server
maximum fragment size
- * dce_tcp.Server min fragment size: connection-oriented server
+ * dce_tcp.server_min_fragment_size: connection-oriented server
minimum fragment size
- * dce_tcp.Server segs reassembled: total connection-oriented server
+ * dce_tcp.server_segs_reassembled: total connection-oriented server
segments reassembled
- * dce_tcp.Server frags reassembled: total connection-oriented
+ * dce_tcp.server_frags_reassembled: total connection-oriented
server fragments reassembled
- * dce_tcp.tcp sessions: total tcp sessions
- * dce_tcp.tcp packets: total tcp packets
+ * dce_tcp.tcp_sessions: total tcp sessions
+ * dce_tcp.tcp_packets: total tcp packets
-8.7. dce_udp
+8.9. dce_udp
--------------
Peg counts:
* dce_udp.events: total events
- * dce_udp.udp sessions: total udp sessions
- * dce_udp.udp packets: total udp packets
- * dce_udp.Requests: total connection-less requests
- * dce_udp.Acks: total connection-less acks
- * dce_udp.Cancels: total connection-less cancels
- * dce_udp.Client facks: total connection-less client facks
- * dce_udp.Ping: total connection-less ping
- * dce_udp.Responses: total connection-less responses
- * dce_udp.Rejects: total connection-less rejects
- * dce_udp.Cancel acks: total connection-less cancel acks
- * dce_udp.Server facks: total connection-less server facks
- * dce_udp.Faults: total connection-less faults
- * dce_udp.No calls: total connection-less no calls
- * dce_udp.Working: total connection-less working
- * dce_udp.Other requests: total connection-less other requests
- * dce_udp.Other responses: total connection-less other responses
- * dce_udp.Fragments: total connection-less fragments
- * dce_udp.Max fragment size: connection-less maximum fragment size
- * dce_udp.Frags reassembled: total connection-less fragments
+ * dce_udp.udp_sessions: total udp sessions
+ * dce_udp.udp_packets: total udp packets
+ * dce_udp.requests: total connection-less requests
+ * dce_udp.acks: total connection-less acks
+ * dce_udp.cancels: total connection-less cancels
+ * dce_udp.client_facks: total connection-less client facks
+ * dce_udp.ping: total connection-less ping
+ * dce_udp.responses: total connection-less responses
+ * dce_udp.rejects: total connection-less rejects
+ * dce_udp.cancel_acks: total connection-less cancel acks
+ * dce_udp.server_facks: total connection-less server facks
+ * dce_udp.faults: total connection-less faults
+ * dce_udp.no_calls: total connection-less no calls
+ * dce_udp.working: total connection-less working
+ * dce_udp.other_requests: total connection-less other requests
+ * dce_udp.other_responses: total connection-less other responses
+ * dce_udp.fragments: total connection-less fragments
+ * dce_udp.max_fragment_size: connection-less maximum fragment size
+ * dce_udp.frags_reassembled: total connection-less fragments
reassembled
- * dce_udp.Max seqnum: max connection-less seqnum
+ * dce_udp.max_seqnum: max connection-less seqnum
-8.8. dnp3
+8.10. dnp3
--------------
Peg counts:
- * dnp3.total packets: total packets
- * dnp3.udp packets: total udp packets
- * dnp3.tcp pdus: total tcp pdus
- * dnp3.dnp3 link layer frames: total dnp3 link layer frames
- * dnp3.dnp3 application pdus: total dnp3 application pdus
+ * dnp3.total_packets: total packets
+ * dnp3.udp_packets: total udp packets
+ * dnp3.tcp_pdus: total tcp pdus
+ * dnp3.dnp3_link_layer_frames: total dnp3 link layer frames
+ * dnp3.dnp3_application_pdus: total dnp3 application pdus
-8.9. dns
+8.11. dns
--------------
* dns.responses: total dns responses
-8.10. file_log
+8.12. file_id
+
+--------------
+
+What: configure file identification
+
+Type: inspector
+
+Configuration:
+
+ * int file_id.type_depth = 1460: stop type ID at this point { 0: }
+ * int file_id.signature_depth = 10485760: stop signature at this
+ point { 0: }
+ * int file_id.block_timeout = 86400: stop blocking after this many
+ seconds { 0: }
+ * int file_id.lookup_timeout = 2: give up on lookup after this many
+ seconds { 0: }
+ * bool file_id.block_timeout_lookup = false: block if lookup times
+ out
+ * int file_id.capture_memcap = 100: memcap for file capture in
+ megabytes { 0: }
+ * int file_id.capture_max_size = 1048576: stop file capture beyond
+ this point { 0: }
+ * int file_id.capture_min_size = 0: stop file capture if file size
+ less than this { 0: }
+ * int file_id.capture_block_size = 32768: file capture block size
+ in bytes { 8: }
+ * int file_id.max_files_cached = 65536: maximal number of files
+ cached in memory { 8: }
+ * bool file_id.enable_type = false: enable type ID
+ * bool file_id.enable_signature = false: enable signature
+ calculation
+ * bool file_id.enable_capture = false: enable file capture
+ * int file_id.show_data_depth = 100: print this many octets { 0: }
+ * int file_id.file_rules[].rev = 0: rule revision { 0: }
+ * string file_id.file_rules[].msg: information about the file type
+ * string file_id.file_rules[].type: file type name
+ * int file_id.file_rules[].id = 0: file type id { 0: }
+ * string file_id.file_rules[].category: file type category
+ * string file_id.file_rules[].version: file type version
+ * string file_id.file_rules[].magic[].content: file magic content
+ * int file_id.file_rules[].magic[].offset = 0: file magic offset {
+ 0: }
+ * int file_id.file_policy[].when.file_type_id = 0: unique ID for
+ file type in file magic rule { 0: }
+ * string file_id.file_policy[].when.sha256: SHA 256
+ * enum file_id.file_policy[].use.verdict = unknown: what to do with
+ matching traffic { unknown | log | stop | block | reset }
+ * bool file_id.file_policy[].use.enable_file_type = false: true/
+ false → enable/disable file type identification
+ * bool file_id.file_policy[].use.enable_file_signature = false:
+ true/false → enable/disable file signature
+ * bool file_id.file_policy[].use.enable_file_capture = false: true/
+ false → enable/disable file capture
+ * bool file_id.trace_type = false: enable runtime dump of type info
+ * bool file_id.trace_signature = false: enable runtime dump of
+ signature info
+ * bool file_id.trace_stream = false: enable runtime dump of file
+ data
+
+Peg counts:
+
+ * file_id.total_files: number of files processed
+ * file_id.total_file_data: number of file data bytes processed
+ * file_id.cache_failures: number of file cache add failures
+
+
+8.13. file_log
--------------
Peg counts:
- * file_log.total events: total file events
+ * file_log.total_events: total file events
-8.11. ftp_client
+8.14. ftp_client
--------------
sequences on ftp control channel
-8.12. ftp_data
+8.15. ftp_data
--------------
* ftp_data.packets: total packets
-8.13. ftp_server
+8.16. ftp_server
--------------
* ftp_server.packets: total packets
-8.14. gtp_inspect
+8.17. gtp_inspect
--------------
* gtp_inspect.sessions: total sessions processed
* gtp_inspect.events: requests
- * gtp_inspect.unknown types: unknown message types
- * gtp_inspect.unknown infos: unknown information elements
+ * gtp_inspect.unknown_types: unknown message types
+ * gtp_inspect.unknown_infos: unknown information elements
-8.15. http_inspect
+8.18. http_inspect
--------------
Content-Encoding used
* 119:78 (http_inspect) multiple layers of compression encodings
applied
+ * 119:79 (http_inspect) server response before client request
Peg counts:
* http_inspect.inspections: total message sections inspected
* http_inspect.requests: HTTP request messages inspected
* http_inspect.responses: HTTP response messages inspected
- * http_inspect.GET requests: GET requests inspected
- * http_inspect.HEAD requests: HEAD requests inspected
- * http_inspect.POST requests: POST requests inspected
- * http_inspect.PUT requests: PUT requests inspected
- * http_inspect.DELETE requests: DELETE requests inspected
- * http_inspect.CONNECT requests: CONNECT requests inspected
- * http_inspect.OPTIONS requests: OPTIONS requests inspected
- * http_inspect.TRACE requests: TRACE requests inspected
- * http_inspect.other requests: other request methods inspected
- * http_inspect.request bodies: POST, PUT, and other requests with
+ * http_inspect.get_requests: GET requests inspected
+ * http_inspect.head_requests: HEAD requests inspected
+ * http_inspect.post_requests: POST requests inspected
+ * http_inspect.put_requests: PUT requests inspected
+ * http_inspect.delete_requests: DELETE requests inspected
+ * http_inspect.connect_requests: CONNECT requests inspected
+ * http_inspect.options_requests: OPTIONS requests inspected
+ * http_inspect.trace_requests: TRACE requests inspected
+ * http_inspect.other_requests: other request methods inspected
+ * http_inspect.request_bodies: POST, PUT, and other requests with
message bodies
* http_inspect.chunked: chunked message bodies
- * http_inspect.URI normalizations: URIs needing to be normalization
- * http_inspect.URI path: URIs with path problems
- * http_inspect.URI coding: URIs with character coding problems
+ * http_inspect.uri_normalizations: URIs needing to be normalization
+ * http_inspect.uri_path: URIs with path problems
+ * http_inspect.uri_coding: URIs with character coding problems
-8.16. imap
+8.19. imap
--------------
* imap.packets: total packets processed
* imap.sessions: total imap sessions
- * imap.b64 attachments: total base64 attachments decoded
- * imap.b64 decoded bytes: total base64 decoded bytes
- * imap.qp attachments: total quoted-printable attachments decoded
- * imap.qp decoded bytes: total quoted-printable decoded bytes
- * imap.uu attachments: total uu attachments decoded
- * imap.uu decoded bytes: total uu decoded bytes
- * imap.non-encoded attachments: total non-encoded attachments
+ * imap.b64_attachments: total base64 attachments decoded
+ * imap.b64_decoded_bytes: total base64 decoded bytes
+ * imap.qp_attachments: total quoted-printable attachments decoded
+ * imap.qp_decoded_bytes: total quoted-printable decoded bytes
+ * imap.uu_attachments: total uu attachments decoded
+ * imap.uu_decoded_bytes: total uu decoded bytes
+ * imap.non_encoded_attachments: total non-encoded attachments
extracted
- * imap.non-encoded bytes: total non-encoded extracted bytes
+ * imap.non_encoded_bytes: total non-encoded extracted bytes
-8.17. modbus
+8.20. modbus
--------------
* modbus.frames: total Modbus messages
-8.18. normalizer
+8.21. normalizer
--------------
Peg counts:
- * normalizer.ip4 trim: eth packets trimmed to datagram size
- * normalizer.test ip4 trim: test eth packets trimmed to datagram
+ * normalizer.ip4_trim: eth packets trimmed to datagram size
+ * normalizer.test_ip4_trim: test eth packets trimmed to datagram
size
- * normalizer.ip4 tos: type of service normalizations
- * normalizer.test ip4 tos: test type of service normalizations
- * normalizer.ip4 df: don’t frag bit normalizations
- * normalizer.test ip4 df: test don’t frag bit normalizations
- * normalizer.ip4 rf: reserved flag bit clears
- * normalizer.test ip4 rf: test reserved flag bit clears
- * normalizer.ip4 ttl: time-to-live normalizations
- * normalizer.test ip4 ttl: test time-to-live normalizations
- * normalizer.ip4 opts: ip4 options cleared
- * normalizer.test ip4 opts: test ip4 options cleared
- * normalizer.icmp4 echo: icmp4 ping normalizations
- * normalizer.test icmp4 echo: test icmp4 ping normalizations
- * normalizer.ip6 hops: ip6 hop limit normalizations
- * normalizer.test ip6 hops: test ip6 hop limit normalizations
- * normalizer.ip6 options: ip6 options cleared
- * normalizer.test ip6 options: test ip6 options cleared
- * normalizer.icmp6 echo: icmp6 echo normalizations
- * normalizer.test icmp6 echo: test icmp6 echo normalizations
- * normalizer.tcp syn options: SYN only options cleared from non-SYN
+ * normalizer.ip4_tos: type of service normalizations
+ * normalizer.test_ip4_tos: test type of service normalizations
+ * normalizer.ip4_df: don’t frag bit normalizations
+ * normalizer.test_ip4_df: test don’t frag bit normalizations
+ * normalizer.ip4_rf: reserved flag bit clears
+ * normalizer.test_ip4_rf: test reserved flag bit clears
+ * normalizer.ip4_ttl: time-to-live normalizations
+ * normalizer.test_ip4_ttl: test time-to-live normalizations
+ * normalizer.ip4_opts: ip4 options cleared
+ * normalizer.test_ip4_opts: test ip4 options cleared
+ * normalizer.icmp4_echo: icmp4 ping normalizations
+ * normalizer.test_icmp4_echo: test icmp4 ping normalizations
+ * normalizer.ip6_hops: ip6 hop limit normalizations
+ * normalizer.test_ip6_hops: test ip6 hop limit normalizations
