Project

General

Profile

Actions
Copy link

Feature #3212

open

Prevent duplicate pcaps from being re-processed

Added by Peter Pan over 4 years ago. Updated over 4 years ago.

Status:
New
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Hi,

Is there a way for Suricata to keep track of the pcaps that had been processed and do not reprocess the same pcap again?

This is in the context of running with the command line option of -r.

Thank you.

Actions
Copy link
 #1

Updated by Victor Julien over 4 years ago

What is your use case?

I think this is more a task of tooling around Suricata.

Actions
Copy link
 #2

Updated by Andreas Herz over 4 years ago

  • Assignee set to Community Ticket
  • Target version set to TBD
Actions
Copy link
 #3

Updated by Peter Pan over 4 years ago

Victor Julien wrote:

What is your use case?

I think this is more a task of tooling around Suricata.

Use case is to look at the different types of traffic patterns in pcaps. But sometimes, the same pcaps get re-submitted for processing by mistake and the reviewing the results from Kibana gave the wrong impression of a spike in certain traffic.

This can be handled with more manual care but just wondering if there can be some technical solution. Eg: using --pcap-file-continuous will at least ensure that pcap with same filename would not be re-processed?

Actions
Copy link

Also available in: Atom PDF