Hello, Suricata Team
I have a question about ICMPv4 decoding.
My Suricata Version : 5.0.3
- src/ decode-icmpv4.h, decode-icmpv4.c
According to the image above, certain types(like type=9/code=0, router advertisement) of ICMPv4 do not use expansion headers.
But now due to fixed header recognition length(8), Cur Hop Limit ~ Routetr Lifetime field cannot be detected in Suricata.
So I changed the protocol type of the rule Header ICMP to IP, but it was also recognized by ICMP finally I couldn’t detect it anyway.
ICMPv6 was not an issue because it recognized the variable header length for the six types specified in RFC 4884.
How can I detect ICMPv4 without extension header first four bytes Body payload?
And I also attach the test packet.
icmpv4_mobile_ip_advert.pcap (100 Bytes)
Best Regards, Choi