Detect non-ip protocols (ie GOOSE)

Hi all,
I’m new to Suricata (and networking in general)
I would like to know how (if possible) to detect non-ip protocols, for instance GOOSE.

I have a pcap with GOOSE packets (among ip packets)
When I set a simple rule:
alert ip any any -> any any …

All ip packets are detected, non-ip packets (GOOSE in my case) are not.

What should I do?

Thanks in advance for your help

Could you share the pcap or have an example pcap for that protocol? but for now you won’t gain much from it without support for that protocol.

Hi Andreas,
thanks for your answer.
In the meantime I found a way to get my packets without the hassle of adding support for the protocol.

Here is a pcap with goose protocol packets:
goose.pcap (1.4 KB)


It might be worth to add a feature request in our redmine for that and attach the pcap.