Adding upstream version 1:7.0.3.upstream/1%7.0.3

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 19 insertions, 0 deletions

diff --git a/doc/userguide/rules/bypass-keyword.rst b/doc/userguide/rules/bypass-keyword.rst
new file mode 100644
index 0000000..e5505a6
--- /dev/null
+++ b/doc/userguide/rules/bypass-keyword.rst
@@ -0,0 +1,19 @@
+Bypass Keyword
+==============
+
+Suricata has a ``bypass`` keyword that can be used in signatures to exclude traffic from further evaluation.
+
+The ``bypass`` keyword is useful in cases where there is a large flow expected (e.g. Netflix, Spotify, YouTube).
+
+The ``bypass`` keyword is considered a post-match keyword.
+
+
+bypass
+------
+
+Bypass a flow on matching http traffic.
+
+Example::
+
+  alert http any any -> any any (content:"suricata.io"; \
+      http_host; bypass; sid:10001; rev:1;)