Suricata

I think a better fix would be to allow blocking when not running live. This would mean no lost events due to a blocking socket when using pcaps and no configuration change required between live and file reading.

I don't think any wait is acceptable in live mode, as it does hold up processing packets.

I get your point and it's a really good one but I'm not totally convinced. :)

Why not let the user choose if waiting is acceptable or not?

Some will prefere to wait while others won't, in any case I think the user is the more appropriate one to decide what really needs and that's the point of the configuration option.

I think a better fix will be to take into account not being in live mode to make the wait but keep on using nonblocking sockets, IMHO it's a more balanced choice.

...so that would be a mix between your idea and the initial one (I'm sorry but I don't know how to edit a post)

My apologies,

I think my initial explantion lacks how I'm using Suricata, I'm controlling Suricata from a unix socket and use that for analyzing pcap files.

The command line used is:

1. suricata -vv --unix-socket -c /usr/local/etc/suricata/suricata.yaml

...so Suricata runs in UNIX_MODE

Found to be a bug in not determining correctly run runmode is offline, and thus setting blocking socket for unix socket outputs.