Suricata

How do you think such a combination should look like? Or do you just want to use -r /tmp/foobar instead of -r /tmp/foobar/1.pcap, -r /tmp/foobar/2.pcap and so on?

Ralph, that PR allows a directory to be specified with multiple files, but suricata state will not be reset between files, and files will be processed in order of modified time.

If you want reset between files with separate output directory, I can do another PR. Looking at a format of

{
  "command" : "pcap-files",
  "arguments" : {
    "files" : [
      {
        "filename" : "path-to-file",
        "output-dir" : "path-to-output-directory" 
      },
      ...
      ]
  }
}

https://github.com/OISF/suricata/pull/3059