Project

General

Profile

Actions

Feature #2222

closed

Batch submission of PCAPs over the socket

Added by Ralph Broenink almost 4 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Currently, it is only possible to send a single PCAP file to the socket. A method to send a list of (pcap, output-dir)-combinations would be very helpful to reduce the amount of messages of the socket.


Related issues

Related to Feature #724: Prevent resetting in UNIX socket modeClosedDanny Browning01/17/2013Actions
Related to Feature #2299: pcap: read directory with pcaps from the commandlineClosedDanny Browning11/28/2017Actions
Actions #1

Updated by Victor Julien almost 4 years ago

  • Assignee set to Anonymous
Actions #2

Updated by Andreas Herz almost 4 years ago

  • Target version set to TBD

How do you think such a combination should look like? Or do you just want to use -r /tmp/foobar instead of -r /tmp/foobar/1.pcap, -r /tmp/foobar/2.pcap and so on?

Actions #3

Updated by Ralph Broenink almost 4 years ago

Andreas Herz wrote:

How do you think such a combination should look like? Or do you just want to use -r /tmp/foobar instead of -r /tmp/foobar/1.pcap, -r /tmp/foobar/2.pcap and so on?

I'm thinking more like providing a list of pcaps through the socket, e.g. s.send_command("pcap-files", {"filenames": ["1.pcap","2.pcap"], "output-dirs": ["/1", "/2"]})

Multiple output-dirs is something that is needed as long as issue #1386 is not resolved.

Actions #5

Updated by Danny Browning almost 4 years ago

  • Status changed from New to Feedback
  • Assignee changed from Anonymous to Danny Browning

Ralph, that PR allows a directory to be specified with multiple files, but suricata state will not be reset between files, and files will be processed in order of modified time.

If you want reset between files with separate output directory, I can do another PR. Looking at a format of

{
  "command" : "pcap-files",
  "arguments" : {
    "files" : [
      {
        "filename" : "path-to-file",
        "output-dir" : "path-to-output-directory" 
      },
      ...
      ]
  }
}
Actions #6

Updated by Danny Browning almost 4 years ago

  • Has duplicate Feature #2299: pcap: read directory with pcaps from the commandline added
Actions #7

Updated by Danny Browning almost 4 years ago

  • Has duplicate Feature #724: Prevent resetting in UNIX socket mode added
Actions #8

Updated by Danny Browning almost 4 years ago

  • Has duplicate Feature #1476: Suricata Unix socket PCAP processing stats should not need to reset after each run added
Actions #9

Updated by Victor Julien almost 4 years ago

  • Has duplicate deleted (Feature #724: Prevent resetting in UNIX socket mode)
Actions #10

Updated by Victor Julien almost 4 years ago

  • Related to Feature #724: Prevent resetting in UNIX socket mode added
Actions #11

Updated by Victor Julien almost 4 years ago

  • Has duplicate deleted (Feature #1476: Suricata Unix socket PCAP processing stats should not need to reset after each run)
Actions #12

Updated by Victor Julien almost 4 years ago

  • Has duplicate deleted (Feature #2299: pcap: read directory with pcaps from the commandline)
Actions #13

Updated by Victor Julien almost 4 years ago

  • Related to Feature #2299: pcap: read directory with pcaps from the commandline added
Actions #14

Updated by Victor Julien almost 4 years ago

  • Status changed from Feedback to Closed
  • Target version changed from TBD to 4.1beta1
Actions

Also available in: Atom PDF