Open Information Security Foundation

03/21/2024

03:04 PM Suricata Feature #6379: JA4 support for TLS and QUIC

I agree that these data should also be in the TLS and QUIC EVE metadata; very useful and also currently IIRC not cons... Sascha Steinbiss

12/31/2023

12:11 PM Suricata Feature #6296: smtp: BDAT chunking support incl MIME parsing

I would also like to offer my assistance getting your contributions into Suricata, if there are still questions. Feel... Sascha Steinbiss

11/28/2023

07:23 PM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Philippe Antoine wrote in #note-22:
> Thank you Sascha
>
> > Not really an improvement for us if drops are repla... Sascha Steinbiss

11/18/2023

11:49 AM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Ah, there's one more question... Thanks Philippe for getting into the details with us!
> Do you know if it is as i... Sascha Steinbiss

11:13 AM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Philippe Antoine wrote in #note-22:
> Thank you Sascha
>
> > Not really an improvement for us if drops are replaced... Sascha Steinbiss

11/15/2023

06:32 PM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Philippe Antoine wrote in #note-19:
> > However, it also does this for the public test file: https://github.com/bro/... Sascha Steinbiss

06:30 PM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Philippe Antoine wrote in #note-17:
> So, looks better.
Not sure, are packets that are "invalid" inspected? Not rea... Sascha Steinbiss

11/13/2023

04:48 PM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Switching to that patch changed the situation in a way that now the package drops (@capture.kernel_drop@) do not star... Sascha Steinbiss

11/10/2023

02:20 PM Suricata Bug #6394: Sudden increase in capture.kernel_drops and tcp.pkt_on_wrong_thread after upgrading to 6.0.14

Philippe Antoine wrote in #note-12:
> @satta could you try a patched Suricata which handles better the footer ?
> h... Sascha Steinbiss

11/09/2023

11:27 AM Suricata Documentation #2699: document all eve record types and fields

My feeling is BTW that the stuff we did for Suricon 2019 is probably obsolete:
* There now is an official JSON sch... Sascha Steinbiss