+ * normalizer.ip6_options: ip6 options cleared
+ * normalizer.test_ip6_options: test ip6 options cleared
+ * normalizer.icmp6_echo: icmp6 echo normalizations
+ * normalizer.test_icmp6_echo: test icmp6 echo normalizations
+ * normalizer.tcp_syn_options: SYN only options cleared from non-SYN
packets
- * normalizer.test tcp syn options: test SYN only options cleared
+ * normalizer.test_tcp_syn_options: test SYN only options cleared
from non-SYN packets
- * normalizer.tcp options: packets with options cleared
- * normalizer.test tcp options: test packets with options cleared
- * normalizer.tcp paddding: packets with padding cleared
- * normalizer.test tcp paddding: test packets with padding cleared
- * normalizer.tcp reserved: packets with reserved bits cleared
- * normalizer.test tcp reserved: test packets with reserved bits
+ * normalizer.tcp_options: packets with options cleared
+ * normalizer.test_tcp_options: test packets with options cleared
+ * normalizer.tcp_paddding: packets with padding cleared
+ * normalizer.test_tcp_paddding: test packets with padding cleared
+ * normalizer.tcp_reserved: packets with reserved bits cleared
+ * normalizer.test_tcp_reserved: test packets with reserved bits
cleared
- * normalizer.tcp nonce: packets with nonce bit cleared
- * normalizer.test tcp nonce: test packets with nonce bit cleared
- * normalizer.tcp urgent ptr: packets without data with urgent
+ * normalizer.tcp_nonce: packets with nonce bit cleared
+ * normalizer.test_tcp_nonce: test packets with nonce bit cleared
+ * normalizer.tcp_urgent_ptr: packets without data with urgent
pointer cleared
- * normalizer.test tcp urgent ptr: test packets without data with
+ * normalizer.test_tcp_urgent_ptr: test packets without data with
urgent pointer cleared
- * normalizer.tcp ecn pkt: packets with ECN bits cleared
- * normalizer.test tcp ecn pkt: test packets with ECN bits cleared
- * normalizer.tcp ts ecr: timestamp cleared on non-ACKs
- * normalizer.test tcp ts ecr: test timestamp cleared on non-ACKs
- * normalizer.tcp req urg: cleared urgent pointer when urgent flag
+ * normalizer.tcp_ecn_pkt: packets with ECN bits cleared
+ * normalizer.test_tcp_ecn_pkt: test packets with ECN bits cleared
+ * normalizer.tcp_ts_ecr: timestamp cleared on non-ACKs
+ * normalizer.test_tcp_ts_ecr: test timestamp cleared on non-ACKs
+ * normalizer.tcp_req_urg: cleared urgent pointer when urgent flag
is not set
- * normalizer.test tcp req urg: test cleared urgent pointer when
+ * normalizer.test_tcp_req_urg: test cleared urgent pointer when
urgent flag is not set
- * normalizer.tcp req pay: cleared urgent pointer and urgent flag
+ * normalizer.tcp_req_pay: cleared urgent pointer and urgent flag
when there is no payload
- * normalizer.test tcp req pay: test cleared urgent pointer and
+ * normalizer.test_tcp_req_pay: test cleared urgent pointer and
urgent flag when there is no payload
- * normalizer.tcp req urp: cleared the urgent flag if the urgent
+ * normalizer.tcp_req_urp: cleared the urgent flag if the urgent
pointer is not set
- * normalizer.test tcp req urp: test cleared the urgent flag if the
+ * normalizer.test_tcp_req_urp: test cleared the urgent flag if the
urgent pointer is not set
- * normalizer.tcp trim syn: tcp segments trimmed on SYN
- * normalizer.test tcp trim syn: test tcp segments trimmed on SYN
- * normalizer.tcp trim rst: RST packets with data trimmed
- * normalizer.test tcp trim rst: test RST packets with data trimmed
- * normalizer.tcp trim win: data trimed to window
- * normalizer.test tcp trim win: test data trimed to window
- * normalizer.tcp trim mss: data trimmed to MSS
- * normalizer.test tcp trim mss: test data trimmed to MSS
- * normalizer.tcp ecn session: ECN bits cleared
- * normalizer.test tcp ecn session: test ECN bits cleared
- * normalizer.tcp ts nop: timestamp options cleared
- * normalizer.test tcp ts nop: test timestamp options cleared
- * normalizer.tcp ips data: normalized segments
- * normalizer.test tcp ips data: test normalized segments
- * normalizer.tcp block: blocked segments
- * normalizer.test tcp block: test blocked segments
+ * normalizer.tcp_trim_syn: tcp segments trimmed on SYN
+ * normalizer.test_tcp_trim_syn: test tcp segments trimmed on SYN
+ * normalizer.tcp_trim_rst: RST packets with data trimmed
+ * normalizer.test_tcp_trim_rst: test RST packets with data trimmed
+ * normalizer.tcp_trim_win: data trimed to window
+ * normalizer.test_tcp_trim_win: test data trimed to window
+ * normalizer.tcp_trim_mss: data trimmed to MSS
+ * normalizer.test_tcp_trim_mss: test data trimmed to MSS
+ * normalizer.tcp_ecn_session: ECN bits cleared
+ * normalizer.test_tcp_ecn_session: test ECN bits cleared
+ * normalizer.tcp_ts_nop: timestamp options cleared
+ * normalizer.test_tcp_ts_nop: test timestamp options cleared
+ * normalizer.tcp_ips_data: normalized segments
+ * normalizer.test_tcp_ips_data: test normalized segments
+ * normalizer.tcp_block: blocked segments
+ * normalizer.test_tcp_block: test blocked segments
-8.19. packet_capture
+8.22. packet_capture
--------------
filter
-8.20. perf_monitor
+8.23. perf_monitor
--------------
* perf_monitor.packets: total packets
-8.21. pop
+8.24. pop
--------------
* pop.packets: total packets processed
* pop.sessions: total pop sessions
- * pop.b64 attachments: total base64 attachments decoded
- * pop.b64 decoded bytes: total base64 decoded bytes
- * pop.qp attachments: total quoted-printable attachments decoded
- * pop.qp decoded bytes: total quoted-printable decoded bytes
- * pop.uu attachments: total uu attachments decoded
- * pop.uu decoded bytes: total uu decoded bytes
- * pop.non-encoded attachments: total non-encoded attachments
+ * pop.b64_attachments: total base64 attachments decoded
+ * pop.b64_decoded_bytes: total base64 decoded bytes
+ * pop.qp_attachments: total quoted-printable attachments decoded
+ * pop.qp_decoded_bytes: total quoted-printable decoded bytes
+ * pop.uu_attachments: total uu attachments decoded
+ * pop.uu_decoded_bytes: total uu decoded bytes
+ * pop.non_encoded_attachments: total non-encoded attachments
extracted
- * pop.non-encoded bytes: total non-encoded extracted bytes
+ * pop.non_encoded_bytes: total non-encoded extracted bytes
-8.22. port_scan
+8.25. port_scan
--------------
* 122:27 (port_scan) open port
-8.23. port_scan_global
+8.26. port_scan_global
--------------
* port_scan_global.packets: total packets
-8.24. reputation
+8.27. reputation
--------------
* reputation.blacklisted: number of packets blacklisted
* reputation.whitelisted: number of packets whitelisted
* reputation.monitored: number of packets monitored
- * reputation.memory allocated: total memory allocated
+ * reputation.memory_allocated: total memory allocated
-8.25. rpc_decode
+8.28. rpc_decode
--------------
* rpc_decode.packets: total packets
-8.26. sip
+8.29. sip
--------------
* sip.sessions: total sessions
* sip.events: events generated
* sip.dialogs: total dialogs
- * sip.ignored channels: total channels ignored
- * sip.ignored sessions: total sessions ignored
- * sip.total requests: total requests
+ * sip.ignored_channels: total channels ignored
+ * sip.ignored_sessions: total sessions ignored
+ * sip.total_requests: total requests
* sip.invite: invite
* sip.cancel: cancel
* sip.ack: ack
* sip.message: message
* sip.notify: notify
* sip.prack: prack
- * sip.total responses: total responses
+ * sip.total_responses: total responses
* sip.1xx: 1xx
* sip.2xx: 2xx
* sip.3xx: 3xx
* sip.9xx: 9xx
-8.27. smtp
+8.30. smtp
--------------
* smtp.packets: total packets processed
* smtp.sessions: total smtp sessions
- * smtp.concurrent sessions: total concurrent smtp sessions
- * smtp.max concurrent sessions: maximum concurrent smtp sessions
- * smtp.b64 attachments: total base64 attachments decoded
- * smtp.b64 decoded bytes: total base64 decoded bytes
- * smtp.qp attachments: total quoted-printable attachments decoded
- * smtp.qp decoded bytes: total quoted-printable decoded bytes
- * smtp.uu attachments: total uu attachments decoded
- * smtp.uu decoded bytes: total uu decoded bytes
- * smtp.non-encoded attachments: total non-encoded attachments
+ * smtp.concurrent_sessions: total concurrent smtp sessions
+ * smtp.max_concurrent_sessions: maximum concurrent smtp sessions
+ * smtp.b64_attachments: total base64 attachments decoded
+ * smtp.b64_decoded_bytes: total base64 decoded bytes
+ * smtp.qp_attachments: total quoted-printable attachments decoded
+ * smtp.qp_decoded_bytes: total quoted-printable decoded bytes
+ * smtp.uu_attachments: total uu attachments decoded
+ * smtp.uu_decoded_bytes: total uu decoded bytes
+ * smtp.non_encoded_attachments: total non-encoded attachments
extracted
- * smtp.non-encoded bytes: total non-encoded extracted bytes
+ * smtp.non_encoded_bytes: total non-encoded extracted bytes
-8.28. ssh
+8.31. ssh
--------------
* ssh.packets: total packets
-8.29. ssl
+8.32. ssl
--------------
* ssl.packets: total packets processed
* ssl.decoded: ssl packets decoded
- * ssl.client hello: total client hellos
- * ssl.server hello: total server hellos
+ * ssl.client_hello: total client hellos
+ * ssl.server_hello: total server hellos
* ssl.certificate: total ssl certificates
- * ssl.server done: total server done
- * ssl.client key exchange: total client key exchanges
- * ssl.server key exchange: total server key exchanges
- * ssl.change cipher: total change cipher records
+ * ssl.server_done: total server done
+ * ssl.client_key_exchange: total client key exchanges
+ * ssl.server_key_exchange: total server key exchanges
+ * ssl.change_cipher: total change cipher records
* ssl.finished: total handshakes finished
- * ssl.client application: total client application records
- * ssl.server application: total server application records
+ * ssl.client_application: total client application records
+ * ssl.server_application: total server application records
* ssl.alert: total ssl alert records
- * ssl.unrecognized records: total unrecognized records
- * ssl.handshakes completed: total completed ssl handshakes
- * ssl.bad handshakes: total bad handshakes
- * ssl.sessions ignored: total sessions ignore
- * ssl.detection disabled: total detection disabled
+ * ssl.unrecognized_records: total unrecognized records
+ * ssl.handshakes_completed: total completed ssl handshakes
+ * ssl.bad_handshakes: total bad handshakes
+ * ssl.sessions_ignored: total sessions ignore
+ * ssl.detection_disabled: total detection disabled
-8.30. stream
+8.33. stream
--------------
Peg counts:
- * stream.ip flows: total ip sessions
- * stream.ip total prunes: total ip sessions pruned
- * stream.ip idle prunes: ip sessions pruned due to timeout
- * stream.ip excess prunes: ip sessions pruned due to excess
- * stream.ip uni prunes: ip uni sessions pruned
- * stream.ip preemptive prunes: ip sessions pruned during preemptive
+ * stream.ip_flows: total ip sessions
+ * stream.ip_total_prunes: total ip sessions pruned
+ * stream.ip_idle_prunes: ip sessions pruned due to timeout
+ * stream.ip_excess_prunes: ip sessions pruned due to excess
+ * stream.ip_uni_prunes: ip uni sessions pruned
+ * stream.ip_preemptive_prunes: ip sessions pruned during preemptive
pruning
- * stream.ip memcap prunes: ip sessions pruned due to memcap
- * stream.ip ha prunes: ip sessions pruned by high availability sync
- * stream.icmp flows: total icmp sessions
- * stream.icmp total prunes: total icmp sessions pruned
- * stream.icmp idle prunes: icmp sessions pruned due to timeout
- * stream.icmp excess prunes: icmp sessions pruned due to excess
- * stream.icmp uni prunes: icmp uni sessions pruned
- * stream.icmp preemptive prunes: icmp sessions pruned during
+ * stream.ip_memcap_prunes: ip sessions pruned due to memcap
+ * stream.ip_ha_prunes: ip sessions pruned by high availability sync
+ * stream.icmp_flows: total icmp sessions
+ * stream.icmp_total_prunes: total icmp sessions pruned
+ * stream.icmp_idle_prunes: icmp sessions pruned due to timeout
+ * stream.icmp_excess_prunes: icmp sessions pruned due to excess
+ * stream.icmp_uni_prunes: icmp uni sessions pruned
+ * stream.icmp_preemptive_prunes: icmp sessions pruned during
preemptive pruning
- * stream.icmp memcap prunes: icmp sessions pruned due to memcap
- * stream.icmp ha prunes: icmp sessions pruned by high availability
+ * stream.icmp_memcap_prunes: icmp sessions pruned due to memcap
+ * stream.icmp_ha_prunes: icmp sessions pruned by high availability
