Unknown rule keyword 'flow.pkts_toclient'

Help
1

Hello,

I’m runnning Suricata 7.0.2 on ubuntu and I’m having problems with this suricata rule :

drop ip any any -> any any (msg:" alert "; flow.pkts_toclient:0; sid:100130; rev:1; flow:to_server; flowbits:set,ip_blocked; flowbits:isnotset,ip_blocked;)

I’m getting this error: unknown rule keyword 'flow.pkts_toclient'

It is strange since this keyword can be found in the official docs for Suricata 7.0.2, which is the version I am running.

any ideas?

Thanks

2

This is not part of 7.0.2 see 8.11. Flow Keywords — Suricata 7.0.2 documentation this got introduced in current master, see Feature #6164: detect: new keyword flow.pkts_toclient to server and bytes as well - Suricata - Open Information Security Foundation so it will be in 8.0

1 Like
3

That makes sense, thank you!