Project

General

Profile

Actions

Feature #3316

open

Unix socket: support dumping flow table

Added by Victor Julien almost 2 years ago. Updated almost 2 years ago.

Status:
Feedback
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

Idea is to use the unix socket interface dump the flow table. This could be used to analyse the internal state of flows.

The conntrack tool from Linux/Netfilter could be an example.


Related issues

Related to Task #3288: Suricon 2019 brainstormNewVictor JulienActions
Related to Feature #3295: Unix socket: support to receive flow shunting informationNewCommunity TicketActions
Related to Task #3301: Research: Failover support within the current IPS implementationNewCommunity TicketActions
Actions #1

Updated by Victor Julien almost 2 years ago

  • Related to Task #3288: Suricon 2019 brainstorm added
Actions #2

Updated by Victor Julien almost 2 years ago

  • Related to Feature #3295: Unix socket: support to receive flow shunting information added
Actions #3

Updated by Victor Julien almost 2 years ago

Suggestions about use cases and things like syntax and such are welcome.

Actions #4

Updated by Victor Julien almost 2 years ago

  • Description updated (diff)
Actions #5

Updated by Danny Browning almost 2 years ago

One thing as we were exploring saving flow state is that there is not currently a stable identifier for flows between suricata runs. If we plan to load the dumped flow table, flow hash_id will need to be stable (no seed), or support for community flow id will need to be added to flow as a way to marry dumped state and captured flows.

Actions #6

Updated by Victor Julien 12 months ago

  • Related to Task #3301: Research: Failover support within the current IPS implementation added
Actions

Also available in: Atom PDF