New answers tagged ids
1
Suricata implements a sub- and superset of the Snort language, but doesn't add support for matching on the layer 2.
Recently there has been some work on at least tracking and logging MAC addresses (see https://github.com/OISF/suricata/pull/4975), so L2 is getting a bit more love.
In general, I would suggest opening a feature ticket describing the use cases.
2
At first, I thought that ip_proto:4 was going to match on IPv4, but that's not correct.
IP protocol number 4 is IP-in-IP, which is what the rule is supposed to report on.
So, for both rules, it is inspecting all IP traffic, regardless of direction or destination for IP-in-IP traffic.
Suricata's documentation on ip_proto.
Why are you getting 100M alerts? ...
Top 50 recent answers are included
