From b5b05b8fce68ac18e7ea6330508afc3ad0c35866 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Wed, 18 Jan 2023 07:05:08 +0530 Subject: [PATCH] rules/decoder: add udp.len_invalid rule --- rules/decoder-events.rules | 1 + 1 file changed, 1 insertion(+) diff --git a/rules/decoder-events.rules b/rules/decoder-events.rules index 026c49f694..1972a5afac 100644 --- a/rules/decoder-events.rules +++ b/rules/decoder-events.rules @@ -67,6 +67,7 @@ alert pkthdr any any -> any any (msg:"SURICATA TCP option invalid length"; decod alert pkthdr any any -> any any (msg:"SURICATA TCP duplicated option"; decode-event:tcp.opt_duplicate; classtype:protocol-command-decode; sid:2200037; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA UDP packet too small"; decode-event:udp.pkt_too_small; classtype:protocol-command-decode; sid:2200038; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA UDP header length too small"; decode-event:udp.hlen_too_small; classtype:protocol-command-decode; sid:2200039; rev:2;) +alert pkthdr any any -> any any (msg:"SURICATA UDP invalid length field in the header"; decode-event:udp.len_invalid; classtype:protocol-command-decode; sid:2200220; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA SLL packet too small"; decode-event:sll.pkt_too_small; classtype:protocol-command-decode; sid:2200041; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA Ethernet packet too small"; decode-event:ethernet.pkt_too_small; classtype:protocol-command-decode; sid:2200042; rev:2;) alert pkthdr any any -> any any (msg:"SURICATA PPP packet too small"; decode-event:ppp.pkt_too_small; classtype:protocol-command-decode; sid:2200043; rev:2;)