Open Information Security Foundation

06/25/2026

JL 11:38 AM Suricata Feature #8671 (Closed): detect/transforms: support inline variable-key extraction (var <nbytes> <offset>)

Merged in https://github.com/OISF/suricata/pull/15699 Jeff Lucovsky

06/20/2026

JL 02:02 PM Suricata Feature #8671 (In Progress): detect/transforms: support inline variable-key extraction (var <nbytes> <offset>)

Jeff Lucovsky

06/19/2026

JL 02:26 PM Suricata Feature #8671 (Closed): detect/transforms: support inline variable-key extraction (var <nbytes> <offset>)

Spun off from #7847.
#7847 asks for byte_extract variables to be usable as input to the xor
transform (and later other keywords). That approach requires engine-core
changes, because transforms execute before byte_extract variables ... Jeff Lucovsky

06/05/2026

JL 01:55 PM Suricata Optimization #7849 (In Review): rule 2200121 : SURICATA Ethertype unknown

https://github.com/OISF/suricata/pull/15569 Jeff Lucovsky

JL 01:55 PM Suricata Bug #8142 (In Review): Unknown ethertype event logs outer header ethertype instead of unrecognized ethertype in inner header

https://github.com/OISF/suricata/pull/15569 Jeff Lucovsky

JL 01:17 PM Suricata Bug #8142 (In Progress): Unknown ethertype event logs outer header ethertype instead of unrecognized ethertype in inner header

Jeff Lucovsky

06/04/2026

JL 02:29 PM Suricata Optimization #7849 (In Progress): rule 2200121 : SURICATA Ethertype unknown

Jeff Lucovsky

05/29/2026

JL 12:16 PM Suricata Optimization #7849: rule 2200121 : SURICATA Ethertype unknown

> Is it possible that in the future this alert will also indicate the affected protocol number?
Are you asking for the unknown ethertype value to be displayed? Jeff Lucovsky

05/16/2026

JL 02:28 PM Suricata Task #6476 (Closed): ftp: parity of logging and detection buffers

Jeff Lucovsky

JL 02:27 PM Suricata Task #6476: ftp: parity of logging and detection buffers

There are no more specific ftp detection keyword tickets. Jeff Lucovsky