Project

General

Profile

TBD

To be determined -- place holder for tickets that are not prioritized/scheduled yet

2%

370 issues   (5 closed — 365 open)

Issues by
Bug

2/107
Feature

3/214
Support

0/4
Optimization

0/44
Task

0/1
Related issues
Bug #317: Invalid Rules Actions
Bug #376: Windows - Failure when trying to get MTU Actions
Bug #437: filemagic / libmagic inconsistent between releases Actions
Bug #500: duplicate values in host-os-policy not detected Actions
Bug #569: display syntax requirement on keyword parsing error Actions
Bug #705: http.log missing lots of requests under high traffic load Actions
Bug #708: Flow vars issue in pcap file mode Actions
Bug #747: Reset async flag if stream is found to be non-async Actions
Bug #778: ipv6 addr with nat64 notation Actions
Bug #786: Windows - yaml directory paths Actions
Bug #849: Not alerting on invalid http request Content-Length Actions
Bug #868: 1.4.3: Makefile[.in] doesn't use its own INSTALL variable definition Actions
Bug #923: memcap value in suricata.yaml Actions
Bug #924: missing space between variable and value in suricata.yaml Actions
Bug #992: Different alerts reported when reading from pcap file with runmode=single and runmode=autofp Actions
Bug #1013: command line parsing Actions
Bug #1020: 1.4.6: sc_log_config->op_filter not filled in Actions
Bug #1083: pfring: valgrind: Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s) Actions
Bug #1084: pfring: valgrind: memory leak at exit in bpf filter Actions
Bug #1152: Write to ipfw divert socket failed: Message too long Actions
Bug #1247: Using suppress in threshold.config does not prevent dropping Actions
Bug #1271: Creating core dump with dropped privileges Actions
Bug #1275: ET Rule 2003927 not matchin in suricata Actions
Bug #1324: vlan tag in eve.json Actions
Bug #1370: sctp fp on suricata engine Actions
Bug #1382: BPF not reflected in suricata.log when using pf-ring Actions
Bug #1390: suricatasc return empty iface-stat.pkts in IPS nfqueue mode Actions
Bug #1412: byte_test checks before byte_extract happens in some cases Actions
Bug #1427: configure with libnss and libnspr Actions
Bug #1457: Non-standard prefixes used for file size indication Actions
Bug #1504: better notification in verbose mode on luascript err Actions
Bug #1526: Malformed encoded base64 packet in json logs Actions
Bug #1549: flow keywords rule parsing Actions
Bug #1560: Newline in certificate subject name results in premature line break in TLS log Actions
Bug #1561: Write to ipfw divert socket failed: Permission denied rappidly followed by a fatal "[ERRCODE: SC_ERR_TM_THREADS_ERROR(136)] - thread restarts exceeded threshold limit for thread Verdict0" Actions
Bug #1567: TCP: Evasion issue Actions
Bug #1593: Negative within error - works in snort Actions
Bug #1711: Ethernet Header Missing From JSON Packet Field Actions
Bug #1722: ip rules don't trigger under the context of 'flow:stateless' Actions
Bug #1738: [ERRCODE: SC_ERR_MEM_ALLOC<1>] - Can not allocate fingerprint string - Suricata 2.0.11-1 Actions
Bug #1754: Inconsistent behavior with 'only_stream' flow keyword Actions
Bug #1770: Suricata takes very long time to start using hyperscan and large/custom detect settings Actions
Bug #1772: Inconsistent number of alerts while reading a pcap - runmode single/autofp,unix-socket Actions
Bug #1782: Unkown TLS's subject attributes Actions
Bug #1833: Transaction can be logged before stream reassembly and parsing are complete Actions
Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible) Actions
Bug #1881: pcap logging out of order Actions
Bug #1882: I don't know why the 2nd file TRUNCATED Actions
Bug #1900: Field http.hostname not being parsed out correctly. Actions
Bug #1911: Commandline provided configuration values don't persist after initial startup Actions
Bug #1922: runmodes: memory leaks Actions
Bug #1926: rule parsing: wrong content checked for fast_pattern (snort compatibility) Actions
Bug #1981: luajit states fail to run with valgrind Actions
Bug #2013: failure of TCP after DOS attack Actions
Bug #2042: Difference protocol of MD5 rule will restart Suricata automatically Actions
Bug #2056: missing warning on a rule using within with one content keyword Actions
Bug #2066: netmap/linux: can't capture packets in suricata-3.2 Actions
Bug #2080: Rules with bad port group var do not error Actions
Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml Actions
Bug #2094: luajit: SCFlowvarGet always returns null Actions
Bug #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
Bug #2190: apparent 1000 character limit in threshold.conf IP lists Actions
