doc/userguide/rules/mdns-keywords.rst
Suricata supports sticky buffers for efficiently matching on specific fields in mDNS (Multicast DNS) messages.
Note that sticky buffers are expected to be followed by one or more
:doc:payload-keywords.
mdns.queries.rrname is a sticky buffer that is used to look at the
name field in mDNS query resource records.
The buffer being matched on contains the complete re-assembled resource name, for example "host.local".
mdns.queries.rrname supports :doc:multi-buffer-matching.
Example::
alert udp any any -> any 5353 (msg:"mDNS query for .local domain";
mdns.queries.rrname; content:".local"; sid:1;)
mdns.answers.rrname is a sticky buffer that is used to look at the
name field in mDNS answer resource records.
The buffer being matched on contains the complete re-assembled resource name, for example "printer.local".
mdns.answers.rrname supports :doc:multi-buffer-matching.
Example::
alert udp any 5353 -> any any (msg:"mDNS answer for printer.local";
mdns.answers.rrname; content:"printer.local"; sid:2;)
mdns.authorities.rrname is a sticky buffer that is used to look at the
rrname field in mDNS authority resource records.
The buffer being matched on contains the complete re-assembled resource name, for example "device.local".
mdns.authorities.rrname supports :doc:multi-buffer-matching.
Example::
alert udp any 5353 -> any any (msg:"mDNS authority record check";
mdns.authorities.rrname; content:"auth.local"; sid:3;)
mdns.additionals.rrname is a sticky buffer that is used to look at
the rrname field in mDNS additional resource records.
The buffer being matched on contains the complete re-assembled resource name, for example "service.local".
mdns.additionals.rrname supports :doc:multi-buffer-matching.
Example::
alert udp any any -> any 5353 (msg:"mDNS additional record check";
mdns.additionals.rrname; content:"_companion-link._tcp.local"; nocase; sid:4;)
mdns.response.rrname is a sticky buffer that is used to inspect
all the rrname fields in a response, in the queries, answers,
additionals and authorities. Additionally it will also inspect rdata
fields that have the same format as an rrname (hostname).
rdata types that will be inspected are:
Example::
alert udp any 5353 -> any any (msg:"mDNS answer data match";
mdns.response.rrname; content:"Apple TV"; sid:5;)