Ignore common UDP ports

443 (http3) and 88 (kerberos) are expected to see UDP traffic Signed-off-by: jackmtpt <115712715+jackmtpt@users.noreply.github.com>
falcosecurity · Aug 15, 2024 · 46a4ff2 · 46a4ff2
1 parent 342b20d
commit 46a4ff2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/rules/falco-incubating_rules.yaml b/rules/falco-incubating_rules.yaml
@@ -734,7 +734,7 @@
   items: [0, 9, 80, 3306]
 
 - list: expected_udp_ports
-  items: [53, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]
+  items: [53, 443, 88, openvpn_udp_ports, l2tp_udp_ports, statsd_ports, ntp_ports, test_connect_ports]
 
 - macro: expected_udp_traffic
   condition: fd.port in (expected_udp_ports)