Fast_pattern and prefilter

Rules
1

I have some questions about how fast_pattern and prefilter are used.

Is fast_pattern only used with the payload keyword 'content? The Suricata 6.00 user guide says that the prefilter engines for other non-MPM keywords can be enabled in specific rules by using the ‘prefilter’ keyword.

Which keywords are non-MPM?

Is the payload keyword ‘content’ a MPM keyword? What are other MPM keywords?

I will appreciate very much if someone can provide information for my questions.

Victor

2

Yes, fast_pattern is only used with content.

To see which keywords support prefilter you can use
suricata --list-keywords=all

This shows a per keyword features field

tcp.flags:
	Description: detect which flags are set in the TCP header
	Features: prefilter
	Documentation: https://suricata.readthedocs.io/en/latest/rules/header-keywords.html#tcp-flags

Quick and dirty grep foo

suricata --list-keywords=all|grep -B2 prefilter|grep -v -P "^(\t|\-)"
app-layer-protocol:
tcp.ack:
tcp.seq:
tcp.flags:
fragbits:
fragoffset:
ttl:
itype:
icode:
icmp_id:
icmp_seq:
dsize:
flow:
id:
template2:
icmpv6.mtu:
tcp.mss:
prefilter:
1 Like
3

Thanks for the information. It is helpful.