From a0aa2307322cd47bbf416810ac0292925e03be87 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:39:49 +0200 Subject: Adding upstream version 1:7.0.3. Signed-off-by: Daniel Baumann --- doc/userguide/rules/bypass-keyword.rst | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 doc/userguide/rules/bypass-keyword.rst (limited to 'doc/userguide/rules/bypass-keyword.rst') diff --git a/doc/userguide/rules/bypass-keyword.rst b/doc/userguide/rules/bypass-keyword.rst new file mode 100644 index 0000000..e5505a6 --- /dev/null +++ b/doc/userguide/rules/bypass-keyword.rst @@ -0,0 +1,19 @@ +Bypass Keyword +============== + +Suricata has a ``bypass`` keyword that can be used in signatures to exclude traffic from further evaluation. + +The ``bypass`` keyword is useful in cases where there is a large flow expected (e.g. Netflix, Spotify, YouTube). + +The ``bypass`` keyword is considered a post-match keyword. + + +bypass +------ + +Bypass a flow on matching http traffic. + +Example:: + + alert http any any -> any any (content:"suricata.io"; \ + http_host; bypass; sid:10001; rev:1;) -- cgit v1.2.3