How to support keyword 'pkt_data' in snort rules
吴超 via Snort-users <[email protected]> Tue, 13 Jan 2026 11:51:26 +0800 (CST)
| Newsgroups | gmane.comp.security.ids.snort.general |
|---|---|
| Message-ID | <[email protected]> |
------=_Part_58862_212520498.1768276286737 Content-Type: multipart/alternative; boundary="----=_Part_58864_1990853373.1768276286737" ------=_Part_58864_1990853373.1768276286737 Content-Type: text/plain; charset=GBK Content-Transfer-Encoding: base64 SGkgU25vcnQgZXhwZXJ0cywKCgpJIGhhdmUgYSBxdWVzdGlvbiB3aGVuIHVzaW5nICdwa3RfZGF0 YScga2V5d29yZCBpbiBzbm9ydCBydWxlcy4KQWNjb3JkaW5nIHRvIGh0dHBzOi8vZG9jcy5zbm9y dC5vcmcvcnVsZXMvb3B0aW9ucy9wYXlsb2FkL3BrdF9kYXRhLCBJIG5lZWQgdG8gc2V0ICdzZWFy Y2hfZW5naW5lLmRldGVjdF9yYXdfdGNwJyB0byB0cnVlIHRvIHN1cHBvcnQgJ3BrdF9kYXRhJyBp biBzb25ydCBydWxlcy4gCkJ1dCBhZnRlciBJIGFkZGVkIHRoaXMgc2V0dGluZyB0byBjb25maWd1 cmF0aW9uLCBpdCBzZWVtcyBub3Qgd29ya2luZy4gClBscyBoZWxwIHRvIGNoZWNrIHdoeSB0aGUg Y29uZmlndXJhdGlvbiBub3QgY2hlbmdlZCBpbiBteSB3b3JraW5nIGVudiwgVGhhbmtzCgoKVGhl IHNub3J0IHZlcnNpb24gaXMgdjMuNy40LjAuIEhlcmUgaXMgd2hhdCBJIHRyaWVkOgooMSkgYWRk IGNoYW5nZSB0byBzbm9ydC5sdWEgZmlsZToKICAgIGFkZCAiaW5jbHVkZSgnbWF4X2RhdGVjdC5s dWEnKSIgb3IgInNlYXJjaF9lbmdpbmUuZGV0ZWN0X3Jhd190Y3AgPSB0cnVlIiBvciAic2VhcmNo X2VuZ2luZSA9IHsgZGV0ZWN0X3Jhd190Y3AgPSB0cnVlIH0iCigyKSBhZGQgcGFyYW1ldGVyIGlu IGNvbW1hbmQKICAgIGFkZCAiLS1sdWEgJ3NlYXJjaF9lbmdpbmUuZGV0ZWN0X3Jhd190Y3AgPSB0 cnVlJyIgb3IgIi0tdHdlYWtzIG1heF9kZXRlY3QiCkFmdGVyIGRvaW5nIGFib3ZlLCBJIGNoZWNr ZWQgY29uZmlndXJhdGlvbiBieSB1c2luZyAiLS1oZWxwLWNvbmZpZyBzZWFyY2hfZW5naW5lIHxn cmVwIHRjcCIsIGFuZCBnZXQgdGhlIG91dHB1dDoKICAgIGJvb2wgc2VhcmNoX2VuZ2luZS5kZXRl Y3RfcmF3X3RjcCA9IGZhbHNlOiBkZXRlY3Qgb24gVENQIHBheWxvYWQgYmVmb3JlIHJlYXNzZW1i bHkKCgpJIGFsc28gY2hlY2tlZCB3aXRoIHNvbWUgc2ltcGxlIHBjYXAgd2l0aCBmb2xsb3dpbmcg c25vcnQgcnVsZXMsIGFuZCBzZWVtcyBubyBtYXR0ZXIgaG93IHRoZSBjb25maWd1cmF0aW9uIGNo YW5nZWQsIHRoZSAzcmQgcnVsZSh3aXRoICdwa3RfZGF0YScgaW4gcnVsZSkgbmV2ZXIgbWF0Y2hl ZDoKICAgIGFsZXJ0IHRjcCBhbnkgYW55IC0+IGFueSAkSFRUUF9QT1JUUyAoIG1zZzoiY2hlY2sg cGt0X2RhdGEtMSI7IGNvbnRlbnQ6Ii9pbmRleC5waHAiOyBjb250ZW50OiJBY2NlcHQtRW5jb2Rp bmc6IGd6aXAiOyBzaWQ6MTAwMDEwMDE7IHJldjoxOyApCgogICAgYWxlcnQgdGNwIGFueSBhbnkg