Bug #2205: Buffer confusion with fast_pattern:only; Actions
Bug #2210: logging: SC_LOG_OP_FILTER still displays some lines not matching filter Actions
Bug #2220: When running on a single-CPU machine, pcap processing takes a long time Actions
Bug #2221: Suricata batch processing slowed down by 0.2s intervals Actions
Bug #2224: Negated http_* match returns false if buffer not populated Actions
Bug #2249: rule with file keyword used with ip or tcp not seen as invalid Actions
Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter Actions
Bug #2264: file-store.stream-depth not working as expected when configured to a specfic value Actions
Bug #2289: af-packet bpf filtering failed to select multiple vlan Actions
Bug #2305: unified2 alerts not including xff ips using extra-data mode Actions
Bug #2321: yaml: clean up usage of lists Actions
Bug #2351: Suricata with alert-prelude option sending only one IDMEF message (not more). Actions
Bug #2358: Inconsistent DNS/flows extracted from pcap Actions
Bug #2369: option force-filestore generate truncated file Actions
Bug #2373: unix domain socket owner stays root when priviledges dropped Actions
Bug #2378: log rotation 'flag' should be atomic Actions
Bug #2386: check if default log dir is writable at start up Actions
Bug #2393: One way TLS traffic not properly identified Actions
Bug #2395: File_data inspection depth while inspecting base64 decoded data Actions
Bug #2404: Windows Installation Guide for Suricata bug Actions
Bug #2412: Suricatasc isn't showing or allowing pcap file continuous option Actions
Bug #2413: Pcap Interrupt Keeps Pcap File Processing Interrupted Actions
Bug #2423: Suricata 4.0.3 and Napatech crashing Actions
Bug #2424: suri->userid (SCInstance) does not reflect correct uid if suricata is started as non-root Actions
Bug #2428: suricata.log file permission error message when using suricata -l <dir> -r x.pcap as unprivilegded user Actions
Bug #2429: TCP-session and wrong alert timestamp Actions
Bug #2434: memleak - possible/definite memleaks reported for libnss3 and pthread_create Actions
Bug #2435: Suricata 4.0.3 in IPS mode seems to discard some DNS requests Actions
Bug #2458: memleak: gitmaster - 4.1.0-dev (rev c60decd) Actions
Bug #2462: memleak: gitmaster json dns logger - 4.1.0-dev (rev efdc592) Actions
Bug #2465: Eve Stats will not be reported unless stats.log is enabled Actions
Bug #2474: Not found the function of parser the dyn_port when in FTP active mode Actions
Bug #2477: 802.1ah & Untagged Traffic Actions
Bug #2478: PCAP logging does not include 802.1q header when using af-packet Actions
Bug #2479: http_cookie negation fails if no cookie in traffic Actions
Bug #2490: Filehash rule does not fire without filestore keyword Actions
Bug #2494: Invalid Base64 payload for filemd5 alerts Actions
Bug #2495: Stream depth and filestore interaction Actions
Bug #2500: stored will always equal false in fileinfo events Actions
Bug #2744: --list-keywords complains about missing yaml Actions
Bug #2795: asan leak: processing of empty pcap Actions
Bug #2802: sigabrt core. Actions
Bug #2815: race condition during file-magic initialization Actions
Bug #2836: signature with filemagic do not honor flowbits Actions
Bug #2838: 4.1.x gcc 9 compilation warnings Actions
Feature #120: Capture full session on alert Actions
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #352: Switching to message queuing system for output Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification Actions
Feature #524: detect double encoding in URI Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #548: Use bloomfilter for filemd5 Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #614: Rate limiting messages Actions
Feature #641: Flowbits group for ORing Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #660: Update host policy from unix socket Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #713: tls.fingerprint - file usage Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #721: full nfq zero copy mode Actions
Feature #728: Add support for OpenCL Actions
Feature #731: generic streaming parser api Actions
Feature #745: Tunnel configuration Actions
Feature #776: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #808: Support the new GSO-avoidance NFQ feature Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: Conditional logging Actions
Feature #843: Custom http logging filter functionality Actions
Feature #845: Memory consumption in stats.log Actions
Feature #870: luajit: global vars Actions
