Project

General

Profile

Actions

Feature #7518

open

add "blocking" argument to pcap-file socket command

Added by Seth Grover 10 days ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

This request is to add a blocking argument to the pcap-file command (see https://docs.suricata.io/en/latest/manpages/suricatasc.html#pcap-mode-commands).

This arose from this conversation (https://forum.suricata.io/t/suricata-in-socket-mode-determining-if-a-pcap-is-done-processing). Right now there isn't a good way to determine if a PCAP file has finished processing other than parsing suricata.log.

With a blocking mode that waited until the run was complete at least we know that way.

No data to display

Actions

Also available in: Atom PDF