decode/ethertype: Event on unknown ethertype #11455
Conversation
Issue: 7129 Create a decode/engine event if unknown ethertypes are observed.
jlucovsky
requested review from
jufajardini,
victorjulien and
a team
as code owners
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #11455 +/- ##
==========================================
- Coverage 82.50% 82.49% -0.01%
==========================================
Files 938 938
Lines 247915 247916 +1
==========================================
- Hits 204533 204526 -7
- Misses 43382 43390 +8
Flags with carried forward coverage won't be shown. Click here to find out more. |
| @@ -71,6 +71,7 @@ alert pkthdr any any -> any any (msg:"SURICATA UDP header length too small"; dec | |||
| alert pkthdr any any -> any any (msg:"SURICATA UDP invalid length field in the header"; decode-event:udp.len_invalid; classtype:protocol-command-decode; sid:2200120; rev:2;) | |||
| alert pkthdr any any -> any any (msg:"SURICATA SLL packet too small"; decode-event:sll.pkt_too_small; classtype:protocol-command-decode; sid:2200041; rev:2;) | |||
| alert pkthdr any any -> any any (msg:"SURICATA Ethernet packet too small"; decode-event:ethernet.pkt_too_small; classtype:protocol-command-decode; sid:2200042; rev:2;) | |||
| alert pkthdr any any -> any any (msg:"SURICATA Ethertype unknown"; decode-event:ethernet.unknown_ethertype; threshold: type limit, track by_rule, seconds 60, count 1; classtype:protocol-command-decode; sid:2200121; rev:1;) | |||
There was a problem hiding this comment.
one issue with thresholding here is that the rule is not per ether type, but a generic "we encountered a type we dont know/support", so if there are multiple unknown ether types, the rule may alert only for some of them due to the thresholding. Not sure what can be done about it.
There was a problem hiding this comment.
Then, one can use another rule with the event
|
WARNING:
Pipeline 21498 |
Is "invalid" correct? Or just "unsupported" by Suricata? |
Good point. I think an argument could be made for each being correct. However, may I suggest that we count unknown ethertypes (and later, unknown IP protocols) as decoder.unknown? |
Strike that -- we already have a counter for |
|
Thoughts on
|
"unknown" makes more sense to me |
|
Continued in #11546 |
Continuation of #11442
Issue: 7129
Create a decode/engine event if unknown ethertypes are observed.
Link to ticket: https://redmine.openinfosecfoundation.org/issues/7129
Describe changes:
Updates
Provide values to any of the below to override the defaults.
link to the pull request in the respective
_BRANCHvariable.SV_REPO=
SV_BRANCH=OISF/suricata-verify#1954
SU_REPO=
SU_BRANCH=
LIBHTP_REPO=
LIBHTP_BRANCH=