8.39. Generic App Layer Keywords
8.39.1. app-layer-protocol
Match on the detected app-layer protocol.
Syntax:
app-layer-protocol:[!]<protocol>(,<mode>);
Examples:
app-layer-protocol:ssh;
app-layer-protocol:!tls;
app-layer-protocol:failed;
app-layer-protocol:!http,final;
app-layer-protocol:http,to_server; app-layer-protocol:tls,to_client;
app-layer-protocol:http2,final; app-layer-protocol:http1,original;
A special value 'failed' can be used for matching on flows in which protocol detection failed. This can happen if Suricata doesn't know the protocol or when certain 'bail out' conditions happen.
The different modes are * direction : protocol recognized on the direction of the current packet * to_server : protocol recognized in the direction to server * to_client : protocol recognized in the direction to client * either : tries to match protocols found on both directions * final : final protocol chosen by Suricata for parsing * original : original protocol (in case of protocol change)
By default, (if no mode is specified), the mode is direction.
Here is an example of a rule matching non-http traffic on port 80:
alert tcp any any -> any 80 (msg:"non-HTTP traffic over HTTP standard port"; flow:to_server; app-layer-protocol:!http,final; sid:1; )
8.39.1.1. Bail out conditions
Protocol detection gives up in several cases:
both sides are inspected and no match was found
side A detection failed, side B has no traffic at all (e.g. FTP data channel)
side A detection failed, side B has so little data detection is inconclusive
In these last 2 cases the app-layer-event:applayer_proto_detection_skipped
is set.
8.39.2. app-layer-event
Match on events generated by the App Layer Parsers and the protocol detection engine.
Syntax:
app-layer-event:<event name>;
Examples:
app-layer-event:applayer_mismatch_protocol_both_directions;
app-layer-event:http.gzip_decompression_failed;
8.39.2.1. Protocol Detection
8.39.2.1.1. applayer_mismatch_protocol_both_directions
The toserver and toclient directions have different protocols. For example a client talking HTTP to a SSH server.
8.39.2.1.2. applayer_wrong_direction_first_data
Some protocol implementations in Suricata have a requirement with regards to the first data direction. The HTTP parser is an example of this.
8.39.2.1.3. applayer_detect_protocol_only_one_direction
Protocol detection only succeeded in one direction. For FTP and SMTP this is expected.
8.39.2.1.4. applayer_proto_detection_skipped
Protocol detection was skipped because of Bail out conditions.