suricata
suricata copied to clipboard
Document rules internals - v2
Added a page that explains how rules are prioritized by Suri, as well as what main different types of inspection happen and what elements are involved when ordering rules.
Task #5449
Previous PR: https://github.com/OISF/suricata/pull/7635
Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/5449
Describe changes:
- Add section elaborating on IPOnly rules and how the applayer state machine can affect when rules are inspected, regardless of rules internal priorities
- typo fixes
Codecov Report
Merging #7655 (7aabfc2) into master (61f9f0d) will decrease coverage by
0.01%
. The diff coverage isn/a
.
@@ Coverage Diff @@
## master #7655 +/- ##
==========================================
- Coverage 75.78% 75.77% -0.02%
==========================================
Files 659 659
Lines 185660 185660
==========================================
- Hits 140706 140682 -24
- Misses 44954 44978 +24
Flag | Coverage Δ | |
---|---|---|
fuzzcorpus | 60.16% <ø> (ø) |
|
suricata-verify | 52.53% <ø> (-0.01%) |
:arrow_down: |
unittests | 60.72% <ø> (-0.01%) |
:arrow_down: |
Flags with carried forward coverage won't be shown. Click here to find out more.
Continued at: https://github.com/OISF/suricata/pull/7721