LT4gYW55ICRIVFRQX1BPUlRTICggbXNnOiJjaGVjayBwa3RfZGF0YS0yIjsgaHR0cF91cmk7IGNv bnRlbnQ6Ii9pbmRleC5waHAiOyBodHRwX2hlYWRlcjsgY29udGVudDoiQWNjZXB0LUVuY29kaW5n OiBnemlwIjsgc2lkOjEwMDAxMDAyOyByZXY6MTsgKQogICAgYWxlcnQgdGNwIGFueSBhbnkgLT4g YW55ICRIVFRQX1BPUlRTICggbXNnOiJjaGVjayBwa3RfZGF0YS0zIjsgaHR0cF9oZWFkZXI7IGNv bnRlbnQ6IkFjY2VwdC1FbmNvZGluZzogZ3ppcCI7IHBrdF9kYXRhOyBjb250ZW50OiIvaW5kZXgu cGhwIjsgc2lkOjEwMDAxMDAzOyByZXY6MTsgKQpUaGUgcGNhcCBpcyBhdHRhY2hlZCB0byB0aGUg bWFpbC4KCgpCZXN0IFJlZ2FyZHMsCld1IENoYW8KCg== ------=_Part_58864_1990853373.1768276286737 Content-Type: text/html; charset=GBK Content-Transfer-Encoding: base64 PGRpdiBkYXRhLW50ZXM9Im50ZXNfbWFpbF9ib2R5X3Jvb3QiIHN0eWxlPSJsaW5lLWhlaWdodDox Ljc7Y29sb3I6IzAwMDAwMDtmb250LXNpemU6MTRweDtmb250LWZhbWlseTpBcmlhbCI+PGRpdiBp ZD0ic3BuRWRpdG9yQ29udGVudCI+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+SGkgU25vcnQgZXhw ZXJ0cyw8L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46IDA7Ij48YnI+PC9kaXY+PGRpdiBzdHlsZT0i bWFyZ2luOiAwOyI+SSBoYXZlIGEgcXVlc3Rpb24gd2hlbiB1c2luZyAncGt0X2RhdGEnIGtleXdv cmQgaW4gc25vcnQgcnVsZXMuPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+QWNjb3JkaW5n IHRvJm5ic3A7PGEgaHJlZj0iaHR0cHM6Ly9kb2NzLnNub3J0Lm9yZy9ydWxlcy9vcHRpb25zL3Bh eWxvYWQvcGt0X2RhdGEiPmh0dHBzOi8vZG9jcy5zbm9ydC5vcmcvcnVsZXMvb3B0aW9ucy9wYXls b2FkL3BrdF9kYXRhPC9hPiwgSSBuZWVkIHRvIHNldCAnc2VhcmNoX2VuZ2luZS5kZXRlY3RfcmF3 X3RjcCcgdG8gdHJ1ZSB0byBzdXBwb3J0ICdwa3RfZGF0YScgaW4gc29ucnQgcnVsZXMuJm5ic3A7 PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+QnV0IGFmdGVyIEkgYWRkZWQgdGhpcyBzZXR0 aW5nIHRvIGNvbmZpZ3VyYXRpb24sIGl0IHNlZW1zIG5vdCB3b3JraW5nLiZuYnNwOzwvZGl2Pjxk aXYgc3R5bGU9Im1hcmdpbjogMDsiPlBscyBoZWxwIHRvIGNoZWNrIHdoeSB0aGUgY29uZmlndXJh dGlvbiBub3QgY2hlbmdlZCBpbiBteSB3b3JraW5nIGVudiwgVGhhbmtzPC9kaXY+PGRpdiBzdHls ZT0ibWFyZ2luOiAwOyI+PGJyPjwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjogMDsiPlRoZSBzbm9y dCB2ZXJzaW9uIGlzIHYzLjcuNC4wLiBIZXJlIGlzIHdoYXQgSSB0cmllZDo8L2Rpdj48ZGl2IHN0 eWxlPSJtYXJnaW46IDA7Ij4oMSkgYWRkIGNoYW5nZSB0byBzbm9ydC5sdWEgZmlsZTo8L2Rpdj48 ZGl2IHN0eWxlPSJtYXJnaW46IDA7Ij4mbmJzcDsgJm5ic3A7IGFkZCAiPGVtPmluY2x1ZGUoJ21h