The IPS documentation for Windows has a dead link to a PDF. The Windows build instructions should be updated with WinDivert build instructions, and then this link could be updated.A. Iooss
Currently Suricata implements the @R@ PCRE modifier to allow the equivalent of @distance:0@. This is enough in most use case, except when using PCRE extraction. See for example this rule:A. Iooss
Suricata can produce pcap.xz files, but can only read uncompressed pcap files. When dealing with large datasets of pcap, it can be useful to be able to load them directly in Suricata without having to decompress them beforehand.A. Iooss
Currently `SCWebSocketLoggerLog` hardcodes `pp` and `pb64` as `false`. An user can only dumps websocket payloads with an alert (setting `websocket-payload: yes`). An option could be added in `suricata.yaml`, such as `outputs.1.eve-lo...A. Iooss
During an attack-defense CTF, I captured the following exchange between a Python HTTPX client and an ASP.NET server (behing a NGINX reverse-proxy).A. Iooss
The rule engine is buggy when using hyperscan. This can be reproduced on a fresh Ubuntu 24.04 install, with the same Suricata package, and same firewall configuration. The Suricata rules are:A. Iooss