Questions tagged [suricata]

The tag has no usage guidance.

5 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
2
votes
0answers
394 views

How can I get Suricata to alert on 1 packet every time

I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought. ...
0
votes
1answer
68 views

Suricata bypass keyword

I have not found any examples on using the 'bypass' keyword. Does it work in any rule? Are there performance implications using 'bypass'. For example, would this bypass all tcp traffic? alert tcp any ...
0
votes
0answers
51 views

How can I get Packet length from Suricata output?

In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don't see these information in JSON alerts (from eve.json). How can I get these information?
0
votes
0answers
122 views

Snort Rule to check for TCP options

Lets say malformed packets are sent by attacker with improper TCP options length i.e, 50bytes,222bytes etc. Is there any way to monitor these packets having invalid tcp options set using Snort or ...
0
votes
1answer
262 views

Virustotal detecting threats in Suricata rule set

Virustotal scans are detecting threats from the Suricata default rule pack located https://rules.emergingthreats.net/open/suricata-4.0/ Is this a false positive? https://www.virustotal.com/#/file/...