sync
- * stream.tcp flows: total tcp sessions
- * stream.tcp total prunes: total tcp sessions pruned
- * stream.tcp idle prunes: tcp sessions pruned due to timeout
- * stream.tcp excess prunes: tcp sessions pruned due to excess
- * stream.tcp uni prunes: tcp uni sessions pruned
- * stream.tcp preemptive prunes: tcp sessions pruned during
+ * stream.tcp_flows: total tcp sessions
+ * stream.tcp_total_prunes: total tcp sessions pruned
+ * stream.tcp_idle_prunes: tcp sessions pruned due to timeout
+ * stream.tcp_excess_prunes: tcp sessions pruned due to excess
+ * stream.tcp_uni_prunes: tcp uni sessions pruned
+ * stream.tcp_preemptive_prunes: tcp sessions pruned during
preemptive pruning
- * stream.tcp memcap prunes: tcp sessions pruned due to memcap
- * stream.tcp ha prunes: tcp sessions pruned by high availability
+ * stream.tcp_memcap_prunes: tcp sessions pruned due to memcap
+ * stream.tcp_ha_prunes: tcp sessions pruned by high availability
sync
- * stream.udp flows: total udp sessions
- * stream.udp total prunes: total udp sessions pruned
- * stream.udp idle prunes: udp sessions pruned due to timeout
- * stream.udp excess prunes: udp sessions pruned due to excess
- * stream.udp uni prunes: udp uni sessions pruned
- * stream.udp preemptive prunes: udp sessions pruned during
+ * stream.udp_flows: total udp sessions
+ * stream.udp_total_prunes: total udp sessions pruned
+ * stream.udp_idle_prunes: udp sessions pruned due to timeout
+ * stream.udp_excess_prunes: udp sessions pruned due to excess
+ * stream.udp_uni_prunes: udp uni sessions pruned
+ * stream.udp_preemptive_prunes: udp sessions pruned during
preemptive pruning
- * stream.udp memcap prunes: udp sessions pruned due to memcap
- * stream.udp ha prunes: udp sessions pruned by high availability
+ * stream.udp_memcap_prunes: udp sessions pruned due to memcap
+ * stream.udp_ha_prunes: udp sessions pruned by high availability
sync
- * stream.user flows: total user sessions
- * stream.user total prunes: total user sessions pruned
- * stream.user idle prunes: user sessions pruned due to timeout
- * stream.user excess prunes: user sessions pruned due to excess
- * stream.user uni prunes: user uni sessions pruned
- * stream.user preemptive prunes: user sessions pruned during
+ * stream.user_flows: total user sessions
+ * stream.user_total_prunes: total user sessions pruned
+ * stream.user_idle_prunes: user sessions pruned due to timeout
+ * stream.user_excess_prunes: user sessions pruned due to excess
+ * stream.user_uni_prunes: user uni sessions pruned
+ * stream.user_preemptive_prunes: user sessions pruned during
preemptive pruning
- * stream.user memcap prunes: user sessions pruned due to memcap
- * stream.user ha prunes: user sessions pruned by high availability
+ * stream.user_memcap_prunes: user sessions pruned due to memcap
+ * stream.user_ha_prunes: user sessions pruned by high availability
sync
- * stream.file flows: total file sessions
- * stream.file total prunes: total file sessions pruned
- * stream.file idle prunes: file sessions pruned due to timeout
- * stream.file excess prunes: file sessions pruned due to excess
- * stream.file uni prunes: file uni sessions pruned
- * stream.file preemptive prunes: file sessions pruned during
+ * stream.file_flows: total file sessions
+ * stream.file_total_prunes: total file sessions pruned
+ * stream.file_idle_prunes: file sessions pruned due to timeout
+ * stream.file_excess_prunes: file sessions pruned due to excess
+ * stream.file_uni_prunes: file uni sessions pruned
+ * stream.file_preemptive_prunes: file sessions pruned during
preemptive pruning
- * stream.file memcap prunes: file sessions pruned due to memcap
- * stream.file ha prunes: file sessions pruned by high availability
+ * stream.file_memcap_prunes: file sessions pruned due to memcap
+ * stream.file_ha_prunes: file sessions pruned by high availability
sync
-8.31. stream_file
+8.34. stream_file
--------------
* bool stream_file.upload = false: indicate file transfer direction
-8.32. stream_icmp
+8.35. stream_icmp
--------------
Peg counts:
- * stream_icmp.sessions: total icmp sessions
- * stream_icmp.max: max icmp sessions
- * stream_icmp.created: icmp session trackers created
- * stream_icmp.released: icmp session trackers released
- * stream_icmp.timeouts: icmp session timeouts
- * stream_icmp.prunes: icmp session prunes
+ * stream_icmp.sessions: total icmp_ sessions
+ * stream_icmp.max: max icmp_ sessions
+ * stream_icmp.created: icmp_ session trackers created
+ * stream_icmp.released: icmp_ session trackers released
+ * stream_icmp.timeouts: icmp_ session timeouts
+ * stream_icmp.prunes: icmp_ session prunes
-8.33. stream_ip
+8.36. stream_ip
--------------
Peg counts:
- * stream_ip.sessions: total ip sessions
- * stream_ip.max: max ip sessions
- * stream_ip.created: ip session trackers created
- * stream_ip.released: ip session trackers released
- * stream_ip.timeouts: ip session timeouts
- * stream_ip.prunes: ip session prunes
- * stream_ip.total frags: total fragments
- * stream_ip.current frags: current fragments
- * stream_ip.max frags: max fragments
+ * stream_ip.sessions: total ip_ sessions
+ * stream_ip.max: max ip_ sessions
+ * stream_ip.created: ip_ session trackers created
+ * stream_ip.released: ip_ session trackers released
+ * stream_ip.timeouts: ip_ session timeouts
+ * stream_ip.prunes: ip_ session prunes
+ * stream_ip.total_frags: total fragments
+ * stream_ip.current_frags: current fragments
+ * stream_ip.max_frags: max fragments
* stream_ip.reassembled: reassembled datagrams
* stream_ip.discards: fragments discarded
- * stream_ip.frag timeouts: datagrams abandoned
+ * stream_ip.frag_timeouts: datagrams abandoned
* stream_ip.overlaps: overlapping fragments
* stream_ip.anomalies: anomalies detected
* stream_ip.alerts: alerts generated
* stream_ip.drops: fragments dropped
- * stream_ip.trackers added: datagram trackers created
- * stream_ip.trackers freed: datagram trackers released
- * stream_ip.trackers cleared: datagram trackers cleared
- * stream_ip.trackers completed: datagram trackers completed
- * stream_ip.nodes inserted: fragments added to tracker
- * stream_ip.nodes deleted: fragments deleted from tracker
- * stream_ip.memory used: current memory usage in bytes
- * stream_ip.reassembled bytes: total reassembled bytes
- * stream_ip.fragmented bytes: total fragmented bytes
+ * stream_ip.trackers_added: datagram trackers created
+ * stream_ip.trackers_freed: datagram trackers released
+ * stream_ip.trackers_cleared: datagram trackers cleared
+ * stream_ip.trackers_completed: datagram trackers completed
+ * stream_ip.nodes_inserted: fragments added to tracker
+ * stream_ip.nodes_deleted: fragments deleted from tracker
+ * stream_ip.memory_used: current memory usage in bytes
+ * stream_ip.reassembled_bytes: total reassembled bytes
+ * stream_ip.fragmented_bytes: total fragmented bytes
-8.34. stream_tcp
+8.37. stream_tcp
--------------
Peg counts:
- * stream_tcp.sessions: total tcp sessions
- * stream_tcp.max: max tcp sessions
- * stream_tcp.created: tcp session trackers created
- * stream_tcp.released: tcp session trackers released
- * stream_tcp.timeouts: tcp session timeouts
- * stream_tcp.prunes: tcp session prunes
+ * stream_tcp.sessions: total tcp_ sessions
+ * stream_tcp.max: max tcp_ sessions
+ * stream_tcp.created: tcp_ session trackers created
+ * stream_tcp.released: tcp_ session trackers released
+ * stream_tcp.timeouts: tcp_ session timeouts
+ * stream_tcp.prunes: tcp_ session prunes
* stream_tcp.resyns: SYN received on established session
* stream_tcp.discards: tcp packets discarded
* stream_tcp.events: events generated
* stream_tcp.ignored: tcp packets ignored
* stream_tcp.untracked: tcp packets not tracked
- * stream_tcp.syn trackers: tcp session tracking started on syn
- * stream_tcp.syn-ack trackers: tcp session tracking started on
+ * stream_tcp.syn_trackers: tcp session tracking started on syn
+ * stream_tcp.syn_ack_trackers: tcp session tracking started on
syn-ack
- * stream_tcp.3way trackers: tcp session tracking started on ack
- * stream_tcp.data trackers: tcp session tracking started on data
- * stream_tcp.segs queued: total segments queued
- * stream_tcp.segs released: total segments released
- * stream_tcp.segs split: tcp segments split when reassembling PDUs
- * stream_tcp.segs used: queued tcp segments applied to reassembled
+ * stream_tcp.3way_trackers: tcp session tracking started on ack
+ * stream_tcp.data_trackers: tcp session tracking started on data
+ * stream_tcp.segs_queued: total segments queued
+ * stream_tcp.segs_released: total segments released
+ * stream_tcp.segs_split: tcp segments split when reassembling PDUs
+ * stream_tcp.segs_used: queued tcp segments applied to reassembled
PDUs
- * stream_tcp.rebuilt packets: total reassembled PDUs
- * stream_tcp.rebuilt buffers: rebuilt PDU sections
- * stream_tcp.rebuilt bytes: total rebuilt bytes
+ * stream_tcp.rebuilt_packets: total reassembled PDUs
+ * stream_tcp.rebuilt_buffers: rebuilt PDU sections
+ * stream_tcp.rebuilt_bytes: total rebuilt bytes
* stream_tcp.overlaps: overlapping segments queued
* stream_tcp.gaps: missing data between PDUs
- * stream_tcp.max segs: number of times the maximum queued segment
+ * stream_tcp.max_segs: number of times the maximum queued segment
limit was reached
- * stream_tcp.max bytes: number of times the maximum queued byte
+ * stream_tcp.max_bytes: number of times the maximum queued byte
limit was reached
- * stream_tcp.internal events: 135:X events generated
- * stream_tcp.client cleanups: number of times data from server was
+ * stream_tcp.internal_events: 135:X events generated
+ * stream_tcp.client_cleanups: number of times data from server was
flushed when session released
- * stream_tcp.server cleanups: number of times data from client was
+ * stream_tcp.server_cleanups: number of times data from client was
flushed when session released
* stream_tcp.memory: current memory in use
* stream_tcp.initializing: number of sessions currently
* stream_tcp.closing: number of sessions currently closing
-8.35. stream_udp
+8.38. stream_udp
--------------
Peg counts:
- * stream_udp.sessions: total udp sessions
- * stream_udp.max: max udp sessions
- * stream_udp.created: udp session trackers created
- * stream_udp.released: udp session trackers released
- * stream_udp.timeouts: udp session timeouts
- * stream_udp.prunes: udp session prunes
+ * stream_udp.sessions: total udp_ sessions
+ * stream_udp.max: max udp_ sessions
+ * stream_udp.created: udp_ session trackers created
+ * stream_udp.released: udp_ session trackers released
+ * stream_udp.timeouts: udp_ session timeouts
+ * stream_udp.prunes: udp_ session prunes
-8.36. stream_user
+8.39. stream_user
--------------
* int stream_user.session_timeout = 30: session tracking timeout {
1:86400 }
+ * int stream_user.trace: mask for enabling debug traces in module
-8.37. telnet
+8.40. telnet
--------------
* telnet.packets: total packets
-8.38. wizard
+8.41. wizard
--------------
Peg counts:
- * wizard.tcp scans: tcp payload scans
- * wizard.tcp hits: tcp identifications
- * wizard.udp scans: udp payload scans
- * wizard.udp hits: udp identifications
- * wizard.user scans: user payload scans
- * wizard.user hits: user identifications
+ * wizard.tcp_scans: tcp payload scans
+ * wizard.tcp_hits: tcp identifications
+ * wizard.udp_scans: udp payload scans
+ * wizard.udp_hits: udp identifications
+ * wizard.user_scans: user payload scans
+ * wizard.user_hits: user identifications
---------------------------------------------------------------------
Type: ips_action
+Configuration:
+
+ * bool rewrite.disable_replace = false: disable replace of packet
+ contents with rewrite rules
+
---------------------------------------------------------------------
Peg counts:
- * sd_pattern.below threshold: sd_pattern matched but missed
+ * sd_pattern.below_threshold: sd_pattern matched but missed
threshold
- * sd_pattern.pattern not found: sd_pattern did not not match
+ * sd_pattern.pattern_not_found: sd_pattern did not not match
* sd_pattern.terminated: hyperscan terminated
snort --help-config http_inspect | grep http_inspect.profile
+15.7. SDF Preprocessor
+
+--------------
+
+The Snort 2.X SDF Preprocessor is gone, replaced by ips option
+sd_pattern. The sd_pattern rule option is synonymous with the
+sd_pattern option used for gid:138 rules, but has a different syntax.
