Project

General

Profile

Actions

Feature #724

closed

Prevent resetting in UNIX socket mode

Added by Felix Ingram over 8 years ago. Updated almost 4 years ago.

Status:
Closed
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:

Description

The UNIX socket mode allows multiple pcaps to be submitted to the engine. At the moment the pcaps are processed in the order in which they are submitted and the engine is reset before each file is processed.

Any events that would have been triggered by a stream that spans separate files will therefore not be reported.

The new feature would prevent the resetting of the engine between pcaps and would produce results similar to what would have been generated if the pcaps had been merged and submitted to the engine as a single file.

The UNIX socket currently allows a log directory to be submitted with each file, so a design decision would have to be made as to which directory received the alert.


Related issues

Related to Feature #2222: Batch submission of PCAPs over the socketClosedDanny Browning10/07/2017Actions
Has duplicate Feature #1476: Suricata Unix socket PCAP processing stats should not need to reset after each runClosedDanny Browning05/28/2015Actions
Actions #1

Updated by Victor Julien over 8 years ago

  • Status changed from New to Assigned
  • Assignee set to Eric Leblond
  • Target version set to TBD
Actions #2

Updated by Victor Julien almost 4 years ago

  • Assignee changed from Eric Leblond to Danny Browning
  • Target version changed from TBD to 70
Actions #3

Updated by Danny Browning almost 4 years ago

  • Is duplicate of Feature #2222: Batch submission of PCAPs over the socket added
Actions #4

Updated by Danny Browning almost 4 years ago

  • Status changed from Assigned to Closed
Actions #5

Updated by Victor Julien almost 4 years ago

  • Is duplicate of deleted (Feature #2222: Batch submission of PCAPs over the socket)
Actions #6

Updated by Victor Julien almost 4 years ago

  • Status changed from Closed to Assigned
Actions #7

Updated by Victor Julien almost 4 years ago

  • Related to Feature #2222: Batch submission of PCAPs over the socket added
Actions #8

Updated by Victor Julien almost 4 years ago

  • Has duplicate Feature #1476: Suricata Unix socket PCAP processing stats should not need to reset after each run added
Actions #9

Updated by Victor Julien almost 4 years ago

  • Status changed from Assigned to Closed
  • Target version changed from 70 to 4.1beta1
Actions

Also available in: Atom PDF