Open Information Security Foundation

11/15/2019

09:30 AM Suricata Optimization #3322: Use standard CRC32 for hash-like functions

I put a first benchmark here
https://github.com/OISF/suricata/pull/4371 Philippe Antoine

11/13/2019

09:21 AM Suricata Optimization #3322: Use standard CRC32 for hash-like functions

MurmurHash may be the best function
https://en.wikipedia.org/wiki/MurmurHash
Current function is not random
It i... Philippe Antoine

11/08/2019

04:08 PM Suricata Feature #1576: http: byte-range support

First is rebuilding file if multiple transactions are in the same flow (maybe first subclass, if they are in the righ... Philippe Antoine

11/06/2019

12:58 PM Suricata Optimization #3322: Use standard CRC32 for hash-like functions

It would be nice if this benchmarking framework handles caches realistically.
With the example of Boyer-Moore opti... Philippe Antoine

09:18 AM Suricata Optimization #3322 (New): Use standard CRC32 for hash-like functions

Instead of a custom one (as CRC32 was I think designed for kind of avoiding collisions)
One such function is @Stri... Philippe Antoine

08:37 AM Suricata Bug #1275: ET Rule 2003927 not matchin in suricata

> But I think Philippe you mentioned its documented as a feature?
We have the documentation :
https://suricata.re... Philippe Antoine

11/01/2019

04:52 PM Suricata Optimization #3305: Tracking ticket: which parts of the engine should be dynamic

For instance, number of layers of HTTP decompression : decrease in case of heavy load Philippe Antoine

03:08 PM Suricata Feature #2713: protocol detection w/o protocol parsing

Are there specific protocols in mind ?
What is the use case ?
We have to watch for evasions to use this in a rules ... Philippe Antoine

02:37 PM Suricata Feature #1576: http: byte-range support

First is rebuilding the file if multiple requests/responses are in the same flow Philippe Antoine

10/30/2019

09:47 AM Suricata Bug #3096: random failures on http-evader suricata-verify tests

Should we get stdout/stderr from failed run tests in Travis ?
So we can debug this flaky behavior... Philippe Antoine