https://redmine.openinfosecfoundation.org/https://redmine.openinfosecfoundation.org/favicon.ico?17011170022022-11-11T14:22:56ZOpen Information Security FoundationSuricata - Feature #5673: capture: option to decapsulate everything firsthttps://redmine.openinfosecfoundation.org/issues/5673?journal_id=254352022-11-11T14:22:56ZPhilippe Antoine
<ul><li><strong>Related to</strong> <i><a class="issue tracker-5 status-2 priority-4 priority-default child" href="/issues/5488">Task #5488</a>: Suricon 2022 brainstorm</i> added</li></ul> Suricata - Feature #5673: capture: option to decapsulate everything firsthttps://redmine.openinfosecfoundation.org/issues/5673?journal_id=254822022-11-13T07:50:21ZVictor Julienvictor@inliniac.net
<ul><li><strong>Related to</strong> <i><a class="issue tracker-4 status-4 priority-4 priority-default" href="/issues/2725">Optimization #2725</a>: stream/packet on wrong thread</i> added</li></ul> Suricata - Feature #5673: capture: option to decapsulate everything firsthttps://redmine.openinfosecfoundation.org/issues/5673?journal_id=254912022-11-13T08:41:46ZVictor Julienvictor@inliniac.net
<ul><li><strong>Subject</strong> changed from <i>Option to decapsulate everything first</i> to <i>capture: option to decapsulate everything first</i></li></ul><p>I think this was about providing ways to decapsulate tunnels at the capture stage, esp before RSS hashing. So this would mean capture specific support, like a special eBdf program in af-packet.</p>