+A major difference in syntax is the use of Hyperscan pattern matching
+library which provides a regex language similar to PCRE.
+
+To facilitate continued performance, sd_pattern rule option is
+implemented with Hyperscan pattern matching library. The rule option
+is now also utilized as a "fast pattern" in the Snort engine which
+provides a significant performance improvement over the separate
+detection step of earlier implementations.
+
+The preprocessor alert SDF_COMBO_ALERT (139:1) has been removed and
+has no replacement in Snort 3.X. This is because the rule offered no
+additional value over gid:138 rules and was difficult to interpret
+the result of.
+
+For more information, See Features > Sensitive Data Filtering for
+details.
+
+
---------------------------------------------------------------------
16. Snort2Lua
Everything should be scoped as tightly as possible. Shared
implementation declarations should go in a separate header from
the interface. And so on.
- * A .cc should include its own .h before any others (including
- system headers). This ensures that the header stands on its own
- and can be used by clients without include prerequisites and the
- developer will be the first to find a dependency problem.
- * Include required headers, all required headers, and nothing but
- required headers. Don’t just clone a bunch of headers because it
- is convenient.
- * Try to keep includes in alpha order. This makes it easier to
- maintain, avoid duplicates, etc.
- * Any file depending on #ifdefs should include config.h as shown
- below. A .h should include it before any other includes, and a
- .cc should include it immediately after the include of its own
- .h.
+ * All .cc files should include config.h with the standard block
+ shown below immediately following the initial comment blocks and
+ before anything else. This presents a consistent view of all
+ included header files as well as access to any other
+ configure-time definitions. No .h files should include config.h
+ unless they are guaranteed to be local header files (never
+ installed).
#ifdef HAVE_CONFIG_H
#include "config.h"
#endif
+ * A .cc should include its own .h before any others aside from the
+ aforementioned config.h (including system headers). This ensures
+ that the header stands on its own and can be used by clients
+ without include prerequisites and the developer will be the first
+ to find a dependency issue.
+ * Split headers included from the local directory into a final
+ block of headers. For a .cc file, the final order of sets of
+ header includes should look like this:
+
+ 1. config.h
+ 2. its own .h file
+ 3. system headers (.h/.hpp/.hxx)
+ 4. C++ standard library headers (no file extension)
+ 5. Snort headers external to the local directory (path-prefixed)
+ 6. Snort headers in the local directory
+ * Include required headers, all required headers, and nothing but
+ required headers. Don’t just clone a bunch of headers because it
+ is convenient.
+ * Keep includes in alphabetical order. This makes it easier to
+ maintain, avoid duplicates, etc.
* Do not put using statements in headers unless they are tightly
scoped.
* addr appid.session_log_filter.src_ip = 0.0.0.0/32: source ip
address in CIDR format
* port appid.session_log_filter.src_port: source port { 1: }
- * string appid.thirdparty_appid_dir: directory to load thirdparty
- appid detectors from
* ip4 arp_spoof.hosts[].ip: host ip address
* mac arp_spoof.hosts[].mac: host mac address
* int asn1.absolute_offset: absolute offset from the beginning of
* enum reputation.white = unblack: specify the meaning of whitelist
{ unblack|trust }
* int rev.~: revision { 1: }
+ * bool rewrite.disable_replace = false: disable replace of packet
+ contents with rewrite rules
* int rpc.~app: application number
* int rpc.proc: procedure number or * for any
* int rpc.ver: version number or * for any
before being eligible for pruning { 1: }
* int stream_user.session_timeout = 30: session tracking timeout {
1:86400 }
+ * int stream_user.trace: mask for enabling debug traces in module
* int suppress[].gid = 0: rule generator ID { 0: }
* string suppress[].ip: restrict suppression to these addresses
according to track
--------------
- * appid.aim clients: count of aim clients discovered
- * appid.battlefield flows: count of battle field flows discovered
- * appid.bgp flows: count of bgp flows discovered
- * appid.bit clients: count of bittorrent clients discovered
- * appid.bit flows: count of bittorrent flows discovered
- * appid.bittracker clients: count of bittorrent tracker clients
+ * appid.aim_clients: count of aim clients discovered
+ * appid.battlefield_flows: count of battle field flows discovered
+ * appid.bgp_flows: count of bgp flows discovered
+ * appid.bit_clients: count of bittorrent clients discovered
+ * appid.bit_flows: count of bittorrent flows discovered
+ * appid.bittracker_clients: count of bittorrent tracker clients
discovered
- * appid.bootp flows: count of bootp flows discovered
- * appid.dcerpc tcp flows: count of dce rpc flows over tcp
+ * appid.bootp_flows: count of bootp flows discovered
+ * appid.dcerpc_tcp_flows: count of dce rpc flows over tcp
discovered
- * appid.dcerpc udp flows: count of dce rpc flows over udp
+ * appid.dcerpc_udp_flows: count of dce rpc flows over udp
discovered
- * appid.direct connect flows: count of direct connect flows
+ * appid.direct_connect_flows: count of direct connect flows
discovered
- * appid.dns tcp flows: count of dns flows over tcp discovered
- * appid.dns udp flows: count of dns flows over udp discovered
- * appid.ftp flows: count of ftp flows discovered
- * appid.ftps flows: count of ftps flows discovered
- * appid.http flows: count of http flows discovered
- * appid.ignored packets: count of packets ignored
- * appid.imap flows: count of imap service flows discovered
- * appid.imaps flows: count of imap TLS service flows discovered
- * appid.irc flows: count of irc service flows discovered
- * appid.kerberos clients: count of kerberos clients discovered
- * appid.kerberos flows: count of kerberos service flows discovered
- * appid.kerberos users: count of kerberos users discovered
- * appid.lpr flows: count of lpr service flows discovered
- * appid.mdns flows: count of mdns service flows discovered
- * appid.msn clients: count of msn clients discovered
- * appid.mysql flows: count of mysql service flows discovered
- * appid.netbios dgm flows: count of netbios-dgm service flows
+ * appid.dns_tcp_flows: count of dns flows over tcp discovered
+ * appid.dns_udp_flows: count of dns flows over udp discovered
+ * appid.ftp_flows: count of ftp flows discovered
+ * appid.ftps_flows: count of ftps flows discovered
+ * appid.http_flows: count of http flows discovered
+ * appid.ignored_packets: count of packets ignored
+ * appid.imap_flows: count of imap service flows discovered
+ * appid.imaps_flows: count of imap TLS service flows discovered
+ * appid.irc_flows: count of irc service flows discovered
+ * appid.kerberos_clients: count of kerberos clients discovered
+ * appid.kerberos_flows: count of kerberos service flows discovered
+ * appid.kerberos_users: count of kerberos users discovered
+ * appid.lpr_flows: count of lpr service flows discovered
+ * appid.mdns_flows: count of mdns service flows discovered
+ * appid.msn_clients: count of msn clients discovered
+ * appid.mysql_flows: count of mysql service flows discovered
+ * appid.netbios_dgm_flows: count of netbios-dgm service flows
discovered
- * appid.netbios ns flows: count of netbios-ns service flows
+ * appid.netbios_ns_flows: count of netbios-ns service flows
discovered
- * appid.netbios ssn flows: count of netbios-ssn service flows
+ * appid.netbios_ssn_flows: count of netbios-ssn service flows
discovered
- * appid.nntp flows: count of nntp flows discovered
- * appid.ntp flows: count of ntp flows discovered
+ * appid.nntp_flows: count of nntp flows discovered
+ * appid.ntp_flows: count of ntp flows discovered
* appid.packets: count of packets received
- * appid.pop flows: count of pop service flows discovered
- * appid.processed packets: count of packets processed
- * appid.radius flows: count of radius flows discovered
- * appid.rexec flows: count of rexec flows discovered
- * appid.rfb flows: count of rfb flows discovered
- * appid.rlogin flows: count of rlogin flows discovered
- * appid.rpc flows: count of rpc flows discovered
- * appid.rshell flows: count of rshell flows discovered
- * appid.rsync flows: count of rsync service flows discovered
- * appid.rtmp flows: count of rtmp flows discovered
- * appid.rtp clients: count of rtp clients discovered
- * appid.sip clients: count of SIP clients discovered
- * appid.sip flows: count of SIP flows discovered
- * appid.smtp aol clients: count of AOL smtp clients discovered
- * appid.smtp applemail clients: count of Apple Mail smtp clients
+ * appid.pop3_clients: count of pop3 clients discovered
+ * appid.pop3s_clients: count of pop3s clients discovered
+ * appid.pop_flows: count of pop service flows discovered
+ * appid.processed_packets: count of packets processed
+ * appid.radius_flows: count of radius flows discovered
+ * appid.rexec_flows: count of rexec flows discovered
+ * appid.rfb_flows: count of rfb flows discovered
+ * appid.rlogin_flows: count of rlogin flows discovered
+ * appid.rpc_flows: count of rpc flows discovered
+ * appid.rshell_flows: count of rshell flows discovered
+ * appid.rsync_flows: count of rsync service flows discovered
+ * appid.rtmp_flows: count of rtmp flows discovered
+ * appid.rtp_clients: count of rtp clients discovered
+ * appid.sip_clients: count of SIP clients discovered
+ * appid.sip_flows: count of SIP flows discovered
+ * appid.smtp_aol_clients: count of AOL smtp clients discovered
+ * appid.smtp_applemail_clients: count of Apple Mail smtp clients
discovered
- * appid.smtp eudora clients: count of Eudora smtp clients
+ * appid.smtp_eudora_clients: count of Eudora smtp clients
discovered
- * appid.smtp eudora pro clients: count of Eudora Pro smtp clients
+ * appid.smtp_eudora_pro_clients: count of Eudora Pro smtp clients
discovered
- * appid.smtp evolution clients: count of Evolution smtp clients
+ * appid.smtp_evolution_clients: count of Evolution smtp clients
discovered
- * appid.smtp flows: count of smtp flows discovered
- * appid.smtp kmail clients: count of KMail smtp clients discovered
- * appid.smtp lotus notes clients: count of Lotus Notes smtp clients
+ * appid.smtp_flows: count of smtp flows discovered
+ * appid.smtp_kmail_clients: count of KMail smtp clients discovered
+ * appid.smtp_lotus_notes_clients: count of Lotus Notes smtp clients
discovered
- * appid.smtp microsoft outlook clients: count of Microsoft Outlook
+ * appid.smtp_microsoft_outlook_clients: count of Microsoft Outlook
smtp clients discovered
- * appid.smtp microsoft outlook express clients: count of Microsoft
+ * appid.smtp_microsoft_outlook_express_clients: count_of Microsoft
Outlook Express smtp clients discovered
- * appid.smtp microsoft outlook imo clients: count of Microsoft
+ * appid.smtp_microsoft_outlook_imo_clients: count of Microsoft
Outlook IMO smtp clients discovered
- * appid.smtp mutt clients: count of Mutt smtp clients discovered
- * appid.smtps flows: count of smtps flows discovered
- * appid.smtp thunderbird clients: count of Thunderbird smtp clients
+ * appid.smtp_mutt_clients: count of Mutt smtp clients discovered
+ * appid.smtps_flows: count of smtps flows discovered
+ * appid.smtp_thunderbird_clients: count of Thunderbird smtp clients
discovered
- * appid.snmp flows: count of snmp flows discovered
- * appid.ssh clients: count of ssh clients discovered
- * appid.ssh flows: count of ssh flows discovered
- * appid.ssl flows: count of ssl flows discovered
- * appid.telnet flows: count of telnet flows discovered
- * appid.tftp flows: count of tftp flows discovered
- * appid.timbuktu flows: count of timbuktu flows discovered
- * appid.tns clients: count of tns clients discovered
- * appid.tns flows: count of tns flows discovered
- * appid.vnc clients: count of vnc clients discovered
- * appid.yahoo messenger clients: count of Yahoo Messenger clients
+ * appid.snmp_flows: count of snmp flows discovered
+ * appid.ssh_clients: count of ssh clients discovered
+ * appid.ssh_flows: count of ssh flows discovered
+ * appid.ssl_flows: count of ssl flows discovered
+ * appid.telnet_flows: count of telnet flows discovered
+ * appid.tftp_flows: count of tftp flows discovered
+ * appid.timbuktu_clients: count of timbuktu clients discovered
+ * appid.timbuktu_flows: count of timbuktu flows discovered
+ * appid.tns_clients: count of tns clients discovered
+ * appid.tns_flows: count of tns flows discovered
+ * appid.vnc_clients: count of vnc clients discovered
