I know this gets a bit into rule writing, but I was curious what native options were available within the Suricata rule engine, or if this would be better tasked for Lua scripting.
What I’m looking to do is get the count (in bytes) of the difference between a byte offset or initial match and a second/end of match. Ex. [Start]<------ byte count ------>[End] I would then like to compare that count to a defined number (ex. $byte_count > 100), and alert if greater than that count. This would function similar to
dsize, but for certain data within the payload, not necessarily the entire payload.
If anyone has any thoughts/feedback, or if you’ve done this and could offer some advice, that would be great.