Skip to content

Commit

Permalink
detect/analyzer: add more details for tcp_seq
Browse files Browse the repository at this point in the history
Log the matched Sequence number of a packet
Issue: 6353
  • Loading branch information
0xEniola authored and victorjulien committed Apr 10, 2024
1 parent e54084f commit d9148d1
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions src/detect-engine-analyzer.c
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@
#include "detect-tcp-flags.h"
#include "detect-tcp-ack.h"
#include "detect-ipopts.h"
#include "detect-tcp-seq.h"
#include "feature.h"
#include "util-print.h"
#include "util-time.h"
Expand Down Expand Up @@ -912,6 +913,14 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
jb_close(js);
break;
}
case DETECT_SEQ: {
const DetectSeqData *cd = (const DetectSeqData *)smd->ctx;

jb_open_object(js, "seq");
jb_set_uint(js, "number", cd->seq);
jb_close(js);
break;
}
}
jb_close(js);

Expand Down

0 comments on commit d9148d1

Please sign in to comment.