summaryrefslogtreecommitdiffstats
path: root/doc/userguide/rules/header-keywords.rst
diff options
context:
space:
mode:
Diffstat (limited to 'doc/userguide/rules/header-keywords.rst')
-rw-r--r--doc/userguide/rules/header-keywords.rst732
1 files changed, 732 insertions, 0 deletions
diff --git a/doc/userguide/rules/header-keywords.rst b/doc/userguide/rules/header-keywords.rst
new file mode 100644
index 0000000..36d1437
--- /dev/null
+++ b/doc/userguide/rules/header-keywords.rst
@@ -0,0 +1,732 @@
+.. role:: example-rule-emphasis
+
+IP Keywords
+-----------
+
+ttl
+^^^
+
+The ttl keyword is used to check for a specific IP time-to-live value
+in the header of a packet. The format is::
+
+ ttl:<number>;
+
+For example::
+
+ ttl:10;
+
+At the end of the ttl keyword you can enter the value on which you
+want to match. The Time-to-live value determines the maximal amount
+of time a packet can be in the Internet-system. If this field is set
+to 0, then the packet has to be destroyed. The time-to-live is based
+on hop count. Each hop/router the packet passes subtracts one from the
+packet TTL counter. The purpose of this mechanism is to limit the
+existence of packets so that packets can not end up in infinite
+routing loops.
+
+Example of the ttl keyword in a rule:
+
+.. container:: example-rule
+
+ alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"IP Packet With TTL 0";
+ :example-rule-emphasis:`ttl:0;` classtype:misc-activity; sid:1; rev:1;)
+
+ipopts
+^^^^^^
+With the ipopts keyword you can check if a specific IP option is
+set. Ipopts has to be used at the beginning of a rule. You can only
+match on one option per rule. There are several options on which can
+be matched. These are:
+
+========= =============================
+IP Option Description
+========= =============================
+rr Record Route
+eol End of List
+nop No Op
+ts Time Stamp
+sec IP Security
+esec IP Extended Security
+lsrr Loose Source Routing
+ssrr Strict Source Routing
+satid Stream Identifier
+any any IP options are set
+========= =============================
+
+Format of the ipopts keyword::
+
+ ipopts: <name>;
+
+For example::
+
+ ipopts: ts;
+
+Example of ipopts in a rule:
+
+.. container:: example-rule
+
+ alert ip $EXTERNAL_NET any -> $HOME_NET any (msg:"IP Packet with timestamp option"; :example-rule-emphasis:`ipopts:ts;` classtype:misc-activity; sid:2; rev:1;)
+
+sameip
+^^^^^^
+
+Every packet has a source IP-address and a destination IP-address. It
+can be that the source IP is the same as the destination IP. With the
+sameip keyword you can check if the IP address of the source is the
+same as the IP address of the destination. The format of the sameip
+keyword is::
+
+ sameip;
+
+Example of sameip in a rule:
+
+.. container:: example-rule
+
+ alert ip any any -> any any (msg:"IP Packet with the same source and destination IP"; :example-rule-emphasis:`sameip;` classtype:bad-unknown; sid:3; rev:1;)
+
+ip_proto
+^^^^^^^^
+With the ip_proto keyword you can match on the IP protocol in the
+packet-header. You can use the name or the number of the protocol.
+You can match for example on the following protocols::
+
+ 1 ICMP Internet Control Message
+ 6 TCP Transmission Control Protocol
+ 17 UDP User Datagram
+ 47 GRE General Routing Encapsulation
+ 50 ESP Encap Security Payload for IPv6
+ 51 AH Authentication Header for Ipv6
+ 58 IPv6-ICMP ICMP for Ipv6
+
+For the complete list of protocols and their numbers see
+http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
+
+Example of ip_proto in a rule:
+
+.. container:: example-rule
+
+ alert ip any any -> any any (msg:"IP Packet with protocol 1"; :example-rule-emphasis:`ip_proto:1;` classtype:bad-unknown; sid:5; rev:1;)
+
+The named variant of that example would be::
+
+ ip_proto:ICMP;
+
+ipv4.hdr
+^^^^^^^^
+
+Sticky buffer to match on content contained within an IPv4 header.
+
+Example rule:
+
+.. container:: example-rule
+
+ alert ip any any -> any any (msg:"IPv4 header keyword example"; :example-rule-emphasis:`ipv4.hdr; content:"|06|"; offset:9; depth:1;` sid:1; rev:1;)
+
+This example looks if byte 10 of IPv4 header has value 06, which indicates that
+the IPv4 protocol is TCP.