eF9kYXRlY3QubHVhJyk8L2VtPiIgb3IgIjxlbT5zZWFyY2hfZW5naW5lLmRldGVjdF9yYXdfdGNw ID0gdHJ1ZTwvZW0+IiBvciAiPGVtPnNlYXJjaF9lbmdpbmUgPSB7IGRldGVjdF9yYXdfdGNwID0g dHJ1ZSB9PC9lbT4iPC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+KDIpIGFkZCBwYXJhbWV0 ZXIgaW4gY29tbWFuZDwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjogMDsiPiZuYnNwOyAmbmJzcDsg YWRkICI8ZW0+LS1sdWEgJ3NlYXJjaF9lbmdpbmUuZGV0ZWN0X3Jhd190Y3AgPSB0cnVlJzwvZW0+ IiBvciAiPGVtPi0tdHdlYWtzIG1heF9kZXRlY3Q8L2VtPiI8L2Rpdj48ZGl2IHN0eWxlPSJtYXJn aW46IDA7Ij5BZnRlciBkb2luZyBhYm92ZSwgSSBjaGVja2VkIGNvbmZpZ3VyYXRpb24gYnkgdXNp bmcgIjxlbT4tLWhlbHAtY29uZmlnIHNlYXJjaF9lbmdpbmUgfGdyZXAgdGNwPC9lbT4iLCBhbmQg Z2V0IHRoZSBvdXRwdXQ6PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+PHNwYW4gc3R5bGU9 ImJhY2tncm91bmQtY29sb3I6IHJnYigyNTUsIDI1NSwgMjU1KTsiPiZuYnNwOyAmbmJzcDsgPC9z cGFuPjxzcGFuIHN0eWxlPSJiYWNrZ3JvdW5kLWNvbG9yOiByZ2IoMjU1LCAyNDUsIDEwMik7Ij5i b29sIHNlYXJjaF9lbmdpbmUuZGV0ZWN0X3Jhd190Y3AgPSA8L3NwYW4+PGI+PHNwYW4gc3R5bGU9 ImJhY2tncm91bmQtY29sb3I6IHJnYigyNTUsIDI0NSwgMTAyKTsiPmZhbHNlPC9zcGFuPjwvYj48 c3BhbiBzdHlsZT0iYmFja2dyb3VuZC1jb2xvcjogcmdiKDI1NSwgMjQ1LCAxMDIpOyI+OiBkZXRl Y3Qgb24gVENQIHBheWxvYWQgYmVmb3JlIHJlYXNzZW1ibHk8L3NwYW4+PC9kaXY+PGRpdiBzdHls ZT0ibWFyZ2luOiAwOyI+PHNwYW4gc3R5bGU9ImJhY2tncm91bmQtY29sb3I6IHJnYigyNTUsIDI1 NSwgMjU1KTsiPjwvc3Bhbj48YnI+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+SSBhbHNv IGNoZWNrZWQgd2l0aCBzb21lIHNpbXBsZSBwY2FwIHdpdGggZm9sbG93aW5nIHNub3J0IHJ1bGVz LCBhbmQgc2VlbXMgbm8gbWF0dGVyIGhvdyB0aGUgY29uZmlndXJhdGlvbiBjaGFuZ2VkLCB0aGUg M3JkIHJ1bGUod2l0aCAncGt0X2RhdGEnIGluIHJ1bGUpIG5ldmVyIG1hdGNoZWQ6PC9kaXY+PGRp diBzdHlsZT0ibWFyZ2luOiAwOyI+Jm5ic3A7ICZuYnNwOyBhbGVydCB0Y3AgYW55IGFueSAtJmd0 OyBhbnkgJEhUVFBfUE9SVFMgKCBtc2c6ImNoZWNrIHBrdF9kYXRhLTEiOyBjb250ZW50OiIvaW5k ZXgucGhwIjsgY29udGVudDoiQWNjZXB0LUVuY29kaW5nOiBnemlwIjsgc2lkOjEwMDAxMDAxOyBy ZXY6MTsgKQo8YnI+PC9kaXY+PGRpdiBzdHlsZT0ibWFyZ2luOiAwOyI+CjwvZGl2PjxkaXYgc3R5 bGU9Im1hcmdpbjogMDsiPiZuYnNwOyAmbmJzcDsgYWxlcnQgdGNwIGFueSBhbnkgLSZndDsgYW55 ICRIVFRQX1BPUlRTICggbXNnOiJjaGVjayBwa3RfZGF0YS0yIjsgaHR0cF91cmk7IGNvbnRlbnQ6 Ii9pbmRleC5waHAiOyBodHRwX2hlYWRlcjsgY29udGVudDoiQWNjZXB0LUVuY29kaW5nOiBnemlw