Added by Eric Leblond about 13 years ago. Updated over 12 years ago.
Description
Current detection algorithm is using the rate (TCP pkt with valid checksum)/(total nb of packet on interface). We should switch to a full TCP rate with (TCP pkt with valid checksum)/(total nb of TCP packets on interface).
It is not a real issue if we are using TCP against total number of packets. It should give a correct idea on most systems.
The major point here is that it is not implemented in pcap file leading to a high number of users with detection issue. I propose to implement it for pcap file running mode. I'm thinking about inverting the logic for pcap file to non tag as invalid packet before the packet count is reached. Once reached, we switch mode.
Reopened on Eric's request.
pcap-file checksum-checks is implemented by https://github.com/inliniac/suricata/pull/396
Implemented in https://github.com/inliniac/suricata/pull/671