This topic created in 1451 days ago, the information mentioned may be changed or developed.
小弟正在学习 ids ，写了一个 suricata 规则，用 wireshark 和 tcpdump 导出两个 pcap 包，使用-r参数来读取，结果是只能匹配到 tcpdump 的 pcap 包，suricata 不支持读取 wireshark 的 pcap 包吗？
alert tls any any -> any any (msg:"match 8443 JA3 string"; \
ja3.string; content:"771"; \
sid:100002;)
alert tls any any -> any any (msg:"match 8443 JA3s string"; \
ja3s.string; content:"49199"; \
sid:100001;)
No Comments Yet
Select Language