Prevent resetting in UNIX socket mode
The UNIX socket mode allows multiple pcaps to be submitted to the engine. At the moment the pcaps are processed in the order in which they are submitted and the engine is reset before each file is processed.
Any events that would have been triggered by a stream that spans separate files will therefore not be reported.
The new feature would prevent the resetting of the engine between pcaps and would produce results similar to what would have been generated if the pcaps had been merged and submitted to the engine as a single file.
The UNIX socket currently allows a log directory to be submitted with each file, so a design decision would have to be made as to which directory received the alert.
Updated by Danny Browning almost 4 years ago
- Status changed from Assigned to Closed
Closing as duplicate of https://redmine.openinfosecfoundation.org/issues/2222