More on Suricata lua flowints
This morning I added flowint lua functions for incrementing and decrementing flowints. From the commit:
Add flowint lua functions for incrementing and decrementing flowints.
First use creates the var and inits to 0. So a call:
a = ScFlowintIncr(0)
Results in a == 1.
If the var reached UINT_MAX (2^32), it’s not further incremented. If the var reaches 0 it’s not decremented further.
Calling ScFlowintDecr on a uninitialized var will init it to 0.
Example script:
function init (args) local needs = {} needs["http.request_headers"] = tostring(true) needs["flowint"] = {"cnt_incr"} return needs end function match(args) a = ScFlowintIncr(0); if a == 23 then return 1 end return 0 end return 0
This script matches the 23rd time it’s invoked on a flow.
Compared to yesterday’s flowint script and the earlier flowvar based counting script, this performs better:
Num Rule Gid Rev Ticks % Checks Matches Max Ticks Avg Ticks Avg Match Avg No Match
-------- ------------ -------- -------- ------------ ------ -------- -------- ----------- ----------- ----------- --------------
1 1 1 0 2434188332 59.71 82249 795 711777 29595.35 7683.20 29809.22
2 2 1 0 1015328580 24.91 82249 795 154398 12344.57 3768.66 12428.27
3 3 1 0 626858067 15.38 82249 795 160731 7621.47 3439.91 7662.28
The rules:
alert http any any -> any any (msg:"LUAJIT HTTP flowvar match"; luajit:lua_flowvar_cnt.lua; flow:to_server; sid:1;)
alert http any any -> any any (msg:"LUAJIT HTTP flowint match"; luajit:lua_flowint_cnt.lua; flow:to_server; sid:2;)
alert http any any -> any any (msg:"LUAJIT HTTP flowint incr match"; luajit:lua_flowint_incr_cnt.lua; flow:to_server; sid:3;)
Please comment, discuss, review etc on the oisf-devel list.