mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
74 lines
1.6 KiB
ReStructuredText
74 lines
1.6 KiB
ReStructuredText
Snort Compatibility
|
|
===================
|
|
|
|
.. contents::
|
|
|
|
Keyword: content
|
|
----------------
|
|
|
|
*Versions affected: All versions prior to 3.0.*
|
|
|
|
Prior to Suricata 3.0, the argument provided to the content keyword
|
|
cannot be longer than 255 characters like it can in Snort.
|
|
|
|
Suricata 3.0 and newer can accept content arguments longer than 255
|
|
characters.
|
|
|
|
See:
|
|
|
|
* https://redmine.openinfosecfoundation.org/issues/1281
|
|
* https://github.com/inliniac/suricata/pull/1475
|
|
|
|
Keyword: urilen
|
|
---------------
|
|
|
|
*Versions affected: all*
|
|
|
|
In Snort the urilen range is inclusive, in Suricata it is not.
|
|
|
|
Example::
|
|
|
|
urilen:5<>10
|
|
|
|
In Snort the above will match URIs that are greater than and equal to
|
|
5 and less than and equal to 10. *Note that this is not what is
|
|
documented in the Snort manual.*
|
|
|
|
In Suricata the above will match URIs that are greater than 5 and less
|
|
than 10, so it will only mathch URIs that are 6, 7, 8, and 9 bytes
|
|
long.
|
|
|
|
See:
|
|
|
|
* https://redmine.openinfosecfoundation.org/issues/1416
|
|
|
|
Keyword: isdataat
|
|
-----------------
|
|
|
|
*Versions affected: all*
|
|
|
|
``isdataat`` is off by one from Snort. In Snort the offset starts at 0
|
|
where Suricata starts at 1.
|
|
|
|
Keyword: flowbits
|
|
-----------------
|
|
|
|
*Versions affected: all prior to 2.0.9*
|
|
|
|
Versions of Suricata prior to 2.0.9 treated leading and trailing
|
|
whitespace in flowbit names as part of the flowbit name where Snort
|
|
does not.
|
|
|
|
This was fixed in Suricata 2.0.9.
|
|
|
|
See:
|
|
|
|
* https://redmine.openinfosecfoundation.org/issues/1481
|
|
|
|
Keyword: flow:not_established
|
|
-----------------------------
|
|
|
|
*Versions affected: all*
|
|
|
|
The ``not_established`` argument to the ``flow`` keyword is not supported.
|