Suricata

HTTP/3 : no feedback from decryptors

More SMTP and FTP keywords and detection
- smtp.subject

Philippe Antoine wrote in #note-11:

HTTP/3 : no feedback from decryptors

More SMTP and FTP keywords and detection
- smtp.subject

Frames support can be an alternative to a new keyword

file.data does not work for SMTP body, SMTP body should be treated as a file

FTP file.name has a perf impact ?

Clarify the doc between ftp and ftp-data abilities

Domain name can be in DNS names, HTTP host or TLS sni based on the networks that do not have all these traffics

Add client certificates information in output

Already done in suricata 7

fileinfo event could hav the name of the file being stored on disk

Have a version field for each event ?

detecting bad capture

unidirectional, encapsulation, duplicate packets...

it would great to find a way to reduce impact of inspection on throughput performance. i.e. let’s say throughput is 5 gig on a box but once Suricata is enabled it drops to a bit over 1 gig.

doc/release: include a delta of changes to suricata.yaml

@Jason Ish just said he will create a ticket for this

performance: Where do the packets get dropped ?

Discussion about LUA vendoring...

Being able to ship JA4+ as a plugin