Actions
Feature #7518
openadd "blocking" argument to pcap-file socket command
Description
This request is to add a blocking argument to the pcap-file command (see https://docs.suricata.io/en/latest/manpages/suricatasc.html#pcap-mode-commands).
This arose from this conversation (https://forum.suricata.io/t/suricata-in-socket-mode-determining-if-a-pcap-is-done-processing). Right now there isn't a good way to determine if a PCAP file has finished processing other than parsing suricata.log.
With a blocking mode that waited until the run was complete at least we know that way.
No data to display
Actions