ICMPv4 Body Not Detected in Suricata

Both icmpv6.hdr and icmpv4.hdr (proposed) will return data, starting from the beginning of the ICMP section.

The v6 version returns the first 8 bytes while the v4 version will return the first N bytes, where N matches the length of the ICMP message type. The “length” for the router advertisement is variable and computed per the RFC.

Many v4 messages are 8 (or less) bytes and a few are longer (timestamp related, router advertisement).

“Body” and “header” are synonymous with the (proposed) addition. I’ll be posting a PR soon so you can view the actual changes and provide an opportunity to try these out in your environment.

Suricata PR
Suricata-verify PR