+ * appid.yahoo_messenger_clients: count of Yahoo Messenger clients
discovered
* arp_spoof.packets: total packets
* back_orifice.packets: total packets
* daq.idle: attempts to acquire from DAQ without available packets
* daq.ignore: total ignore verdicts
* daq.injected: active responses or replacements
- * daq.internal blacklist: packets blacklisted internally due to
+ * daq.internal_blacklist: packets blacklisted internally due to
lack of DAQ support
- * daq.internal whitelist: packets whitelisted internally due to
+ * daq.internal_whitelist: packets whitelisted internally due to
lack of DAQ support
* daq.outstanding: packets unprocessed
* daq.pcaps: total files and interfaces processed
* daq.replace: total replace verdicts
* daq.skipped: packets skipped at startup
* daq.whitelist: total whitelist verdicts
- * dce_smb.Alter context responses: total connection-oriented alter
+ * dce_http_proxy.http_proxy_session_failures: failed http proxy
+ sessions
+ * dce_http_proxy.http_proxy_sessions: successful http proxy
+ sessions
+ * dce_http_server.http_server_session_failures: failed http server
+ sessions
+ * dce_http_server.http_server_sessions: successful http server
+ sessions
+ * dce_smb.alter_context_responses: total connection-oriented alter
context responses
- * dce_smb.Alter contexts: total connection-oriented alter contexts
- * dce_smb.Auth3s: total connection-oriented auth3s
- * dce_smb.Bind acks: total connection-oriented binds acks
- * dce_smb.Bind naks: total connection-oriented bind naks
- * dce_smb.Binds: total connection-oriented binds
- * dce_smb.Cancels: total connection-oriented cancels
- * dce_smb.Client frags reassembled: total connection-oriented
+ * dce_smb.alter_contexts: total connection-oriented alter contexts
+ * dce_smb.auth3s: total connection-oriented auth3s
+ * dce_smb.bind_acks: total connection-oriented binds acks
+ * dce_smb.bind_naks: total connection-oriented bind naks
+ * dce_smb.binds: total connection-oriented binds
+ * dce_smb.cancels: total connection-oriented cancels
+ * dce_smb.client_frags_reassembled: total connection-oriented
client fragments reassembled
- * dce_smb.Client max fragment size: connection-oriented client
+ * dce_smb.client_max_fragment_size: connection-oriented client
maximum fragment size
- * dce_smb.Client min fragment size: connection-oriented client
+ * dce_smb.client_min_fragment_size: connection-oriented client
minimum fragment size
- * dce_smb.Client segs reassembled: total connection-oriented client
+ * dce_smb.client_segs_reassembled: total connection-oriented client
segments reassembled
- * dce_smb.Client segs reassembled: total smb client segments
+ * dce_smb.client_segs_reassembled: total smb client segments
reassembled
* dce_smb.events: total events
- * dce_smb.Faults: total connection-oriented faults
- * dce_smb.Files processed: total smb files processed
- * dce_smb.Ignored bytes: total ignored bytes
- * dce_smb.Max outstanding requests: total smb maximum outstanding
+ * dce_smb.faults: total connection-oriented faults
+ * dce_smb.files_processed: total smb files processed
+ * dce_smb.ignored_bytes: total ignored bytes
+ * dce_smb.max_outstanding_requests: total smb maximum outstanding
requests
- * dce_smb.MS RPC/HTTP PDUs: total connection-oriented MS requests
+ * dce_smb.ms_rpc_http_pdus: total connection-oriented MS requests
to send RPC over HTTP
- * dce_smb.Orphaned: total connection-oriented orphaned
- * dce_smb.Other requests: total connection-oriented other requests
- * dce_smb.Other responses: total connection-oriented other
+ * dce_smb.orphaned: total connection-oriented orphaned
+ * dce_smb.other_requests: total connection-oriented other requests
+ * dce_smb.other_responses: total connection-oriented other
responses
- * dce_smb.Packets: total smb packets
- * dce_smb.PDUs: total connection-oriented PDUs
- * dce_smb.Rejects: total connection-oriented rejects
- * dce_smb.Request fragments: total connection-oriented request
+ * dce_smb.packets: total smb packets
+ * dce_smb.pdus: total connection-oriented PDUs
+ * dce_smb.rejects: total connection-oriented rejects
+ * dce_smb.request_fragments: total connection-oriented request
fragments
- * dce_smb.Requests: total connection-oriented requests
- * dce_smb.Response fragments: total connection-oriented response
+ * dce_smb.requests: total connection-oriented requests
+ * dce_smb.response_fragments: total connection-oriented response
fragments
- * dce_smb.Responses: total connection-oriented responses
- * dce_smb.Server frags reassembled: total connection-oriented
+ * dce_smb.responses: total connection-oriented responses
+ * dce_smb.server_frags_reassembled: total connection-oriented
server fragments reassembled
- * dce_smb.Server max fragment size: connection-oriented server
+ * dce_smb.server_max_fragment_size: connection-oriented server
maximum fragment size
- * dce_smb.Server min fragment size: connection-oriented server
+ * dce_smb.server_min_fragment_size: connection-oriented server
minimum fragment size
- * dce_smb.Server segs reassembled: total connection-oriented server
+ * dce_smb.server_segs_reassembled: total connection-oriented server
segments reassembled
- * dce_smb.Server segs reassembled: total smb server segments
+ * dce_smb.server_segs_reassembled: total smb server segments
reassembled
- * dce_smb.Sessions: total smb sessions
- * dce_smb.Shutdowns: total connection-oriented shutdowns
- * dce_smb.SMBv2 close: total number of SMBv2 close packets seen
- * dce_smb.SMBv2 create: total number of SMBv2 create packets seen
- * dce_smb.SMBv2 read: total number of SMBv2 read packets seen
- * dce_smb.SMBv2 set info: total number of SMBv2 set info packets
+ * dce_smb.sessions: total smb sessions
+ * dce_smb.shutdowns: total connection-oriented shutdowns
+ * dce_smb.smbv2_close: total number of SMBv2 close packets seen
+ * dce_smb.smbv2_create: total number of SMBv2 create packets seen
+ * dce_smb.smbv2_read: total number of SMBv2 read packets seen
+ * dce_smb.smbv2_set_info: total number of SMBv2 set info packets
seen
- * dce_smb.SMBv2 tree connect: total number of SMBv2 tree connect
+ * dce_smb.smbv2_tree_connect: total number of SMBv2 tree connect
packets seen
- * dce_smb.SMBv2 tree disconnect: total number of SMBv2 tree
+ * dce_smb.smbv2_tree_disconnect: total number of SMBv2 tree
disconnect packets seen
- * dce_smb.SMBv2 write: total number of SMBv2 write packets seen
- * dce_tcp.Alter context responses: total connection-oriented alter
+ * dce_smb.smbv2_write: total number of SMBv2 write packets seen
+ * dce_tcp.alter_context_responses: total connection-oriented alter
context responses
- * dce_tcp.Alter contexts: total connection-oriented alter contexts
- * dce_tcp.Auth3s: total connection-oriented auth3s
- * dce_tcp.Bind acks: total connection-oriented binds acks
- * dce_tcp.Bind naks: total connection-oriented bind naks
- * dce_tcp.Binds: total connection-oriented binds
- * dce_tcp.Cancels: total connection-oriented cancels
- * dce_tcp.Client frags reassembled: total connection-oriented
+ * dce_tcp.alter_contexts: total connection-oriented alter contexts
+ * dce_tcp.auth3s: total connection-oriented auth3s
+ * dce_tcp.bind_acks: total connection-oriented binds acks
+ * dce_tcp.bind_naks: total connection-oriented bind naks
+ * dce_tcp.binds: total connection-oriented binds
+ * dce_tcp.cancels: total connection-oriented cancels
+ * dce_tcp.client_frags_reassembled: total connection-oriented
client fragments reassembled
- * dce_tcp.Client max fragment size: connection-oriented client
+ * dce_tcp.client_max_fragment_size: connection-oriented client
maximum fragment size
- * dce_tcp.Client min fragment size: connection-oriented client
+ * dce_tcp.client_min_fragment_size: connection-oriented client
minimum fragment size
- * dce_tcp.Client segs reassembled: total connection-oriented client
+ * dce_tcp.client_segs_reassembled: total connection-oriented client
segments reassembled
* dce_tcp.events: total events
- * dce_tcp.Faults: total connection-oriented faults
- * dce_tcp.MS RPC/HTTP PDUs: total connection-oriented MS requests
+ * dce_tcp.faults: total connection-oriented faults
+ * dce_tcp.ms_rpc_http_pdus: total connection-oriented MS requests
to send RPC over HTTP
- * dce_tcp.Orphaned: total connection-oriented orphaned
- * dce_tcp.Other requests: total connection-oriented other requests
- * dce_tcp.Other responses: total connection-oriented other
+ * dce_tcp.orphaned: total connection-oriented orphaned
+ * dce_tcp.other_requests: total connection-oriented other requests
+ * dce_tcp.other_responses: total connection-oriented other
responses
- * dce_tcp.PDUs: total connection-oriented PDUs
- * dce_tcp.Rejects: total connection-oriented rejects
- * dce_tcp.Request fragments: total connection-oriented request
+ * dce_tcp.pdus: total connection-oriented PDUs
+ * dce_tcp.rejects: total connection-oriented rejects
+ * dce_tcp.request_fragments: total connection-oriented request
fragments
- * dce_tcp.Requests: total connection-oriented requests
- * dce_tcp.Response fragments: total connection-oriented response
+ * dce_tcp.requests: total connection-oriented requests
+ * dce_tcp.response_fragments: total connection-oriented response
fragments
- * dce_tcp.Responses: total connection-oriented responses
- * dce_tcp.Server frags reassembled: total connection-oriented
+ * dce_tcp.responses: total connection-oriented responses
+ * dce_tcp.server_frags_reassembled: total connection-oriented
server fragments reassembled
- * dce_tcp.Server max fragment size: connection-oriented server
+ * dce_tcp.server_max_fragment_size: connection-oriented server
maximum fragment size
- * dce_tcp.Server min fragment size: connection-oriented server
+ * dce_tcp.server_min_fragment_size: connection-oriented server
minimum fragment size
- * dce_tcp.Server segs reassembled: total connection-oriented server
+ * dce_tcp.server_segs_reassembled: total connection-oriented server
segments reassembled
- * dce_tcp.Shutdowns: total connection-oriented shutdowns
- * dce_tcp.tcp packets: total tcp packets
- * dce_tcp.tcp sessions: total tcp sessions
- * dce_udp.Acks: total connection-less acks
- * dce_udp.Cancel acks: total connection-less cancel acks
- * dce_udp.Cancels: total connection-less cancels
- * dce_udp.Client facks: total connection-less client facks
+ * dce_tcp.shutdowns: total connection-oriented shutdowns
+ * dce_tcp.tcp_packets: total tcp packets
+ * dce_tcp.tcp_sessions: total tcp sessions
+ * dce_udp.acks: total connection-less acks
+ * dce_udp.cancel_acks: total connection-less cancel acks
+ * dce_udp.cancels: total connection-less cancels
+ * dce_udp.client_facks: total connection-less client facks
* dce_udp.events: total events
- * dce_udp.Faults: total connection-less faults
- * dce_udp.Fragments: total connection-less fragments
- * dce_udp.Frags reassembled: total connection-less fragments
+ * dce_udp.faults: total connection-less faults
+ * dce_udp.fragments: total connection-less fragments
+ * dce_udp.frags_reassembled: total connection-less fragments
reassembled
- * dce_udp.Max fragment size: connection-less maximum fragment size
- * dce_udp.Max seqnum: max connection-less seqnum
- * dce_udp.No calls: total connection-less no calls
- * dce_udp.Other requests: total connection-less other requests
- * dce_udp.Other responses: total connection-less other responses
- * dce_udp.Ping: total connection-less ping
- * dce_udp.Rejects: total connection-less rejects
- * dce_udp.Requests: total connection-less requests
- * dce_udp.Responses: total connection-less responses
- * dce_udp.Server facks: total connection-less server facks
- * dce_udp.udp packets: total udp packets
- * dce_udp.udp sessions: total udp sessions
- * dce_udp.Working: total connection-less working
- * detection.alert limit: events previously triggered on same PDU
+ * dce_udp.max_fragment_size: connection-less maximum fragment size
+ * dce_udp.max_seqnum: max connection-less seqnum
+ * dce_udp.no_calls: total connection-less no calls
+ * dce_udp.other_requests: total connection-less other requests
+ * dce_udp.other_responses: total connection-less other responses
+ * dce_udp.ping: total connection-less ping
+ * dce_udp.rejects: total connection-less rejects
+ * dce_udp.requests: total connection-less requests
+ * dce_udp.responses: total connection-less responses
+ * dce_udp.server_facks: total connection-less server facks
+ * dce_udp.udp_packets: total udp packets
+ * dce_udp.udp_sessions: total udp sessions
+ * dce_udp.working: total connection-less working
+ * detection.alert_limit: events previously triggered on same PDU
* detection.alerts: alerts not including IP reputation
- * detection.alt searches: alt fast pattern searches in packet data
