Suricata

The UNIX socket mode allows multiple pcaps to be submitted to the engine. At the moment the pcaps are processed in the order in which they are submitted and the engine is reset before each file is processed.

Any events that would have been triggered by a stream that spans separate files will therefore not be reported.

The new feature would prevent the resetting of the engine between pcaps and would produce results similar to what would have been generated if the pcaps had been merged and submitted to the engine as a single file.

The UNIX socket currently allows a log directory to be submitted with each file, so a design decision would have to be made as to which directory received the alert.