Feature #886: bromagic support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #947: dynamic allocation of thread queues Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1005: conditional logging Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1017: Add support for content-range Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1088: Detect virtual machines during build/start Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1096: Log TLS client certificate Actions
Feature #1099: keyword: file_name keyword Actions
Feature #1100: keyword: file_ext keyword Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1199: LDAP support Actions
Feature #1215: journald logging support Actions
Feature #1229: Suricata alerts in CEF Format Actions
Feature #1233: Documentation for each keyword in stats.log file. Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1249: http/dns ip-reputation alike technique Actions
Feature #1250: Multipath TCP Actions
Feature #1274: ssh events Actions
Feature #1283: support for snort's file_data keyword Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1478: Active flow counters Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1505: Show loaded lua scripts during live rule swap or normal start in verbose mode Actions
Feature #1520: multitenancy - verbose output clarity Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
Feature #1545: Add type variable into StatsRecord Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1576: http: byte-range support Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1691: Docs: Convert windows docs Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1726: pfring: IPS support Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1757: URL Reputation Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1828: YARA support Actions
Feature #1851: add verbosity level description to the help command Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1892: rule docs should include example rules Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1940: Debian Jessie - better message when trying to run 2 suricata with afpacket Actions
Feature #1947: HTTP2 decoder Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1971: lua: make mandatory Actions
Feature #1974: DNP3: document lua support Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1993: commandline: introduce --enable-all-outputs switch Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2015: eve: add fileinfo in alert Actions
Feature #2016: doc: improve keywords self documentation Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2096: eve: event_type for MODBUS Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2127: Rate Limiting by Tracking Both Source & Destination IP Addresses Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2167: eve-ng Actions
Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update. Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2196: Add flow_id to the file extracted .meta file Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2200: Dynamically add md5 to blacklist without full restart Actions
Feature #2211: doc: document issues with --set and lists in the command line parameters section of the manual Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2219: Save pcap only if alert Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2278: failing better Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2284: detect partial file transfers Actions
Feature #2286: doc: document best practices around handling file extraction Actions
Feature #2290: lua: expose lua generated buffers to rule lang Actions
Feature #2300: DPDK integration Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2311: math on extracted values Actions
Feature #2312: http: parsing for async streams Actions
Feature #2313: save & restore state when suricata restarts Actions
Feature #2314: protocol parser: rdp Actions
Feature #2316: global memcap Actions
Feature #2318: matching on large amounts of data with dynamic updates Actions
Feature #2319: Expose flow lifetime to the rulelanguage Actions
Feature #2323: Applayer support for telnet Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2363: pcap: read directories recursively Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2375: Design and implement sensible per-thread capabilities Actions
Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2385: deprecate: unified2 Actions
Feature #2388: smtp: log md5 of attachments Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2421: Warn user if -r (pcap offline mode) is used with default log dir Actions
Feature #2426: tls: extend logging Actions
Feature #2448: Add additional buffers for DNS Responses Actions
