Decoder Events Rule - SID 2200067

[Alessiottero]

Hello guys!

I have a question regarding the built-in Suricata rule with SID 2200067 in the decoder-events.rules file.

Could someone please explain me the specific function of this rule? Specifically in which cases is it triggered?

Thanks in advance for anyone who can answer!!

[vjulien (Victor Julien)]

VLAN has a next protocol field, that can is 16 bits, so it can potentially hold 64k unique values. When Suricata encounters a value there that it doesn’t support, it will set this event.

In the code:

Here is the vlan decoder

src/decode-vlan.c

And here is the parser that parses the next layer

src/decode.h

If the switch statement reaches the default case, it returns false and the vent will be set in the vlan decoder.

[vjulien (Victor Julien)]

To clarify, the fact that Suricata doesn’t know the protocol, doesn’t mean it is bad or weird or malicious. It might simply be a protocol that Suricata doesn’t have support for. We’re always interested in pcaps for such protocols.