Feature #2174
openNeed a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET
Description
Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET
For example:
ip_extract: <bytes to convert>, <offset> [, relative][, <endian>][, string], <comparator>
Where:
<bytes_to_convert>: Number of bytes to pick up from the packet. The allowed values are 7 to 15 when used against string. Should not be used if applied against binary data.
<offset>: Number of bytes into the payload to start processing
<relative>: Use an offset relative to last pattern match
<endian>: Endian type of the ip address being represented by binary data:
big - Process data as big endian (default)
little - Process data as little endian
<string>: IP address is stored in string format in packet
<comparator>: One of 4 values specifying what the extracted ip address should be compared to:
is_srcip - extracted ip address is checked whether it is equal to the source address of ip packet
is_dstip - extracted ip address is checked whether it is equal to the destination address of ip packet
is_external - extracted ip address is checked whether it is in $EXTERNAL_NET ip address space
is_home - extracted ip address is checked whether it is in $HOME_NET ip address space
I attached a screenshot of an example http session where I'd like to extract ip address and compare whether it is from $EXTERNAL_NET
Files