Feature #2450: lua scripts access to calling rule informations Actions
Feature #2485: http: log byte range with file extraction Actions
Feature #2486: prefilter/fast_pattern logic for flowbits Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2524: Allow user to choose the reject iface Actions
Feature #2529: doc: include quick start guide Actions
Feature #2538: dsize keyword improvements Actions
Feature #2539: protocol parser: vxlan Actions
Feature #2553: support 'by_both' in threshold rule keyword Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2670: tls_cert sticky buffer Actions
Feature #2693: libsuricata Actions
Feature #2694: thresholding: feature parity between global and per-rule options Actions
Feature #2695: websocket support Actions
Feature #2696: http parser in rust Actions
Feature #2697: prefilter support for stream_size Actions
Feature #2698: hassh and hasshServer for ssh fingerprinting Actions
Feature #2699: document all eve record types and fields Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2754: JA3 and JA3S - sets / reputation Actions
Feature #2756: rules input in json format Actions
Feature #2758: intel / reputation matching on arbitrary data Actions
Feature #2759: iprep: more granularity Actions
Feature #2766: Simplified Napatech Configuration Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2871: Exposing byte extract to Lua Actions
Feature #2876: doc: add nftables with nfqueue section Actions
Support #2322: create place for easy sharing of test cases Actions
Support #2453: Big flows are splitted Actions
Support #2470: Suricata does not always alert on traffic with content that matches rules Actions
Support #2845: Counters for kernel_packets decreases at times without restart Actions
Optimization #426: sid based thresholding data structure improvement Actions
Optimization #536: share ctx for filemd5 keyword if identical files are used Actions
Optimization #570: memory fragmentation Actions
Optimization #595: document csum keywords Actions
Optimization #749: pcre 8.32 introduces JIT pcre_jit_exec(...) Actions
Optimization #795: stream: use pool instead of direct SACK record allocs Actions
Optimization #879: update configure.ac with autoupdate Actions
Optimization #945: remove useless includes Actions
Optimization #1038: Flow Queue should be a stack Actions
Optimization #1094: Special check for first character of buffer Actions
Optimization #1188: Don't use iface name in GetIfaceMaxHWHeaderLength Actions
Optimization #1218: BoyerMooreNocase could avoid tolower() call Actions
Optimization #1220: Boyer Moore SPM pass in ctx instead of indivual bmBc and bmBg Actions
Optimization #1222: Boyer Moore content not shared between same content Actions
Optimization #1313: All Free functions should correctly handle NULL pointers Actions
Optimization #1322: Flow Spare Queue should be a stack Actions
Optimization #1718: Time stamp in Log files should be ISO 8601 format Actions
Optimization #1791: Kernel Drops: Thread occasionally Spike to 100% Actions
Optimization #2266: no documentation for file-store-waldo Actions
Optimization #2272: Analyze DNS response if query is not present Actions
Optimization #2317: rcu Actions
Optimization #2405: Use FileTruncateAllOpenFiles for every app layer protocol Actions
Optimization #2460: Reduce timeout in unix-socket when multiple pcaps are enqueued Actions
Optimization #2582: document flags keyword Actions
Optimization #2584: document tag keyword Actions
Optimization #2585: document replace keyword Actions
Optimization #2586: document flowvar keyword Actions
Optimization #2587: document pktvar keyword Actions
Optimization #2588: document hostbits keyword Actions
Optimization #2589: document decode-event Actions
Optimization #2590: document nfq_set_mark keyword Actions
Optimization #2593: document pkt_data keyword Actions
Optimization #2594: document dce keywords Actions
Optimization #2595: document asn1 keyword Actions
Optimization #2596: document engine-event keyword Actions
Optimization #2597: document stream-event keyword Actions
Optimization #2598: document l3_proto keyword Actions
Optimization #2599: document base64 keywords Actions
Optimization #2620: Documentation: tagged_packets / event_type packet Actions
Optimization #2750: document nfs-keywords Actions
Optimization #2780: Convert DNP3 from C to Rust Actions
Optimization #2781: Convert ENIP from C to Rust Actions
Optimization #2782: Convert Modbus from C to Rust Actions
Optimization #2848: Rule reload when run with -s or -S arguments Actions
Task #2381: deprecate: 'drop' log output Actions