+ * detection.alt_searches: alt fast pattern searches in packet data
* detection.analyzed: packets sent to detection
- * detection.body searches: fast pattern searches in body buffer
- * detection.cooked searches: fast pattern searches in cooked packet
+ * detection.body_searches: fast pattern searches in body buffer
+ * detection.cooked_searches: fast pattern searches in cooked packet
data
- * detection.event limit: events filtered
- * detection.file searches: fast pattern searches in file buffer
- * detection.hard evals: non-fast pattern rule evaluations
- * detection.header searches: fast pattern searches in header buffer
- * detection.key searches: fast pattern searches in key buffer
+ * detection.event_limit: events filtered
+ * detection.file_searches: fast pattern searches in file buffer
+ * detection.hard_evals: non-fast pattern rule evaluations
+ * detection.header_searches: fast pattern searches in header buffer
+ * detection.key_searches: fast pattern searches in key buffer
* detection.logged: logged packets
- * detection.log limit: events queued but not logged
- * detection.match limit: fast pattern matches not processed
+ * detection.log_limit: events queued but not logged
+ * detection.match_limit: fast pattern matches not processed
* detection.passed: passed packets
- * detection.pkt searches: fast pattern searches in packet data
- * detection.queue limit: events not queued because queue full
- * detection.raw searches: fast pattern searches in raw packet data
- * detection.total alerts: alerts including IP reputation
- * dnp3.dnp3 application pdus: total dnp3 application pdus
- * dnp3.dnp3 link layer frames: total dnp3 link layer frames
- * dnp3.tcp pdus: total tcp pdus
- * dnp3.total packets: total packets
- * dnp3.udp packets: total udp packets
+ * detection.pkt_searches: fast pattern searches in packet data
+ * detection.queue_limit: events not queued because queue full
+ * detection.raw_searches: fast pattern searches in raw packet data
+ * detection.total_alerts: alerts including IP reputation
+ * dnp3.dnp3_application_pdus: total dnp3 application pdus
+ * dnp3.dnp3_link_layer_frames: total dnp3 link layer frames
+ * dnp3.tcp_pdus: total tcp pdus
+ * dnp3.total_packets: total packets
+ * dnp3.udp_packets: total udp packets
* dns.packets: total packets processed
* dns.requests: total dns requests
* dns.responses: total dns responses
* file_connector.messages: total messages
- * file_id.cache failures: number of file cache add failures
- * file_id.total file data: number of file data bytes processed
- * file_id.total files: number of files processed
- * file_log.total events: total file events
+ * file_id.cache_failures: number of file cache add failures
+ * file_id.total_file_data: number of file data bytes processed
+ * file_id.total_files: number of files processed
+ * file_log.total_events: total file events
* ftp_data.packets: total packets
* ftp_server.packets: total packets
* gtp_inspect.events: requests
* gtp_inspect.sessions: total sessions processed
- * gtp_inspect.unknown infos: unknown information elements
- * gtp_inspect.unknown types: unknown message types
- * host_cache.lru cache adds: lru cache added new entry
- * host_cache.lru cache clears: lru cache clear API calls
- * host_cache.lru cache find hits: lru cache found entry in cache
- * host_cache.lru cache find misses: lru cache did not find entry in
+ * gtp_inspect.unknown_infos: unknown information elements
+ * gtp_inspect.unknown_types: unknown message types
+ * host_cache.lru_cache_adds: lru cache added new entry
+ * host_cache.lru_cache_clears: lru cache clear API calls
+ * host_cache.lru_cache_find_hits: lru cache found entry in cache
+ * host_cache.lru_cache_find_misses: lru cache did not find entry in
cache
- * host_cache.lru cache prunes: lru cache pruned entry to make space
+ * host_cache.lru_cache_prunes: lru cache pruned entry to make space
for new entry
- * host_cache.lru cache removes: lru cache found entry and removed
+ * host_cache.lru_cache_removes: lru cache found entry and removed
it
- * host_cache.lru cache replaces: lru cache replaced existing entry
- * host_tracker.service adds: host service adds
- * host_tracker.service finds: host service finds
- * host_tracker.service removes: host service removes
+ * host_cache.lru_cache_replaces: lru cache replaced existing entry
+ * host_tracker.service_adds: host service adds
+ * host_tracker.service_finds: host service finds
+ * host_tracker.service_removes: host service removes
* http_inspect.chunked: chunked message bodies
- * http_inspect.CONNECT requests: CONNECT requests inspected
- * http_inspect.DELETE requests: DELETE requests inspected
+ * http_inspect.connect_requests: CONNECT requests inspected
+ * http_inspect.delete_requests: DELETE requests inspected
* http_inspect.flows: HTTP connections inspected
- * http_inspect.GET requests: GET requests inspected
- * http_inspect.HEAD requests: HEAD requests inspected
+ * http_inspect.get_requests: GET requests inspected
+ * http_inspect.head_requests: HEAD requests inspected
* http_inspect.inspections: total message sections inspected
- * http_inspect.OPTIONS requests: OPTIONS requests inspected
- * http_inspect.other requests: other request methods inspected
- * http_inspect.POST requests: POST requests inspected
- * http_inspect.PUT requests: PUT requests inspected
+ * http_inspect.options_requests: OPTIONS requests inspected
+ * http_inspect.other_requests: other request methods inspected
+ * http_inspect.post_requests: POST requests inspected
+ * http_inspect.put_requests: PUT requests inspected
* http_inspect.reassembles: TCP segments combined into HTTP
messages
- * http_inspect.request bodies: POST, PUT, and other requests with
+ * http_inspect.request_bodies: POST, PUT, and other requests with
message bodies
* http_inspect.requests: HTTP request messages inspected
* http_inspect.responses: HTTP response messages inspected
* http_inspect.scans: TCP segments scanned looking for HTTP
messages
- * http_inspect.TRACE requests: TRACE requests inspected
- * http_inspect.URI coding: URIs with character coding problems
- * http_inspect.URI normalizations: URIs needing to be normalization
- * http_inspect.URI path: URIs with path problems
- * icmp4.bad checksum: non-zero icmp checksums
- * icmp6.bad checksum (ip4): nonzero ipcm4 checksums
- * icmp6.bad checksum (ip6): nonzero ipcm6 checksums
- * imap.b64 attachments: total base64 attachments decoded
- * imap.b64 decoded bytes: total base64 decoded bytes
- * imap.non-encoded attachments: total non-encoded attachments
+ * http_inspect.trace_requests: TRACE requests inspected
+ * http_inspect.uri_coding: URIs with character coding problems
+ * http_inspect.uri_normalizations: URIs needing to be normalization
+ * http_inspect.uri_path: URIs with path problems
+ * icmp4.bad_checksum: non-zero icmp checksums
+ * icmp6.bad_icmp4_checksum: nonzero ipcm4 checksums
+ * icmp6.bad_icmp6_checksum: nonzero ipcm6 checksums
+ * imap.b64_attachments: total base64 attachments decoded
+ * imap.b64_decoded_bytes: total base64 decoded bytes
+ * imap.non_encoded_attachments: total non-encoded attachments
extracted
- * imap.non-encoded bytes: total non-encoded extracted bytes
+ * imap.non_encoded_bytes: total non-encoded extracted bytes
* imap.packets: total packets processed
- * imap.qp attachments: total quoted-printable attachments decoded
- * imap.qp decoded bytes: total quoted-printable decoded bytes
+ * imap.qp_attachments: total quoted-printable attachments decoded
+ * imap.qp_decoded_bytes: total quoted-printable decoded bytes
* imap.sessions: total imap sessions
- * imap.uu attachments: total uu attachments decoded
- * imap.uu decoded bytes: total uu decoded bytes
- * ipv4.bad checksum: nonzero ip checksums
- * latency.max usecs: maximum usecs elapsed
- * latency.packet timeouts: packets that timed out
- * latency.rule eval timeouts: rule evals that timed out
- * latency.rule tree enables: rule tree re-enables
- * latency.total packets: total packets monitored
- * latency.total rule evals: total rule evals monitored
- * latency.total usecs: total usecs elapsed
+ * imap.uu_attachments: total uu attachments decoded
+ * imap.uu_decoded_bytes: total uu decoded bytes
+ * ipv4.bad_checksum: nonzero ip checksums
+ * latency.max_usecs: maximum usecs elapsed
+ * latency.packet_timeouts: packets that timed out
+ * latency.rule_eval_timeouts: rule evals that timed out
+ * latency.rule_tree_enables: rule tree re-enables
+ * latency.total_packets: total packets monitored
+ * latency.total_rule_evals: total rule evals monitored
+ * latency.total_usecs: total usecs elapsed
* modbus.frames: total Modbus messages
* modbus.sessions: total sessions processed
- * mpls.total bytes: total mpls labeled bytes processed
- * mpls.total packets: total mpls labeled packets processed
- * normalizer.icmp4 echo: icmp4 ping normalizations
- * normalizer.icmp6 echo: icmp6 echo normalizations
- * normalizer.ip4 df: don’t frag bit normalizations
- * normalizer.ip4 opts: ip4 options cleared
- * normalizer.ip4 rf: reserved flag bit clears
- * normalizer.ip4 tos: type of service normalizations
- * normalizer.ip4 trim: eth packets trimmed to datagram size
- * normalizer.ip4 ttl: time-to-live normalizations
- * normalizer.ip6 hops: ip6 hop limit normalizations
- * normalizer.ip6 options: ip6 options cleared
- * normalizer.tcp block: blocked segments
- * normalizer.tcp ecn pkt: packets with ECN bits cleared
- * normalizer.tcp ecn session: ECN bits cleared
- * normalizer.tcp ips data: normalized segments
- * normalizer.tcp nonce: packets with nonce bit cleared
- * normalizer.tcp options: packets with options cleared
- * normalizer.tcp paddding: packets with padding cleared
- * normalizer.tcp req pay: cleared urgent pointer and urgent flag
+ * mpls.total_bytes: total mpls labeled bytes processed
+ * mpls.total_packets: total mpls labeled packets processed
+ * normalizer.icmp4_echo: icmp4 ping normalizations
+ * normalizer.icmp6_echo: icmp6 echo normalizations
+ * normalizer.ip4_df: don’t frag bit normalizations
+ * normalizer.ip4_opts: ip4 options cleared
+ * normalizer.ip4_rf: reserved flag bit clears
+ * normalizer.ip4_tos: type of service normalizations
+ * normalizer.ip4_trim: eth packets trimmed to datagram size
+ * normalizer.ip4_ttl: time-to-live normalizations
+ * normalizer.ip6_hops: ip6 hop limit normalizations
+ * normalizer.ip6_options: ip6 options cleared
+ * normalizer.tcp_block: blocked segments
+ * normalizer.tcp_ecn_pkt: packets with ECN bits cleared
+ * normalizer.tcp_ecn_session: ECN bits cleared
+ * normalizer.tcp_ips_data: normalized segments
+ * normalizer.tcp_nonce: packets with nonce bit cleared
+ * normalizer.tcp_options: packets with options cleared
+ * normalizer.tcp_paddding: packets with padding cleared
+ * normalizer.tcp_req_pay: cleared urgent pointer and urgent flag
when there is no payload
- * normalizer.tcp req urg: cleared urgent pointer when urgent flag
+ * normalizer.tcp_req_urg: cleared urgent pointer when urgent flag
is not set
- * normalizer.tcp req urp: cleared the urgent flag if the urgent
+ * normalizer.tcp_req_urp: cleared the urgent flag if the urgent
pointer is not set
- * normalizer.tcp reserved: packets with reserved bits cleared
- * normalizer.tcp syn options: SYN only options cleared from non-SYN
+ * normalizer.tcp_reserved: packets with reserved bits cleared
+ * normalizer.tcp_syn_options: SYN only options cleared from non-SYN
packets
- * normalizer.tcp trim mss: data trimmed to MSS
- * normalizer.tcp trim rst: RST packets with data trimmed
- * normalizer.tcp trim syn: tcp segments trimmed on SYN
- * normalizer.tcp trim win: data trimed to window
- * normalizer.tcp ts ecr: timestamp cleared on non-ACKs
- * normalizer.tcp ts nop: timestamp options cleared
- * normalizer.tcp urgent ptr: packets without data with urgent
+ * normalizer.tcp_trim_mss: data trimmed to MSS
+ * normalizer.tcp_trim_rst: RST packets with data trimmed
+ * normalizer.tcp_trim_syn: tcp segments trimmed on SYN
+ * normalizer.tcp_trim_win: data trimed to window
+ * normalizer.tcp_ts_ecr: timestamp cleared on non-ACKs
+ * normalizer.tcp_ts_nop: timestamp options cleared
+ * normalizer.tcp_urgent_ptr: packets without data with urgent
pointer cleared
- * normalizer.test icmp4 echo: test icmp4 ping normalizations
- * normalizer.test icmp6 echo: test icmp6 echo normalizations
- * normalizer.test ip4 df: test don’t frag bit normalizations
- * normalizer.test ip4 opts: test ip4 options cleared
- * normalizer.test ip4 rf: test reserved flag bit clears
- * normalizer.test ip4 tos: test type of service normalizations
- * normalizer.test ip4 trim: test eth packets trimmed to datagram
+ * normalizer.test_icmp4_echo: test icmp4 ping normalizations
