readme.flowbits

This is the snapshot of Snot Latest Rules

Flowbits Detection Capability
-----------------------------

The flowbits detection plugin uses the flow preprocessor to track rule state
across transport protocol sessions.  This is most useful for TCP sessions, as
it allows rules to generically track the state of an application protocol.

The general configuration of the flowbits rule option is:

    flowbits:<keyword>[,<STATE_NAME>];

Flowbits Keywords
-----------------

There are seven keywords associated with flowbits, most of the options need a
user defined name for the specific state that is being checked.  This string
should be limited to any alphanumeric string including periods, dashes, and
underscores.  

set
---
This keyword sets a STATE_NAME for a particular flow.  This keyword always
returns true.

Usage:  flowbits:set,FOO;

unset
-----
This keyword unsets a STATE_NAME for a particular flow.  This keyword always
returns true.

Usage:  flowbits:unset,FOO;

toggle
------
This keyword sets a STATE_NAME if unset, and unsets a STATE_NAME if set.  This
keyword always returns true.

Usage:  flowbits:toggle,FOO;

isset
-----
This keyword checks a STATE_NAME to see if it is set.  It returns true if the
STATE_NAME is set, and returns false if the STATE_NAME is not set.

Usage:  flowbits:isset,FOO;

isnotset
--------
This keyword checks a STATE_NAME to see if it is not set.  It returns true if
the STATE_NAME is not set, and returns false if the STATE_NAME is set.

Usage:  flowbits:isnotset,FOO;

noalert
-------
This keyword always returns false.  It allows users to write rules that set,
unset, and toggle STATE_NAME without generating an alert.  This is most useful
for writing flowbit rules that set STATE_NAME on normal traffic and
significantly reduces unwanted alerts.  There is no STATE_NAME specified with
this keyword.

Usage:  flowbits:noalert;

reset
-----

This keyword resets all of the states on a given flow.  This always returns
true.  There is no STATE_NAME specified with this keyword.

Usage:  flowbits:reset;

Sample Rules
------------
alert tcp any 143 -> any any (msg:"IMAP login"; content:"OK LOGIN"; flowbits:set,logged_in;)
alert tcp any any -> any 143 (msg:"IMAP lsub"; content:"LSUB"; flowbits:isset,logged_in;)
alert tcp any any -> any 143 (msg:"IMAP LIST WITHOUT LOGIN"; content:"LIST"; flowbits:isnotset,logged_in;)