Ijsgc2lkOjEwMDAxMDAyOyByZXY6MTsgKTwvZGl2PjxkaXYgc3R5bGU9Im1hcmdpbjogMDsiPgo8 L2Rpdj48ZGl2IHN0eWxlPSJtYXJnaW46IDA7Ij4mbmJzcDsgJm5ic3A7IGFsZXJ0IHRjcCBhbnkg YW55IC0mZ3Q7IGFueSAkSFRUUF9QT1JUUyAoIG1zZzoiY2hlY2sgcGt0X2RhdGEtMyI7IGh0dHBf aGVhZGVyOyBjb250ZW50OiJBY2NlcHQtRW5jb2Rpbmc6IGd6aXAiOyBwa3RfZGF0YTsgY29udGVu dDoiL2luZGV4LnBocCI7IHNpZDoxMDAwMTAwMzsgcmV2OjE7ICk8L2Rpdj48ZGl2IHN0eWxlPSJt YXJnaW46IDA7Ij5UaGUgcGNhcCBpcyBhdHRhY2hlZCB0byB0aGUgbWFpbC48L2Rpdj48ZGl2IHN0 eWxlPSJtYXJnaW46IDA7Ij48YnI+PC9kaXY+PC9kaXY+PGRpdiBzdHlsZT0icG9zaXRpb246cmVs YXRpdmU7em9vbToxIj48L2Rpdj48ZGl2IGlkPSJkaXZOZXRlYXNlTWFpbENhcmQiPjwvZGl2Pjxk aXYgc3R5bGU9Im1hcmdpbjogMDsiPkJlc3QgUmVnYXJkcyw8L2Rpdj48ZGl2IHN0eWxlPSJtYXJn aW46IDA7Ij5XdSBDaGFvPC9kaXY+PHByZT48YnI+CjwvcHJlPjwvZGl2Pg== ------=_Part_58864_1990853373.1768276286737-- ------=_Part_58862_212520498.1768276286737 Content-Type: application/vnd.tcpdump.pcap; name=test.pcap; x-cm-securityLevel=0 Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="test.pcap" 1MOyoQIABAAAAAAAAAAAAP//AAABAAAAKA8EZSbdCADNAAAAzQAAAABQVr+cGAAMKZw9sggARQAA v554QACABgAAwKgKCsCoChTGVgBQE1meFfdLBD5QGCAUliAAAEdFVCAvaW5kZXgucGhwIEhUVFAv MS4xDQpIb3N0OiAxOTIuMTY4LjEwLjIwDQpVc2VyLUFnZW50OiBNb3ppbGxhLzUuMCAoV2luZG93 cyBOVCAxMC4wOyBydjo3OC4wKSBHZWNrby8yMDEwMDEwMSBGaXJlZm94Lzc4LjANCkFjY2VwdC1F bmNvZGluZzogZ3ppcA0KDQooDwRlyvoIAPwAAAD8AAAAAAwpnD2yAFBWv5wYCABFAADuMKlAAIAG M/LAqAoUwKgKCgBQxlb3SwQ+E1merFAYAQD1xQAASFRUUC8xLjEgNDA0IOacquaJvuWIsA0KQ29u dGVudC1UeXBlOiB0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgNCkFjY2VwdC1SYW5nZXM6IGJ5dGVz DQpTZXJ2ZXI6IEhGUyAyLjQuMCBSQzcNClNldC1Db29raWU6IEhGU19TSURfPVg0c1hDQlVRNWtB QUFPQkxEbGJyUHc7IHBhdGg9LzsgSHR0cE9ubHkNCkNvbnRlbnQtRW5jb2Rpbmc6IGd6aXANCg0K ------=_Part_58862_212520498.1768276286737 Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Snort-users mailing list [email protected] Go to this URL to change user options or unsubscribe: https://lists.snort.org/mailman/listinfo/snort-users To unsubscribe, send an email to: [email protected] Please visit http://blog.snort.org to stay current on all the latest Snort news! Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette ------=_Part_58862_212520498.1768276286737--