Can space be used in the header of the rule format?
According to suricata’s documentation (6.1. Rules Format — Suricata 6.0.1 documentation), each sample contains spaces.
For example, section 6.1.3
- ! 126.96.36.199
- ![188.8.131.52, 184.108.40.206]
If spaces are available for addressd and port, it is difficult to analyze(Split) headers using spaces.
I am wondering if it is officially possible to use space for Address and Port.
Let’s just try it out. Sure enough, you can have space galore.
[root@3e6616847ed5 ~]# suricata -T -S test.rules
20/2/2021 -- 10:08:43 - <Info> - Running suricata under test mode
20/2/2021 -- 10:08:43 - <Notice> - This is Suricata version 6.0.0 RELEASE running in SYSTEM mode
20/2/2021 -- 10:08:43 - <Notice> - Configuration provided was successfully loaded. Exiting.
[root@3e6616847ed5 ~]# cat test.rules
alert ip any any -> [ any, ! 220.127.116.11] any (msg:"asd"; sid:1;)
Thanks for your detailed answer.