Project

General

Profile

Actions
Copy link

Feature #2648

open
HL CT

store captured data into file

Feature #2648: store captured data into file

Added by Hugo Lequien almost 8 years ago. Updated 15 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Problematic :
- file reconstruction does not work on ip stream
- luajit only receives chunks of the stream (1250 bytes max)
- Malwares and large exploits can be injected via non-http flows, but it is impossible to perform a confirmation check (via lua or 3rd-party software) because the matched stream can not be properly passed to them.

Solution :
A new feature to store the stream to a file. Preferably enabled by a keyword in a rule to avoid storing every matching rule.

AH Updated by Andreas Herz about 7 years ago Actions
Copy link
 #1

  • Assignee set to Community Ticket
  • Target version set to TBD

PA Updated by Philippe Antoine 15 days ago Actions
Copy link
 #2

  • Status changed from New to Feedback

Is this not handled by

      types:
        - alert:
            # payload: yes

in suricata.yaml ?

Actions
Copy link

Also available in: PDF Atom