diff --git a/rules/decoder-events.rules b/rules/decoder-events.rules index 7240ea06785..95414b74c6d 100644 --- a/rules/decoder-events.rules +++ b/rules/decoder-events.rules @@ -121,6 +121,7 @@ alert pkthdr any any -> any any (msg:"SURICATA IPv6-in-IPv6 packet too short"; d alert pkthdr any any -> any any (msg:"SURICATA IPv6-in-IPv6 invalid protocol"; decode-event:ipv6.ipv6_in_ipv6_wrong_version; sid:2200085; rev:1;) # MPLS rules +alert pkthdr any any -> any any (msg:"SURICATA MPLS header too small"; decode-event:mpls.header_too_small; sid:2200111; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS bad router alert label"; decode-event:mpls.bad_label_router_alert; sid: 2200098; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS bad implicit null label"; decode-event:mpls.bad_label_implicit_null; sid: 2200099; rev:1;) alert pkthdr any any -> any any (msg:"SURICATA MPLS reserved label"; decode-event:mpls.bad_label_reserved; sid: 2200100; rev:1;) @@ -140,5 +141,5 @@ alert pkthdr any any -> any any (msg:"SURICATA ERSPAN too many vlan layers"; dec # Cisco Fabric Path/DCE alert pkthdr any any -> any any (msg:"SURICATA DCE packet too small"; decode-event:dce.pkt_too_small; sid:2200110; rev:1;) -# next sid is 2200111 +# next sid is 2200112 diff --git a/src/decode-events.c b/src/decode-events.c index d7e4ecc946c..a07b44b1d44 100644 --- a/src/decode-events.c +++ b/src/decode-events.c @@ -168,6 +168,7 @@ const struct DecodeEvents_ DEvents[] = { { "decoder.ipv6.ipv6_in_ipv6_wrong_version", IPV6_IN_IPV6_WRONG_IP_VER, }, /* MPLS events */ + { "decoder.mpls.header_too_small", MPLS_HEADER_TOO_SMALL, }, { "decoder.mpls.bad_label_router_alert", MPLS_BAD_LABEL_ROUTER_ALERT, }, { "decoder.mpls.bad_label_implicit_null", MPLS_BAD_LABEL_IMPLICIT_NULL, }, { "decoder.mpls.bad_label_reserved", MPLS_BAD_LABEL_RESERVED, },