Optimization of IP rules (Suricata/Snort)
Open
Nobody has claimed this yet.
T: enhancement
topic: IDS
topic: suricata
- Dominant language
- PHP
- Stars
- 6.5k
- Forks
- 1.6k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 27
Description
Reported by David André, Jan 23, 2013
Idea for an optimization, if there are mutiple IP rules in an event,
when exporting as an IDS rule, merge them as one in the format:
alert tcp $HOME_NET any -> [1.1.1.1,2.2.2.2,3.3.3.3]any
(msg:"Matching traffic for event 001!"; sid:1; rev:1;)
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the IDS rule export path and the code that handles multiple IP rules in an event; the issue does not name files or tests. Compare the current exported Suricata/Snort rule format with the requested merged destination list. Done means multiple IP rules produce one valid rule with the combined addresses, with existing export behavior preserved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100