•
•
Step Description Command Keys
23 Set TCP Window-Size value for which
the rule should trigger (optional).
Applicable only for protocol tcp value.
esr(config-ips-category-rule)# ip
tcp window-size <SIZE>
<SIZE> – TCP Window-Size
value, takes a value in the range
[0..65535].
24 Set HTTP protocol keywords for which
the rule will trigger (optional).
Applicable only for protocol http value.
esr(config-ips-category-rule)# ip
http { accept | accept-enc |
accept-lang | client-body |
connection | content-type | cookie |
file-data | header | header-names |
host | method | protocol |
referer | request-line | response-
line | server-body | start |
start-code | start-msg | uri | user-
agent }
See the Suricata 4.X
documentation for the meaning
of the keywords.
https://
suricata.readthedocs.io/en/
suricata-4.1.4/rules/http-
keywords.html
25 Set HTTP protocol URI LEN keyword
value for which the rule will trigger
(optional).
Applicable only for protocol http value.
esr(config-ips-category-rule)# ip
http urilen <LEN>
<LEN> – takes values in the
range of [0.. 65535].
esr(config-ips-category-rule)# ip
http urilen comparison-operator
{ greater-than | less-than }
Comparison operator for ip http
urilen value:
greater-than – greater
than..
less-than – less than..
26 Set the value of the content of
packages (Payload content) for which
the rule will trigger (optional).
esr(config-ips-category-rule)#
payload content <CONTENT>
<CONTENT> – text message
specified by a string of up to
1024 characters.
27 Do not distinguish between uppercase
and lowercase letters in the description
of package contents (optional).
Only applicable in conjunction with the
payload content command.
esr(config-ips-category-rule)#
payload no-case
28 Set how many bytes from the beginning
of the contents of the packet will be
checked (optional).
Only applicable in conjunction with the
payload content command.
esr(config-ips-category-rule)#
payload depth <DEPTH>
<DEPTH> – the number of
bytes from the beginning of the
packet contents, takes a value
in the range [1 .. 65535].
By default, the entire contents
of the package are checked.
To Next Page
Loading...
Need help?
General
