Suricata

Maybe could be done together: add option to indicate that the pcap comes from an existing test (so we won't duplicate the pcap, but add the path to the original as seen in https://github.com/OISF/suricata-verify/blob/master/tests/alert-testmyids-frames/test.yaml#L1

Maybe the script could even simply identify when the pcap path is from a test within the SV directory?

Maybe the script could even simply identify when the pcap path is from a test within the SV directory?

Agreed. That would be useful. I also wonder how many people actually use createst to create the tests. I feel that the number is quite little even within the team. So, maybe it's useful to ask the roadblocks for using the script and have tickets for everything. wdyt?

Shivani Bhardwaj wrote in #note-4:

Maybe the script could even simply identify when the pcap path is from a test within the SV directory?

Agreed. That would be useful. I also wonder how many people actually use createst to create the tests. I feel that the number is quite little even within the team. So, maybe it's useful to ask the roadblocks for using the script and have tickets for everything. wdyt?

I like that approach. I use createst a lot, even when I sometimes - like with --simulate-ips up until now - I have to adjust stuff afterwards. I'll see if I get feedback from the team on what prevents them from using it, and see what can be improved, from there :)

Created a ticket for the suggestion given here: https://redmine.openinfosecfoundation.org/issues/7139