Project

General

Profile

Feature #4174

Updated by Victor Julien almost 3 years ago

Effort to make it possible to avoid raw tcp data inspection. Many rules looking for application records make assumptions about pdu's aligning with packets. 

 Rules should be able to do something like @alert ftp ... (frame:ftp.command; (record; content:"USER"; ... )@. 

 Frames should be defined by the app-layer parsers.

Back