Re: dpd.sig rejection syntax
Jon Siwek <[email protected]>
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <CAMzgZ0L39AVT1JEgG10hRcOq4XhwmjZOD8-g=A6Nvf4_9YQV8Q@mail.gmail.com> |
On Sun, Apr 21, 2019 at 2:58 PM TQ <[email protected]> wrote: > There are two protocols, A and B which use <STX> and <ETX> to encapsulate their data. Both protocols operate over 20+ ports, and the only difference is that protocol B starts with lowercase 's' after \x02. I've looked over the dpd.sig files on Zeek GitHub but didn't find anything for rejection. Here's more extensive documentation on signatures: https://docs.zeek.org/en/latest/frameworks/signatures.html The negated "requires-signature" condition may be relevant to you. > I've tried adding (!s), [!s] after \x02, but protocol A stops logging... so I know there's a syntax issue. The syntax generally follows these rules: http://westes.github.io/flex/manual/Patterns.html So [^s] means "anything except an 's' character" - Jon _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek