From a0aa2307322cd47bbf416810ac0292925e03be87 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 19:39:49 +0200 Subject: Adding upstream version 1:7.0.3. Signed-off-by: Daniel Baumann --- rules/dhcp-events.rules | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 rules/dhcp-events.rules (limited to 'rules/dhcp-events.rules') diff --git a/rules/dhcp-events.rules b/rules/dhcp-events.rules new file mode 100644 index 0000000..c99d981 --- /dev/null +++ b/rules/dhcp-events.rules @@ -0,0 +1,7 @@ +# DHCP app-layer event rules. See +# +# https://redmine.openinfosecfoundation.org/projects/suricata/wiki/AppLayer +# for SID allocation. + +alert dhcp any any -> any any (msg:"SURICATA DHCP malformed options"; app-layer-event:dhcp.malformed_options; classtype:protocol-command-decode; sid:2227000; rev:1;) +alert dhcp any any -> any any (msg:"SURICATA DHCP truncated options"; app-layer-event:dhcp.truncated_options; classtype:protocol-command-decode; sid:2227001; rev:1;) -- cgit v1.2.3