Suricata Rule : allowed to use variables in content?

1

Hi,
content:!“|C0 A8 01 01|”; # This works
content:!$DHCP_SERVERS; # This fails to parse
I’m trying to detect rogue DHCP servers, and want to detect option54 values instead of src or dst ip addresses

Any suggestion ?
Is this because of a typing issue (hex / string …)
Or because it is not allowed at all in the content and worst with negate ?

I’m using an old version 6.0.2
Regards

2

Hi,
Thanks for posting.

Suricata 6.0.2 is very old and is no longer supported. Please update and use 8.0 or 7.0.11 (both just released) which are the only supported versions.

Rule variables cannot be used with content

3

You may use datasets though