+
+ipv6.hdr
+^^^^^^^^
+
+Sticky buffer to match on content contained within an IPv6 header.
+
+Example rule:
+
+.. container:: example-rule
+
+ alert ip any any -> any any (msg:"IPv6 header keyword example"; :example-rule-emphasis:`ipv6.hdr; content:"|06|"; offset:6; depth:1;` sid:1; rev:1;)
+
+This example looks if byte 7 of IP64 header has value 06, which indicates that
+the IPv6 protocol is TCP.
+
+id
+^^
+
+With the id keyword, you can match on a specific IP ID value. The ID
+identifies each packet sent by a host and increments usually with one
+with each packet that is being send. The IP ID is used as a fragment
+identification number. Each packet has an IP ID, and when the packet
+becomes fragmented, all fragments of this packet have the same ID. In
+this way, the receiver of the packet knows which fragments belong to
+the same packet. (IP ID does not take care of the order, in that case
+offset is used. It clarifies the order of the fragments.)
+
+Format of id::
+
+ id:<number>;
+
+Example of id in a rule:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"id keyword example"; :example-rule-emphasis:`id:1;` content:"content|3a 20|"; fast_pattern; classtype:misc-activity; sid:12; rev:1;)
+
+geoip
+^^^^^
+The geoip keyword enables matching on the source, destination or
+source and destination IPv4 addresses of network traffic, and to see to
+which country it belongs. To be able to do this, Suricata uses the GeoIP2
+API of MaxMind.
+
+The syntax of geoip::
+
+ geoip: src,RU;
+ geoip: both,CN,RU;
+ geoip: dst,CN,RU,IR;
+ geoip: both,US,CA,UK;
+ geoip: any,CN,IR;
+
+====== =============================================================
+Option Description
+====== =============================================================
+both Both source and destination have to match with the given geoip(s)
+any Either the source or the destination has to match with the given geoip(s).
+dest The destination matches with the given geoip.
+src The source matches with the given geoip.
+====== =============================================================
+
+geoip currently only supports IPv4. As it uses the GeoIP2 API of MaxMind,
+libmaxminddb must be compiled in. You must download and install the
+GeoIP2 or GeoLite2 database editions desired. Visit the MaxMind site
+at https://dev.maxmind.com/geoip/geolite2-free-geolocation-data for details.
+
+You must also supply the location of the GeoIP2 or GeoLite2 database
+file on the local system in the YAML-file configuration (for example)::
+
+ geoip-database: /usr/local/share/GeoIP/GeoLite2-Country.mmdb
+
+fragbits (IP fragmentation)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+With the fragbits keyword, you can check if the fragmentation and
+reserved bits are set in the IP header. The fragbits keyword should be
+placed at the beginning of a rule. Fragbits is used to modify the
+fragmentation mechanism. During routing of messages from one Internet
+module to the other, it can occur that a packet is bigger than the
+maximal packet size a network can process. In that case, a packet can
+be send in fragments. This maximum of the packet size is called
+Maximal Transmit Unit (MTU).
+
+You can match on the following bits::
+
+ M - More Fragments
+ D - Do not Fragment
+ R - Reserved Bit
+
+Matching on this bits can be more specified with the following
+modifiers::
+
+ + match on the specified bits, plus any others
+ * match if any of the specified bits are set
+ ! match if the specified bits are not set
+
+Format::
+
+ fragbits:[*+!]<[MDR]>;
+
+Example of fragbits in a rule:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"fragbits keyword example non-fragmented packet with fragment offset>0"; :example-rule-emphasis:`fragbits:M;` fragoffset:>0; classtype:bad-unknown; sid:123; rev:1;)
+
+fragoffset
+^^^^^^^^^^
+
+With the fragoffset keyword you can match on specific decimal values
+of the IP fragment offset field. If you would like to check the first
+fragments of a session, you have to combine fragoffset 0 with the More
+Fragment option. The fragmentation offset field is convenient for
+reassembly. The id is used to determine which fragments belong to
+which packet and the fragmentation offset field clarifies the order of
+the fragments.
