Project

General

Profile

Actions
Copy link

Feature #1979

open

TCP/IP packets normalization/scrubbing

Added by op suri about 8 years ago. Updated about 1 month ago.

Status:
In Progress
Priority:
Normal
Assignee:
Victor Julien
Target version:
8.0.0-beta1
Effort:
high
Difficulty:
medium
Label:

Description

Snort is capable of normalizing network traffic see : https://snort.org/faq/readme-normalize

For example if one wants clear the reserved bits in the TCP header, in Snort this would be possible using the following: preprocessor normalize_tcp: [rsv]

I am convinced that TCP/IP packets normalization is possible in Suricata, but I don't know where to configure it.

Can you please help me?

Thank you.

Actions
Copy link
 #1

Updated by Victor Julien about 8 years ago

  • Priority changed from High to Normal
  • Target version deleted (3.2.1)
Actions
Copy link
 #2

Updated by Victor Julien about 8 years ago

  • Subject changed from TCP/IP packets normalization to TCP/IP packets normalization/scrubbing
  • Target version set to TBD

Suricata does not (yet) have a packet normalization/scrubbing feature.

Actions
Copy link
 #3

Updated by op suri about 8 years ago

Thank you for your reply.

Since you mentioned that suricata does not (yet) have a packet scrubbing feature, is there any short term plan to implement it?

Actions
Copy link
 #4

Updated by Victor Julien about 8 years ago

There are no plans for it at this time. Perhaps you or someone else in the community can take on the effort.

Actions
Copy link
 #5

Updated by op suri about 8 years ago

I understand that suricata does not have the normalization feature.

Your advice is appreciated to the following problem

1) I have a suricata up and running with rules generating alerts.

2) "abnormal" TCP/IP traffic/packets was identified based on rules.

3) From what I do see as features on suricata is: drop (reject), pass, alert

4) GOAL: is to clear some fields on packets instead of dropping the whole packets/traffic 

Question: 
 Is Suricata capable of 4)? if not what is your recommendation to reach this goal?

Thank you in advance

Actions
Copy link
 #6

Updated by Victor Julien about 8 years ago

No, not at this time.

Actions
Copy link
 #7

Updated by Victor Julien over 6 years ago

  • Effort set to high
  • Difficulty set to medium
Actions
Copy link
 #8

Updated by Victor Julien almost 6 years ago

  • Assignee set to Community Ticket
Actions
Copy link
 #9

Updated by Victor Julien about 1 month ago

  • Status changed from New to In Progress
  • Assignee changed from Community Ticket to Victor Julien
  • Target version changed from TBD to 8.0.0-beta1
Actions
Copy link

Also available in: Atom PDF