Logging all the frames is likely only useful for developments and rule writers for small pcaps. But it could be interesting to enable a subset of frames for logging.
There could be 2 ways, that we should probably explore both:
- global config
- rule based: e.g.
configkeyword to enable logging somehow on a per flow or per frame basis?