+ * normalizer.test_icmp6_echo: test icmp6 echo normalizations
+ * normalizer.test_ip4_df: test don’t frag bit normalizations
+ * normalizer.test_ip4_opts: test ip4 options cleared
+ * normalizer.test_ip4_rf: test reserved flag bit clears
+ * normalizer.test_ip4_tos: test type of service normalizations
+ * normalizer.test_ip4_trim: test eth packets trimmed to datagram
size
- * normalizer.test ip4 ttl: test time-to-live normalizations
- * normalizer.test ip6 hops: test ip6 hop limit normalizations
- * normalizer.test ip6 options: test ip6 options cleared
- * normalizer.test tcp block: test blocked segments
- * normalizer.test tcp ecn pkt: test packets with ECN bits cleared
- * normalizer.test tcp ecn session: test ECN bits cleared
- * normalizer.test tcp ips data: test normalized segments
- * normalizer.test tcp nonce: test packets with nonce bit cleared
- * normalizer.test tcp options: test packets with options cleared
- * normalizer.test tcp paddding: test packets with padding cleared
- * normalizer.test tcp req pay: test cleared urgent pointer and
+ * normalizer.test_ip4_ttl: test time-to-live normalizations
+ * normalizer.test_ip6_hops: test ip6 hop limit normalizations
+ * normalizer.test_ip6_options: test ip6 options cleared
+ * normalizer.test_tcp_block: test blocked segments
+ * normalizer.test_tcp_ecn_pkt: test packets with ECN bits cleared
+ * normalizer.test_tcp_ecn_session: test ECN bits cleared
+ * normalizer.test_tcp_ips_data: test normalized segments
+ * normalizer.test_tcp_nonce: test packets with nonce bit cleared
+ * normalizer.test_tcp_options: test packets with options cleared
+ * normalizer.test_tcp_paddding: test packets with padding cleared
+ * normalizer.test_tcp_req_pay: test cleared urgent pointer and
urgent flag when there is no payload
- * normalizer.test tcp req urg: test cleared urgent pointer when
+ * normalizer.test_tcp_req_urg: test cleared urgent pointer when
urgent flag is not set
- * normalizer.test tcp req urp: test cleared the urgent flag if the
+ * normalizer.test_tcp_req_urp: test cleared the urgent flag if the
urgent pointer is not set
- * normalizer.test tcp reserved: test packets with reserved bits
+ * normalizer.test_tcp_reserved: test packets with reserved bits
cleared
- * normalizer.test tcp syn options: test SYN only options cleared
+ * normalizer.test_tcp_syn_options: test SYN only options cleared
from non-SYN packets
- * normalizer.test tcp trim mss: test data trimmed to MSS
- * normalizer.test tcp trim rst: test RST packets with data trimmed
- * normalizer.test tcp trim syn: test tcp segments trimmed on SYN
- * normalizer.test tcp trim win: test data trimed to window
- * normalizer.test tcp ts ecr: test timestamp cleared on non-ACKs
- * normalizer.test tcp ts nop: test timestamp options cleared
- * normalizer.test tcp urgent ptr: test packets without data with
+ * normalizer.test_tcp_trim_mss: test data trimmed to MSS
+ * normalizer.test_tcp_trim_rst: test RST packets with data trimmed
+ * normalizer.test_tcp_trim_syn: test tcp segments trimmed on SYN
+ * normalizer.test_tcp_trim_win: test data trimed to window
+ * normalizer.test_tcp_ts_ecr: test timestamp cleared on non-ACKs
+ * normalizer.test_tcp_ts_nop: test timestamp options cleared
+ * normalizer.test_tcp_urgent_ptr: test packets without data with
urgent pointer cleared
* packet_capture.captured: packets matching dumped after matching
filter
* packet_capture.processed: packets processed against filter
* perf_monitor.packets: total packets
- * pop.b64 attachments: total base64 attachments decoded
- * pop.b64 decoded bytes: total base64 decoded bytes
- * pop.non-encoded attachments: total non-encoded attachments
+ * pop.b64_attachments: total base64 attachments decoded
+ * pop.b64_decoded_bytes: total base64 decoded bytes
+ * pop.non_encoded_attachments: total non-encoded attachments
extracted
- * pop.non-encoded bytes: total non-encoded extracted bytes
+ * pop.non_encoded_bytes: total non-encoded extracted bytes
* pop.packets: total packets processed
- * pop.qp attachments: total quoted-printable attachments decoded
- * pop.qp decoded bytes: total quoted-printable decoded bytes
+ * pop.qp_attachments: total quoted-printable attachments decoded
+ * pop.qp_decoded_bytes: total quoted-printable decoded bytes
* pop.sessions: total pop sessions
- * pop.uu attachments: total uu attachments decoded
- * pop.uu decoded bytes: total uu decoded bytes
+ * pop.uu_attachments: total uu attachments decoded
+ * pop.uu_decoded_bytes: total uu decoded bytes
* port_scan_global.packets: total packets
* reputation.blacklisted: number of packets blacklisted
- * reputation.memory allocated: total memory allocated
+ * reputation.memory_allocated: total memory allocated
* reputation.monitored: number of packets monitored
* reputation.packets: total packets processed
* reputation.whitelisted: number of packets whitelisted
* rpc_decode.packets: total packets
- * sd_pattern.below threshold: sd_pattern matched but missed
+ * sd_pattern.below_threshold: sd_pattern matched but missed
threshold
- * sd_pattern.pattern not found: sd_pattern did not not match
+ * sd_pattern.pattern_not_found: sd_pattern did not not match
* sd_pattern.terminated: hyperscan terminated
- * search_engine.max queued: maximum fast pattern matches queued for
+ * search_engine.max_queued: maximum fast pattern matches queued for
further evaluation
- * search_engine.non-qualified events: total non-qualified events
- * search_engine.qualified events: total qualified events
- * search_engine.total flushed: fast pattern matches discarded due
+ * search_engine.non_qualified_events: total non-qualified events
+ * search_engine.qualified_events: total qualified events
+ * search_engine.total_flushed: fast pattern matches discarded due
to overflow
- * search_engine.total inserts: total fast pattern hits
- * search_engine.total unique: total unique fast pattern hits
+ * search_engine.total_inserts: total fast pattern hits
+ * search_engine.total_unique: total unique fast pattern hits
* sip.1xx: 1xx
* sip.2xx: 2xx
* sip.3xx: 3xx
* sip.cancel: cancel
* sip.dialogs: total dialogs
* sip.events: events generated
- * sip.ignored channels: total channels ignored
- * sip.ignored sessions: total sessions ignored
+ * sip.ignored_channels: total channels ignored
+ * sip.ignored_sessions: total sessions ignored
* sip.info: info
* sip.invite: invite
* sip.join: join
* sip.register: register
* sip.sessions: total sessions
* sip.subscribe: subscribe
- * sip.total requests: total requests
- * sip.total responses: total responses
+ * sip.total_requests: total requests
+ * sip.total_responses: total responses
* sip.update: update
- * smtp.b64 attachments: total base64 attachments decoded
- * smtp.b64 decoded bytes: total base64 decoded bytes
- * smtp.concurrent sessions: total concurrent smtp sessions
- * smtp.max concurrent sessions: maximum concurrent smtp sessions
- * smtp.non-encoded attachments: total non-encoded attachments
+ * smtp.b64_attachments: total base64 attachments decoded
+ * smtp.b64_decoded_bytes: total base64 decoded bytes
+ * smtp.concurrent_sessions: total concurrent smtp sessions
+ * smtp.max_concurrent_sessions: maximum concurrent smtp sessions
+ * smtp.non_encoded_attachments: total non-encoded attachments
extracted
- * smtp.non-encoded bytes: total non-encoded extracted bytes
+ * smtp.non_encoded_bytes: total non-encoded extracted bytes
* smtp.packets: total packets processed
- * smtp.qp attachments: total quoted-printable attachments decoded
- * smtp.qp decoded bytes: total quoted-printable decoded bytes
+ * smtp.qp_attachments: total quoted-printable attachments decoded
+ * smtp.qp_decoded_bytes: total quoted-printable decoded bytes
* smtp.sessions: total smtp sessions
- * smtp.uu attachments: total uu attachments decoded
- * smtp.uu decoded bytes: total uu decoded bytes
- * snort.attribute table hosts: total number of hosts in table
- * snort.attribute table reloads: number of times hosts table was
+ * smtp.uu_attachments: total uu attachments decoded
+ * smtp.uu_decoded_bytes: total uu decoded bytes
+ * snort.attribute_table_hosts: total number of hosts in table
+ * snort.attribute_table_reloads: number of times hosts table was
reloaded
- * snort.conf reloads: number of times configuration was reloaded
- * snort.local commands: total local commands processed
- * snort.remote commands: total remote commands processed
+ * snort.conf_reloads: number of times configuration was reloaded
+ * snort.local_commands: total local commands processed
+ * snort.remote_commands: total remote commands processed
* snort.signals: total signals processed
* ssh.packets: total packets
* ssl.alert: total ssl alert records
- * ssl.bad handshakes: total bad handshakes
+ * ssl.bad_handshakes: total bad handshakes
* ssl.certificate: total ssl certificates
- * ssl.change cipher: total change cipher records
- * ssl.client application: total client application records
- * ssl.client hello: total client hellos
- * ssl.client key exchange: total client key exchanges
+ * ssl.change_cipher: total change cipher records
+ * ssl.client_application: total client application records
+ * ssl.client_hello: total client hellos
+ * ssl.client_key_exchange: total client key exchanges
* ssl.decoded: ssl packets decoded
- * ssl.detection disabled: total detection disabled
+ * ssl.detection_disabled: total detection disabled
* ssl.finished: total handshakes finished
- * ssl.handshakes completed: total completed ssl handshakes
+ * ssl.handshakes_completed: total completed ssl handshakes
* ssl.packets: total packets processed
- * ssl.server application: total server application records
- * ssl.server done: total server done
- * ssl.server hello: total server hellos
- * ssl.server key exchange: total server key exchanges
- * ssl.sessions ignored: total sessions ignore
- * ssl.unrecognized records: total unrecognized records
- * stream.file excess prunes: file sessions pruned due to excess
- * stream.file flows: total file sessions
- * stream.file ha prunes: file sessions pruned by high availability
+ * ssl.server_application: total server application records
+ * ssl.server_done: total server done
+ * ssl.server_hello: total server hellos
+ * ssl.server_key_exchange: total server key exchanges
+ * ssl.sessions_ignored: total sessions ignore
+ * ssl.unrecognized_records: total unrecognized records
+ * stream.file_excess_prunes: file sessions pruned due to excess
+ * stream.file_flows: total file sessions
+ * stream.file_ha_prunes: file sessions pruned by high availability
sync
- * stream.file idle prunes: file sessions pruned due to timeout
- * stream.file memcap prunes: file sessions pruned due to memcap
- * stream.file preemptive prunes: file sessions pruned during
+ * stream.file_idle_prunes: file sessions pruned due to timeout
+ * stream.file_memcap_prunes: file sessions pruned due to memcap
+ * stream.file_preemptive_prunes: file sessions pruned during
preemptive pruning
- * stream.file total prunes: total file sessions pruned
- * stream.file uni prunes: file uni sessions pruned
- * stream_icmp.created: icmp session trackers created
- * stream.icmp excess prunes: icmp sessions pruned due to excess
- * stream.icmp flows: total icmp sessions
- * stream.icmp ha prunes: icmp sessions pruned by high availability
+ * stream.file_total_prunes: total file sessions pruned
+ * stream.file_uni_prunes: file uni sessions pruned
+ * stream_icmp.created: icmp_ session trackers created
+ * stream.icmp_excess_prunes: icmp sessions pruned due to excess
+ * stream.icmp_flows: total icmp sessions
+ * stream.icmp_ha_prunes: icmp sessions pruned by high availability
sync
- * stream.icmp idle prunes: icmp sessions pruned due to timeout
- * stream_icmp.max: max icmp sessions
- * stream.icmp memcap prunes: icmp sessions pruned due to memcap
- * stream.icmp preemptive prunes: icmp sessions pruned during
+ * stream.icmp_idle_prunes: icmp sessions pruned due to timeout
+ * stream_icmp.max: max icmp_ sessions
+ * stream.icmp_memcap_prunes: icmp sessions pruned due to memcap
+ * stream.icmp_preemptive_prunes: icmp sessions pruned during
preemptive pruning
- * stream_icmp.prunes: icmp session prunes
- * stream_icmp.released: icmp session trackers released
- * stream_icmp.sessions: total icmp sessions
- * stream_icmp.timeouts: icmp session timeouts
- * stream.icmp total prunes: total icmp sessions pruned
- * stream.icmp uni prunes: icmp uni sessions pruned
+ * stream_icmp.prunes: icmp_ session prunes
+ * stream_icmp.released: icmp_ session trackers released
+ * stream_icmp.sessions: total icmp_ sessions
+ * stream_icmp.timeouts: icmp_ session timeouts
+ * stream.icmp_total_prunes: total icmp sessions pruned
+ * stream.icmp_uni_prunes: icmp uni sessions pruned
* stream_ip.alerts: alerts generated