+
+You can use the following modifiers::
+
+ < match if the value is smaller than the specified value
+ > match if the value is greater than the specified value
+ ! match if the specified value is not present
+
+Format of fragoffset::
+
+ fragoffset:[!|<|>]<number>;
+
+Example of fragoffset in a rule:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"fragoffset keyword example invalid non-fragmented packet with fragment offset>0"; fragbits:M; :example-rule-emphasis:`fragoffset:>0;` classtype:bad-unknown; sid:13; rev:1;)
+
+tos
+^^^
+
+The tos keyword can match on specific decimal values of the IP header TOS
+field. The tos keyword can have a value from 0 - 255. This field of the
+IP header has been updated by `rfc2474 <https://tools.ietf.org/html/rfc2474>`_
+to include functionality for
+`Differentiated services <https://en.wikipedia.org/wiki/Differentiated_services>`_.
+Note that the value of the field has been defined with the right-most 2 bits having
+the value 0. When specifying a value for tos, ensure that the value follows this.
+
+E.g, instead of specifying the decimal value 34 (hex 22), right shift twice and use
+decimal 136 (hex 88).
+
+You can specify hexadecimal values with a leading `x`, e.g, `x88`.
+
+Format of tos::
+
+ tos:[!]<number>;
+
+Example of tos in a rule:
+
+.. container:: example-rule
+
+ alert ip any any -> any any (msg:"tos keyword example tos value 8"; flow:established; :example-rule-emphasis:`tos:8;` classtype:not-suspicious; sid:123; rev:1;)
+
+Example of tos with a negated value:
+
+.. container:: example-rule
+
+ alert ip any any -> any any (msg:"tos keyword example with negated content"; flow:established,to_server; :example-rule-emphasis:`tos:!8;` classtype:bad-unknown; sid:14; rev:1;)
+
+
+TCP keywords
+------------
+
+tcp.flags
+^^^^^^^^^
+
+The tcp.flags keyword checks for specific `TCP flag bits
+<https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure>`_.
+
+The following flag bits may be checked:
+
+==== ====================================
+Flag Description
+==== ====================================
+F FIN - Finish
+S SYN - Synchronize sequence numbers
+R RST - Reset
+P PSH - Push
+A ACK - Acknowledgment
+U URG - Urgent
+C CWR - Congestion Window Reduced
+E ECE - ECN-Echo
+0 No TCP Flags Set
+==== ====================================
+
+The following modifiers can be set to change the match criteria:
+
+======== ===================================
+Modifier Description
+======== ===================================
+``+`` match on the bits, plus any others
+``*`` match if any of the bits are set
+``!`` match if the bits are not set
+======== ===================================
+
+To handle writing rules for session initiation packets such as ECN where a SYN
+packet is sent with CWR and ECE flags set, an option mask may be used by
+appending a comma and masked values. For example, a rule that checks for a SYN
+flag, regardless of the values of the reserved bits is ``tcp.flags:S,CE;``
+
+Format of tcp.flags::
+
+ tcp.flags:[modifier]<test flags>[,<ignore flags>];
+ tcp.flags:[!|*|+]<FSRPAUCE0>[,<FSRPAUCE>];
+
+Example::
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Example tcp.flags sig"; \
+ :example-rule-emphasis:`tcp.flags:FPU,CE;` classtype:misc-activity; sid:1; rev:1;)
+
+It is also possible to use the `tcp.flags` content as a fast_pattern by using the `prefilter` keyword. For more information on `prefilter` usage see :doc:`prefilter-keywords`
+
+Example::
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"Example tcp.flags sig"; \
+ :example-rule-emphasis:`tcp.flags:FPU,CE; prefilter;` classtype:misc-activity; sid:1; rev:1;)
+
+seq
+^^^
+The seq keyword can be used in a signature to check for a specific TCP
+sequence number. A sequence number is a number that is generated
+practically at random by both endpoints of a TCP-connection. The
+client and the server both create a sequence number, which increases
+with one with every byte that they send. So this sequence number is
+different for both sides. This sequence number has to be acknowledged
+by both sides of the connection. Through sequence numbers, TCP
+handles acknowledgement, order and retransmission. Its number
+increases with every data-byte the sender has send. The seq helps
+keeping track of to what place in a data-stream a byte belongs. If the
+SYN flag is set at 1, than the sequence number of the first byte of
+the data is this number plus 1 (so, 2).
