From: Victor Julien Date: Mon, 24 Mar 2025 12:25:25 +0000 (+0100) Subject: doc/tls: add more detail on tls.random X-Git-Tag: suricata-8.0.0-beta1~187 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8c9dfafc6d8406f373ad1578c1686735e9c23936;p=thirdparty%2Fsuricata.git doc/tls: add more detail on tls.random --- diff --git a/doc/userguide/rules/tls-keywords.rst b/doc/userguide/rules/tls-keywords.rst index 0db3e1c049..f65689a067 100644 --- a/doc/userguide/rules/tls-keywords.rst +++ b/doc/userguide/rules/tls-keywords.rst @@ -261,7 +261,7 @@ You can specify several states with ``|`` (OR) to check for any of the specified tls.random ---------- -Matches on the 32 bytes of the TLS random field. +Matches on the 32 bytes of the TLS random field from the client hello or server hello records. Example:: @@ -273,7 +273,7 @@ Example:: tls.random_time --------------- -Matches on the first 4 bytes of the TLS random field. +Matches on the first 4 bytes of the TLS random field from the client hello or server hello records. Example:: @@ -285,7 +285,7 @@ Example:: tls.random_bytes ---------------- -Matches on the last 28 bytes of the TLS random field. +Matches on the last 28 bytes of the TLS random field from the client hello or server hello records. Example::