* stream_ip.anomalies: anomalies detected
- * stream_ip.created: ip session trackers created
- * stream_ip.current frags: current fragments
+ * stream_ip.created: ip_ session trackers created
+ * stream_ip.current_frags: current fragments
* stream_ip.discards: fragments discarded
* stream_ip.drops: fragments dropped
- * stream.ip excess prunes: ip sessions pruned due to excess
- * stream.ip flows: total ip sessions
- * stream_ip.fragmented bytes: total fragmented bytes
- * stream_ip.frag timeouts: datagrams abandoned
- * stream.ip ha prunes: ip sessions pruned by high availability sync
- * stream.ip idle prunes: ip sessions pruned due to timeout
- * stream_ip.max frags: max fragments
- * stream_ip.max: max ip sessions
- * stream.ip memcap prunes: ip sessions pruned due to memcap
- * stream_ip.memory used: current memory usage in bytes
- * stream_ip.nodes deleted: fragments deleted from tracker
- * stream_ip.nodes inserted: fragments added to tracker
+ * stream.ip_excess_prunes: ip sessions pruned due to excess
+ * stream.ip_flows: total ip sessions
+ * stream_ip.fragmented_bytes: total fragmented bytes
+ * stream_ip.frag_timeouts: datagrams abandoned
+ * stream.ip_ha_prunes: ip sessions pruned by high availability sync
+ * stream.ip_idle_prunes: ip sessions pruned due to timeout
+ * stream_ip.max_frags: max fragments
+ * stream_ip.max: max ip_ sessions
+ * stream.ip_memcap_prunes: ip sessions pruned due to memcap
+ * stream_ip.memory_used: current memory usage in bytes
+ * stream_ip.nodes_deleted: fragments deleted from tracker
+ * stream_ip.nodes_inserted: fragments added to tracker
* stream_ip.overlaps: overlapping fragments
- * stream.ip preemptive prunes: ip sessions pruned during preemptive
+ * stream.ip_preemptive_prunes: ip sessions pruned during preemptive
pruning
- * stream_ip.prunes: ip session prunes
- * stream_ip.reassembled bytes: total reassembled bytes
+ * stream_ip.prunes: ip_ session prunes
+ * stream_ip.reassembled_bytes: total reassembled bytes
* stream_ip.reassembled: reassembled datagrams
- * stream_ip.released: ip session trackers released
- * stream_ip.sessions: total ip sessions
- * stream_ip.timeouts: ip session timeouts
- * stream_ip.total frags: total fragments
- * stream.ip total prunes: total ip sessions pruned
- * stream_ip.trackers added: datagram trackers created
- * stream_ip.trackers cleared: datagram trackers cleared
- * stream_ip.trackers completed: datagram trackers completed
- * stream_ip.trackers freed: datagram trackers released
- * stream.ip uni prunes: ip uni sessions pruned
- * stream_tcp.3way trackers: tcp session tracking started on ack
- * stream_tcp.client cleanups: number of times data from server was
+ * stream_ip.released: ip_ session trackers released
+ * stream_ip.sessions: total ip_ sessions
+ * stream_ip.timeouts: ip_ session timeouts
+ * stream_ip.total_frags: total fragments
+ * stream.ip_total_prunes: total ip sessions pruned
+ * stream_ip.trackers_added: datagram trackers created
+ * stream_ip.trackers_cleared: datagram trackers cleared
+ * stream_ip.trackers_completed: datagram trackers completed
+ * stream_ip.trackers_freed: datagram trackers released
+ * stream.ip_uni_prunes: ip uni sessions pruned
+ * stream_tcp.3way_trackers: tcp session tracking started on ack
+ * stream_tcp.client_cleanups: number of times data from server was
flushed when session released
* stream_tcp.closing: number of sessions currently closing
- * stream_tcp.created: tcp session trackers created
- * stream_tcp.data trackers: tcp session tracking started on data
+ * stream_tcp.created: tcp_ session trackers created
+ * stream_tcp.data_trackers: tcp session tracking started on data
* stream_tcp.discards: tcp packets discarded
* stream_tcp.established: number of sessions currently established
* stream_tcp.events: events generated
- * stream.tcp excess prunes: tcp sessions pruned due to excess
- * stream.tcp flows: total tcp sessions
+ * stream.tcp_excess_prunes: tcp sessions pruned due to excess
+ * stream.tcp_flows: total tcp sessions
* stream_tcp.gaps: missing data between PDUs
- * stream.tcp ha prunes: tcp sessions pruned by high availability
+ * stream.tcp_ha_prunes: tcp sessions pruned by high availability
sync
- * stream.tcp idle prunes: tcp sessions pruned due to timeout
+ * stream.tcp_idle_prunes: tcp sessions pruned due to timeout
* stream_tcp.ignored: tcp packets ignored
* stream_tcp.initializing: number of sessions currently
initializing
- * stream_tcp.internal events: 135:X events generated
- * stream_tcp.max bytes: number of times the maximum queued byte
+ * stream_tcp.internal_events: 135:X events generated
+ * stream_tcp.max_bytes: number of times the maximum queued byte
limit was reached
- * stream_tcp.max: max tcp sessions
- * stream_tcp.max segs: number of times the maximum queued segment
+ * stream_tcp.max: max tcp_ sessions
+ * stream_tcp.max_segs: number of times the maximum queued segment
limit was reached
- * stream.tcp memcap prunes: tcp sessions pruned due to memcap
+ * stream.tcp_memcap_prunes: tcp sessions pruned due to memcap
* stream_tcp.memory: current memory in use
* stream_tcp.overlaps: overlapping segments queued
- * stream.tcp preemptive prunes: tcp sessions pruned during
+ * stream.tcp_preemptive_prunes: tcp sessions pruned during
preemptive pruning
- * stream_tcp.prunes: tcp session prunes
- * stream_tcp.rebuilt buffers: rebuilt PDU sections
- * stream_tcp.rebuilt bytes: total rebuilt bytes
- * stream_tcp.rebuilt packets: total reassembled PDUs
- * stream_tcp.released: tcp session trackers released
+ * stream_tcp.prunes: tcp_ session prunes
+ * stream_tcp.rebuilt_buffers: rebuilt PDU sections
+ * stream_tcp.rebuilt_bytes: total rebuilt bytes
+ * stream_tcp.rebuilt_packets: total reassembled PDUs
+ * stream_tcp.released: tcp_ session trackers released
* stream_tcp.resyns: SYN received on established session
- * stream_tcp.segs queued: total segments queued
- * stream_tcp.segs released: total segments released
- * stream_tcp.segs split: tcp segments split when reassembling PDUs
- * stream_tcp.segs used: queued tcp segments applied to reassembled
+ * stream_tcp.segs_queued: total segments queued
+ * stream_tcp.segs_released: total segments released
+ * stream_tcp.segs_split: tcp segments split when reassembling PDUs
+ * stream_tcp.segs_used: queued tcp segments applied to reassembled
PDUs
- * stream_tcp.server cleanups: number of times data from client was
+ * stream_tcp.server_cleanups: number of times data from client was
flushed when session released
- * stream_tcp.sessions: total tcp sessions
- * stream_tcp.syn-ack trackers: tcp session tracking started on
+ * stream_tcp.sessions: total tcp_ sessions
+ * stream_tcp.syn_ack_trackers: tcp session tracking started on
syn-ack
- * stream_tcp.syn trackers: tcp session tracking started on syn
- * stream_tcp.timeouts: tcp session timeouts
- * stream.tcp total prunes: total tcp sessions pruned
- * stream.tcp uni prunes: tcp uni sessions pruned
+ * stream_tcp.syn_trackers: tcp session tracking started on syn
+ * stream_tcp.timeouts: tcp_ session timeouts
+ * stream.tcp_total_prunes: total tcp sessions pruned
+ * stream.tcp_uni_prunes: tcp uni sessions pruned
* stream_tcp.untracked: tcp packets not tracked
- * stream_udp.created: udp session trackers created
- * stream.udp excess prunes: udp sessions pruned due to excess
- * stream.udp flows: total udp sessions
- * stream.udp ha prunes: udp sessions pruned by high availability
+ * stream_udp.created: udp_ session trackers created
+ * stream.udp_excess_prunes: udp sessions pruned due to excess
+ * stream.udp_flows: total udp sessions
+ * stream.udp_ha_prunes: udp sessions pruned by high availability
sync
- * stream.udp idle prunes: udp sessions pruned due to timeout
- * stream_udp.max: max udp sessions
- * stream.udp memcap prunes: udp sessions pruned due to memcap
- * stream.udp preemptive prunes: udp sessions pruned during
+ * stream.udp_idle_prunes: udp sessions pruned due to timeout
+ * stream_udp.max: max udp_ sessions
+ * stream.udp_memcap_prunes: udp sessions pruned due to memcap
+ * stream.udp_preemptive_prunes: udp sessions pruned during
preemptive pruning
- * stream_udp.prunes: udp session prunes
- * stream_udp.released: udp session trackers released
- * stream_udp.sessions: total udp sessions
- * stream_udp.timeouts: udp session timeouts
- * stream.udp total prunes: total udp sessions pruned
- * stream.udp uni prunes: udp uni sessions pruned
- * stream.user excess prunes: user sessions pruned due to excess
- * stream.user flows: total user sessions
- * stream.user ha prunes: user sessions pruned by high availability
+ * stream_udp.prunes: udp_ session prunes
+ * stream_udp.released: udp_ session trackers released
+ * stream_udp.sessions: total udp_ sessions
+ * stream_udp.timeouts: udp_ session timeouts
+ * stream.udp_total_prunes: total udp sessions pruned
+ * stream.udp_uni_prunes: udp uni sessions pruned
+ * stream.user_excess_prunes: user sessions pruned due to excess
+ * stream.user_flows: total user sessions
+ * stream.user_ha_prunes: user sessions pruned by high availability
sync
- * stream.user idle prunes: user sessions pruned due to timeout
- * stream.user memcap prunes: user sessions pruned due to memcap
- * stream.user preemptive prunes: user sessions pruned during
+ * stream.user_idle_prunes: user sessions pruned due to timeout
+ * stream.user_memcap_prunes: user sessions pruned due to memcap
+ * stream.user_preemptive_prunes: user sessions pruned during
preemptive pruning
- * stream.user total prunes: total user sessions pruned
- * stream.user uni prunes: user uni sessions pruned
- * tcp.bad checksum (ip4): nonzero tcp over ip checksums
- * tcp.bad checksum (ip6): nonzero tcp over ipv6 checksums
+ * stream.user_total_prunes: total user sessions pruned
+ * stream.user_uni_prunes: user uni sessions pruned
+ * tcp.bad_tcp4_checksum: nonzero tcp over ip checksums
+ * tcp.bad_tcp6_checksum: nonzero tcp over ipv6 checksums
* tcp_connector.messages: total messages
* telnet.packets: total packets
- * udp.bad checksum (ip4): nonzero udp over ipv4 checksums
- * udp.bad checksum (ip6): nonzero udp over ipv6 checksums
- * wizard.tcp hits: tcp identifications
- * wizard.tcp scans: tcp payload scans
- * wizard.udp hits: udp identifications
- * wizard.udp scans: udp payload scans
- * wizard.user hits: user identifications
- * wizard.user scans: user payload scans
+ * udp.bad_udp4_checksum: nonzero udp over ipv4 checksums
+ * udp.bad_udp6_checksum: nonzero udp over ipv6 checksums
+ * wizard.tcp_hits: tcp identifications
+ * wizard.tcp_scans: tcp payload scans
+ * wizard.udp_hits: udp identifications
+ * wizard.udp_scans: udp payload scans
+ * wizard.user_hits: user identifications
+ * wizard.user_scans: user payload scans
19.6. Generators
* 128: ssh
* 129: stream_tcp
* 131: dns
+ * 133: dce_http_proxy
+ * 133: dce_http_server
* 133: dce_smb
* 133: dce_tcp
* 133: dce_udp
Content-Encoding used
* 119:78 (http_inspect) multiple layers of compression encodings
applied
+ * 119:79 (http_inspect) server response before client request
* 122:1 (port_scan) TCP portscan
* 122:2 (port_scan) TCP decoy portscan
* 122:3 (port_scan) TCP portsweep
* cvs (ips_option): payload rule option for detecting specific
attacks
* daq (basic): configure packet acquisition interface
+ * dce_http_proxy (inspector): dce over http inspection - client to/
+ from proxy
+ * dce_http_server (inspector): dce over http inspection - proxy to/
+ from server
* dce_iface (ips_option): detection option to check dcerpc
interface
* dce_opnum (ips_option): detection option to check dcerpc
* file_connector (connector): implement the file based connector
* file_data (ips_option): rule option to set detection cursor to
file data
- * file_id (basic): configure file identification
+ * file_id (inspector): configure file identification
* file_log (inspector): log file event to file.log
* file_type (ips_option): rule option to check file type
* flags (ips_option): rule option to test TCP control flags
* inspector::back_orifice: back orifice detection
* inspector::binder: configure processing based on CIDRs, ports,
services, etc.
+ * inspector::dce_http_proxy: dce over http inspection - client to/
+ from proxy
+ * inspector::dce_http_server: dce over http inspection - proxy to/
+ from server
* inspector::dce_smb: dce over smb inspection
* inspector::dce_tcp: dce over tcp inspection
* inspector::dce_udp: dce over udp inspection
* inspector::dnp3: dnp3 inspection
* inspector::dns: dns inspection
+ * inspector::file_id: configure file identification
* inspector::file_log: log file event to file.log
* inspector::ftp_client: FTP inspector client module
* inspector::ftp_data: FTP data channel handler
projects / thirdparty / snort3.git / commitdiff