+
+Example::
+
+ seq:0;
+
+Example of seq in a signature:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN NULL"; flow:stateless; ack:0; flags:0; :example-rule-emphasis:`seq:0;` reference:arachnids,4; classtype:attempted-recon; sid:2100623; rev:7;)
+
+Example of seq in a packet (Wireshark):
+
+.. image:: header-keywords/Wireshark_seq.png
+
+
+ack
+^^^
+
+The ack is the acknowledgement of the receipt of all previous
+(data)-bytes send by the other side of the TCP-connection. In most
+occasions every packet of a TCP connection has an ACK flag after the
+first SYN and a ack-number which increases with the receipt of every
+new data-byte. The ack keyword can be used in a signature to check
+for a specific TCP acknowledgement number.
+
+Format of ack::
+
+ ack:1;
+
+Example of ack in a signature:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN NULL"; flow:stateless; :example-rule-emphasis:`ack:0;` flags:0; seq:0; reference:arachnids,4; classtype:attempted-recon; sid:2100623; rev:7;)
+
+Example of ack in a packet (Wireshark):
+
+.. image:: header-keywords/Wireshark_ack.png
+
+window
+^^^^^^
+
+The window keyword is used to check for a specific TCP window size.
+The TCP window size is a mechanism that has control of the
+data-flow. The window is set by the receiver (receiver advertised
+window size) and indicates the amount of bytes that can be
+received. This amount of data has to be acknowledged by the receiver
+first, before the sender can send the same amount of new data. This
+mechanism is used to prevent the receiver from being overflowed by
+data. The value of the window size is limited and can be 2 to 65.535
+bytes. To make more use of your bandwidth you can use a bigger
+TCP-window.
+
+The format of the window keyword::
+
+ window:[!]<number>;
+
+Example of window in a rule:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL DELETED typot trojan traffic"; flow:stateless; flags:S,12; :example-rule-emphasis:`window:55808;` reference:mcafee,100406; classtype:trojan-activity; sid:2182; rev:8;)
+
+tcp.mss
+^^^^^^^
+
+Match on the TCP MSS option value. Will not match if the option is not
+present.
+
+The format of the keyword::
+
+ tcp.mss:<min>-<max>;
+ tcp.mss:[<|>]<number>;
+ tcp.mss:<value>;
+
+Example rule:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (flow:stateless; flags:S,12; :example-rule-emphasis:`tcp.mss:<536;` sid:1234; rev:5;)
+
+tcp.hdr
+^^^^^^^
+
+Sticky buffer to match on the whole TCP header.
+
+Example rule:
+
+.. container:: example-rule
+
+ alert tcp $EXTERNAL_NET any -> $HOME_NET any (flags:S,12; :example-rule-emphasis:`tcp.hdr; content:"|02 04|"; offset:20; byte_test:2,<,536,0,big,relative;` sid:1234; rev:5;)
+
+This example starts looking after the fixed portion of the header, so
+into the variable sized options. There it will look for the MSS option
+(type 2, option len 4) and using a byte_test determine if the value of
+the option is lower than 536. The `tcp.mss` option will be more efficient,
+so this keyword is meant to be used in cases where no specific keyword
+is available.
+
+UDP keywords
+------------
+
+udp.hdr
+^^^^^^^
+
+Sticky buffer to match on the whole UDP header.
+
+Example rule:
+
+.. container:: example-rule
+
+ alert udp any any -> any any (:example-rule-emphasis:`udp.hdr; content:"|00 08|"; offset:4; depth:2;` sid:1234; rev:5;)
+
+This example matches on the length field of the UDP header. In this
+case the length of 8 means that there is no payload. This can also
+be matched using `dsize:0;`.
+
+ICMP keywords
+-------------
+
+ICMP (Internet Control Message Protocol) is a part of IP. IP at itself
+is not reliable when it comes to delivering data (datagram). ICMP
+gives feedback in case problems occur. It does not prevent problems
+from happening, but helps in understanding what went wrong and
+where. If reliability is necessary, protocols that use IP have to take
+care of reliability themselves. In different situations ICMP messages
+will be send. For instance when the destination is unreachable, if
+there is not enough buffer-capacity to forward the data, or when a
+datagram is send fragmented when it should not be, etcetera. More can
+be found in the list with message-types.
+
+There are four important contents of a ICMP message on which can be
+matched with corresponding ICMP-keywords. These are: the type, the
+code, the id and the sequence of a message.
+
+itype
+^^^^^
+
+The itype keyword is for matching on a specific ICMP type (number).
