A Suricata detection rule uses the keyword flow:established,to_server. What does this specify?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because flow:established requires an established (three-way handshake completed) TCP connection, and to_server restricts matching to packets flowing from the client to the server — commonly used to detect malicious HTTP requests or exploit payloads sent to services. A is wrong because flow:established applies to TCP stateful tracking; UDP connections are not 'established' in the same sense.
Full explanation below image
Full Explanation
B is correct because flow:established requires an established (three-way handshake completed) TCP connection, and to_server restricts matching to packets flowing from the client to the server — commonly used to detect malicious HTTP requests or exploit payloads sent to services. A is wrong because flow:established applies to TCP stateful tracking; UDP connections are not 'established' in the same sense. C is wrong because flow:established refers to TCP state, not TLS encryption state. D is wrong because to_server refers to the client-to-server direction of a specific connection, not internet-outbound direction.