Rule to search for a word in the entire header

Help
1

I’m new to Suricata and am trying to create a rule that would detect a word in the header of a packet.

So far the best I’ve managed to come up with is:

drop tcp any any -> any any (content:"bad_word"; nocase; sid:1;)

This works, but my understanding is that this is searching across the entire packet, including the body (effectively doin DPI).

Is that correct? If so, how do I modify the rule to only search for the word in the header?

Thank you!

2

This only inspects the payloads, in fact by default in the reassembled stream. In Suricata 6 you can use the tcp.hdr sticky buffer, so you’d write your content match as:

tcp.hdr; content:"bad_word"; nocase;
1 Like