+ICMP has several kinds of messages and uses codes to clarify those
+messages. The different messages are distinct by different names, but
+more important by numeric values. For more information see the table
+with message-types and codes.
+
+The format of the itype keyword::
+
+ itype:min<>max;
+ itype:[<|>]<number>;
+
+Example
+This example looks for an ICMP type greater than 10::
+
+ itype:>10;
+
+Example of the itype keyword in a signature:
+
+.. container:: example-rule
+
+ alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN Broadscan Smurf Scanner"; dsize:4; icmp_id:0; icmp_seq:0; :example-rule-emphasis:`itype:8;` classtype:attempted-recon; sid:2100478; rev:4;)
+
+The following lists all ICMP types known at the time of writing. A recent table can be found `at the website of IANA <https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml>`_
+
+========= ==========================================================
+ICMP Type Name
+========= ==========================================================
+0 Echo Reply
+3 Destination Unreachable
+4 Source Quench
+5 Redirect
+6 Alternate Host Address
+8 Echo
+9 Router Advertisement
+10 Router Solicitation
+11 Time Exceeded
+12 Parameter Problem
+13 Timestamp
+14 Timestamp Reply
+15 Information Request
+16 Information Reply
+17 Address Mask Request
+18 Address Mask Reply
+30 Traceroute
+31 Datagram Conversion Error
+32 Mobile Host Redirect
+33 IPv6 Where-Are-You
+34 IPv6 I-Am-Here
+35 Mobile Registration Request
+36 Mobile Registration Reply
+37 Domain Name Request
+38 Domain Name Reply
+39 SKIP
+40 Photuris
+41 Experimental mobility protocols such as Seamoby
+========= ==========================================================
+
+icode
+^^^^^
+
+With the icode keyword you can match on a specific ICMP code. The
+code of a ICMP message clarifies the message. Together with the
+ICMP-type it indicates with what kind of problem you are dealing with.
+A code has a different purpose with every ICMP-type.
+
+The format of the icode keyword::
+
+ icode:min<>max;
+ icode:[<|>]<number>;
+
+Example:
+This example looks for an ICMP code greater than 5::
+
+ icode:>5;
+
+Example of the icode keyword in a rule:
+
+.. container:: example-rule
+
+ alert icmp $HOME_NET any -> $EXTERNAL_NET any (msg:"GPL MISC Time-To-Live Exceeded in Transit"; :example-rule-emphasis:`icode:0;` itype:11; classtype:misc-activity; sid:2100449; rev:7;)
+
+The following lists the meaning of all ICMP types. When a code is not listed,
+only type 0 is defined and has the meaning of the ICMP code, in the table above.
+A recent table can be found `at the website of IANA <https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml>`_
+
++-----------+-----------+-----------------------------------------------------------------------+
+| ICMP Code | ICMP Type | Description |
++===========+===========+=======================================================================+
+| 3 | 0 | Net Unreachable |
+| +-----------+-----------------------------------------------------------------------+
+| | 1 | Host Unreachable |
+| +-----------+-----------------------------------------------------------------------+
+| | 2 | Protocol Unreachable |
+| +-----------+-----------------------------------------------------------------------+
+| | 3 | Port Unreachable |
+| +-----------+-----------------------------------------------------------------------+
+| | 4 | Fragmentation Needed and Don't Fragment was Set |
+| +-----------+-----------------------------------------------------------------------+
+| | 5 | Source Route Failed |
+| +-----------+-----------------------------------------------------------------------+
+| | 6 | Destination Network Unknown |
+| +-----------+-----------------------------------------------------------------------+
+| | 7 | Destination Host Unknown |
+| +-----------+-----------------------------------------------------------------------+
+| | 8 | Source Host Isolated |
+| +-----------+-----------------------------------------------------------------------+
+| | 9 | Communication with Destination Network is Administratively Prohibited |
+| +-----------+-----------------------------------------------------------------------+
+| | 10 | Communication with Destination Host is Administratively Prohibited |
+| +-----------+-----------------------------------------------------------------------+
+| | 11 | Destination Network Unreachable for Type of Service |
+| +-----------+-----------------------------------------------------------------------+
+| | 12 | Destination Host Unreachable for Type of Service |
