hi there is an example show that quic can not detect well.
udp port not 443 or 80
quic.pcap (43.5 KB)
alert quic any any → any any (msg:“QUIC TEST”; sid:999;)
Suricata 7.0.1-dev (f58bc4d 2023-10-12)
UPDATE
modify quic decoder,add 16847 into the default port list ,it works.
why the any(dest port) not work?
Quic detection relies on port, as there are no fixed patterns for port-independent detection.
Wonder if |C2 00 00 00 01| would be a good pattern…
here is my rule.
alert udp any any → any ![443,80] (msg:“quic init request”; content:“|c2 00 00 00 01 14|”; depth:6; sid:3; rev:1;)
but i want see the sni info in the eve log.
i am try to write a “text parser” for quic protocol.
To get sni, we need to recognize quic first.
To do so, we can add ports for detection with probing parser in suricata.yaml configuration.
Or we need to modify suricata code, to add a fixed pattern like | 00 00 00 01| | at offset 1 (which can be followed by a probing parser to check)