Project

General

Profile

Actions
Copy link

Feature #3316

open

unix-socket: support dumping flow table

Added by Victor Julien about 6 years ago. Updated 14 days ago.

Status:
Feedback
Priority:
Normal
Assignee:
Community Ticket
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Idea is to use the unix socket interface dump the flow table. This could be used to analyse the internal state of flows.

The conntrack tool from Linux/Netfilter could be an example.

Related issues 4 (4 open — 0 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #3295: unix-socket: support to receive flow bypass informationNewCommunity TicketActions
Related to Suricata - Task #3301: Research: Failover support within the current IPS implementationNewCommunity TicketActions
Related to Suricata - Task #8123: Suricon 2025 BrainstormAssignedVictor JulienActions
Actions
Copy link
 #1

Updated by Victor Julien about 6 years ago

  • Related to Task #3288: Suricon 2019 brainstorm added
Actions
Copy link
 #2

Updated by Victor Julien about 6 years ago

  • Related to Feature #3295: unix-socket: support to receive flow bypass information added
Actions
Copy link
 #3

Updated by Victor Julien about 6 years ago

Suggestions about use cases and things like syntax and such are welcome.

Actions
Copy link
 #4

Updated by Victor Julien about 6 years ago

  • Description updated (diff)
Actions
Copy link
 #5

Updated by Danny Browning about 6 years ago

One thing as we were exploring saving flow state is that there is not currently a stable identifier for flows between suricata runs. If we plan to load the dumped flow table, flow hash_id will need to be stable (no seed), or support for community flow id will need to be added to flow as a way to marry dumped state and captured flows.

Actions
Copy link
 #6

Updated by Victor Julien about 5 years ago

  • Related to Task #3301: Research: Failover support within the current IPS implementation added
Actions
Copy link
 #7

Updated by Jason Ish 18 days ago

  • Related to Task #8123: Suricon 2025 Brainstorm added
Actions
Copy link
 #8

Updated by Juliana Fajardini Reichow 18 days ago

apparentlym there is alresy a unix socket command to dump a flow given its id

Actions
Copy link
 #9

Updated by Juliana Fajardini Reichow 18 days ago

TCP reverse shells seem an interesting use case as a long session not terminating properly

Actions
Copy link
 #10

Updated by Juliana Fajardini Reichow 18 days ago

Another solution could be a partial flow dump in eve.json (at flow start)

Actions
Copy link
 #11

Updated by Juliana Fajardini Reichow 18 days ago

Not only at start/end of flow, but give flexibility to user...

Actions
Copy link
 #12

Updated by Victor Julien 14 days ago

  • Subject changed from Unix socket: support dumping flow table to unix-socket: support dumping flow table
Actions
Copy link

Also available in: Atom PDF