Open Information Security Foundation

11/03/2020

07:14 PM Suricata Bug #4107 (Feedback): Coredump with async-oneside: true enabled in suricata.yaml.

We have observed multiple core dumps when the async-oneside feature is enabled.
Process 58708 (Suricata-Main) of ... Cooper Nelson

07:07 PM Suricata Bug #4106 (Closed): Duplicate TLS subjects in tls metadata.

We are seeing the tls subject duplicated in tls metadata associated with EVE suricata alerts.
The subject is not d... Cooper Nelson

06/10/2020

05:28 PM Suricata Optimization #2725: stream/packet on wrong thread

At this point it might make sense to have the devs cook up a git branch that will dump the relevant packets from both... Cooper Nelson

04/20/2020

09:02 PM Suricata Optimization #2725: stream/packet on wrong thread

Peter Manev wrote in #note-116:
> Yes, they come back "clean" :)
>
That is very interesting, I wonder if enabli... Cooper Nelson

03/11/2020

03:51 PM Suricata Optimization #2725: stream/packet on wrong thread

Peter Manev wrote in #note-109:
>
> Can you try something similar for a test?
No sorry, I'm on an old Piledrive... Cooper Nelson

03/04/2020

11:18 PM Suricata Optimization #2725: stream/packet on wrong thread

Hi Peter,
My theory is that even with 1 RSS queue and hashing disabled, the 'sdfn' RX hash is *still* generated in... Cooper Nelson

02/25/2020

08:58 PM Suricata Feature #3319: on 'wrong thread' reinject packets to correct thread

Actually, thinking about I think this could work with minimal performance impact or packet re-ordering if the check w... Cooper Nelson

04:03 PM Suricata Feature #3319: on 'wrong thread' reinject packets to correct thread

Andreas Herz wrote in #note-2:
> It would be also helpful to have some sort of verbose logging for that to find out ... Cooper Nelson

08:42 PM Suricata Optimization #2725: stream/packet on wrong thread

@Peter Manev
Hey Peter, could you do me a favor on your test rig?
Could you run a test with 'sdfn' flow hashing... Cooper Nelson

03:42 PM Suricata Optimization #2725: stream/packet on wrong thread

Michal Purzynski wrote in #note-101:
>
> What I do not understand is why I'm getting packets on the wrong thread w... Cooper Nelson