TCP packets Question

Rules
1

I want to detect TCP packets of the same size? How?

2

I want to detect the number of times a TCP packet of the same size appears at a given time.

3

For only one predefined packet size or for packets of any size where the packet size is seen again X times?
Do you only care about detection inside one tcp stream? As in a packet with size X showing up in 10 different TCP streams should not be alerted on but a 10 packets with size X in one stream should?

4

For only one predefined packet size or for packets of any size where the packet size is seen again X times?

yes.

Do you only care about detection inside one tcp stream? As in a packet with size X showing up in 10 different TCP streams should not be alerted on but a 10 packets with size X in one stream should?

different TCP streams. Don’t care Whether in the same TCP streams, Just the size and the times

5

I do not think it can be done using the regular rule language if you are looking for repetition of arbitrary packet sizes. It might be doable using Lua. Fixed packet sizes should be solvable.