Sticky buffer to match on the whole UDP header. Example rule: alert udp any any -> any any (udp.hdr; content:”|00 08|”; offset:4; depth:2; sid:1234; rev:5;)
This above is only information given in Suricata documentation. I am using pyshark to analyzed each packet and get information from packet related to signature of UDP will only header and its content in this case according to documentation.
How can i get this content:|00 08| information from each UDP packet? I am using in python script to automatically generate rules for each UDP packet.
If i see the bytes of in pcap which does not have any udp.header information( its has source port, destionation port, checkum and legnth, payloads etc) packet.udp.hdr does not provide any information packet.udp.srcport provude port port, destionation port, checkum and legnth, payloads can be fected individually but how complete header information to be feched header which is 8 byte (port, destionation port, checkum and legnth) 2byte for each. packet.udp print whole udp layer information