Detect non-ip protocols (ie GOOSE)

Help
1

Hi all,
I’m new to Suricata (and networking in general)
I would like to know how (if possible) to detect non-ip protocols, for instance GOOSE.

I have a pcap with GOOSE packets (among ip packets)
When I set a simple rule:
alert ip any any -> any any …

All ip packets are detected, non-ip packets (GOOSE in my case) are not.

What should I do?

Thanks in advance for your help
Vincent

2

Could you share the pcap or have an example pcap for that protocol? but for now you won’t gain much from it without support for that protocol.

3

Hi Andreas,
thanks for your answer.
In the meantime I found a way to get my packets without the hassle of adding support for the protocol.

Here is a pcap with goose protocol packets:
goose.pcap (1.4 KB)

Regards,
Vincent

4

It might be worth to add a feature request in our redmine for that and attach the pcap.