+| +-----------+-----------------------------------------------------------------------+
+| | 13 | Communication Administratively Prohibited |
+| +-----------+-----------------------------------------------------------------------+
+| | 14 | Host Precedence Violation |
+| +-----------+-----------------------------------------------------------------------+
+| | 15 | Precedence cutoff in effect |
++-----------+-----------+-----------------------------------------------------------------------+
+| 5 | 0 | Redirect Datagram for the Network (or subnet) |
+| +-----------+-----------------------------------------------------------------------+
+| | 1 | Redirect Datagram for the Host |
+| +-----------+-----------------------------------------------------------------------+
+| | 2 | Redirect Datagram for the Type of Service and Network |
+| +-----------+-----------------------------------------------------------------------+
+| | 3 | Redirect Datagram for the Type of Service and Host |
++-----------+-----------+-----------------------------------------------------------------------+
+| 9 | 0 | Normal router advertisement |
+| +-----------+-----------------------------------------------------------------------+
+| | 16 | Doesn't route common traffic |
++-----------+-----------+-----------------------------------------------------------------------+
+| 11 | 0 | Time to Live exceeded in Transit |
+| +-----------+-----------------------------------------------------------------------+
+| | 1 | Fragment Reassembly Time Exceeded |
++-----------+-----------+-----------------------------------------------------------------------+
+| 12 | 0 | Pointer indicates the error |
+| +-----------+-----------------------------------------------------------------------+
+| | 1 | Missing a Required Option |
+| +-----------+-----------------------------------------------------------------------+
+| | 2 | Bad Length |
++-----------+-----------+-----------------------------------------------------------------------+
+| 40 | 0 | Bad SPI |
+| +-----------+-----------------------------------------------------------------------+
+| | 1 | Authentication Failed |
+| +-----------+-----------------------------------------------------------------------+
+| | 2 | Decompression Failed |
+| +-----------+-----------------------------------------------------------------------+
+| | 3 | Decryption Failed |
+| +-----------+-----------------------------------------------------------------------+
+| | 4 | Need Authentication |
+| +-----------+-----------------------------------------------------------------------+
+| | 5 | Need Authorization |
++-----------+-----------+-----------------------------------------------------------------------+
+
+
+icmp_id
+^^^^^^^
+
+With the icmp_id keyword you can match on specific ICMP id-values.
+Every ICMP-packet gets an id when it is being send. At the moment the
+receiver has received the packet, it will send a reply using the same
+id so the sender will recognize it and connects it with the correct
+ICMP-request.
+
+Format of the icmp_id keyword::
+
+ icmp_id:<number>;
+
+Example:
+This example looks for an ICMP ID of 0::
+
+ icmp_id:0;
+
+Example of the icmp_id keyword in a rule:
+
+.. container:: example-rule
+
+ alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN Broadscan Smurf Scanner"; dsize:4; :example-rule-emphasis:`icmp_id:0;` icmp_seq:0; itype:8; classtype:attempted-recon; sid:2100478; rev:4;)
+
+icmp_seq
+^^^^^^^^
+
+You can use the icmp_seq keyword to check for a ICMP sequence number.
+ICMP messages all have sequence numbers. This can be useful (together
+with the id) for checking which reply message belongs to which request
+message.
+
+Format of the icmp_seq keyword::
+
+ icmp_seq:<number>;
+
+Example:
+This example looks for an ICMP Sequence of 0::
+
+ icmp_seq:0;
+
+Example of icmp_seq in a rule:
+
+.. container:: example-rule
+
+ alert icmp $EXTERNAL_NET any -> $HOME_NET any (msg:"GPL SCAN Broadscan Smurf Scanner"; dsize:4; icmp_id:0; :example-rule-emphasis:`icmp_seq:0;` itype:8; classtype:attempted-recon; sid:2100478; rev:4;)
+
+icmpv4.hdr
+^^^^^^^^^^
+
+Sticky buffer to match on the whole ICMPv4 header.
+
+icmpv6.hdr
+^^^^^^^^^^
+
+Sticky buffer to match on the whole ICMPv6 header.
+
+icmpv6.mtu
+^^^^^^^^^^
+
+Match on the ICMPv6 MTU optional value. Will not match if the MTU is not
+present.
+
+The format of the keyword::
+
+ icmpv6.mtu:<min>-<max>;
+ icmpv6.mtu:[<|>]<number>;
+ icmpv6.mtu:<value>;
+
+Example rule:
+
+.. container:: example-rule
+
+ alert ip $EXTERNAL_NET any -> $HOME_NET any (:example-rule-emphasis:`icmpv6.mtu:<1280;` sid:1234; rev:5;)