Project

General

Profile

TBD

To be determined -- place holder for tickets that are not prioritized/scheduled yet

9%

479 issues   (42 closed — 437 open)

Issues by
Bug

24/157
Feature

4/242
Support

1/7
Optimization

13/48
Task

0/25
Related issues
Bug #317: Invalid Rules Actions
Bug #376: Windows - Failure when trying to get MTU Actions
Bug #437: filemagic / libmagic inconsistent between releases Actions
Bug #500: duplicate values in host-os-policy not detected Actions
Bug #551: Replace SCLogError by a counter for memory issue and other memcap Actions
Bug #569: display syntax requirement on keyword parsing error Actions
Bug #705: http.log missing lots of requests under high traffic load Actions
Bug #708: Flow vars issue in pcap file mode Actions
Bug #747: Reset async flag if stream is found to be non-async Actions
Bug #778: ipv6 addr with nat64 notation Actions
Bug #786: Windows - yaml directory paths Actions
Bug #849: Not alerting on invalid http request Content-Length Actions
Bug #868: 1.4.3: Makefile[.in] doesn't use its own INSTALL variable definition Actions
Bug #923: memcap value in suricata.yaml Actions
Bug #924: missing space between variable and value in suricata.yaml Actions
Bug #992: Different alerts reported when reading from pcap file with runmode=single and runmode=autofp Actions
Bug #1083: pfring: valgrind: Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s) Actions
Bug #1084: pfring: valgrind: memory leak at exit in bpf filter Actions
Bug #1152: Write to ipfw divert socket failed: Message too long Actions
Bug #1247: Using suppress in threshold.config does not prevent dropping Actions
Bug #1271: Creating core dump with dropped privileges Actions
Bug #1275: ET Rule 2003927 not matchin in suricata Actions
Bug #1370: sctp fp on suricata engine Actions
Bug #1382: BPF not reflected in suricata.log when using pf-ring Actions
Bug #1390: suricatasc return empty iface-stat.pkts in IPS nfqueue mode Actions
Bug #1412: byte_test checks before byte_extract happens in some cases Actions
Bug #1457: Non-standard prefixes used for file size indication Actions
Bug #1484: Remove BUG_ON(1) statements in the packet path Actions
Bug #1526: Malformed encoded base64 packet in json logs Actions
Bug #1549: flow keywords rule parsing Actions
Bug #1560: Newline in certificate subject name results in premature line break in TLS log Actions
Bug #1561: Write to ipfw divert socket failed: Permission denied rappidly followed by a fatal "[ERRCODE: SC_ERR_TM_THREADS_ERROR(136)] - thread restarts exceeded threshold limit for thread Verdict0" Actions
Bug #1567: TCP: Evasion issue Actions
Bug #1593: Negative within error - works in snort Actions
Bug #1711: Ethernet Header Missing From JSON Packet Field Actions
Bug #1722: ip rules don't trigger under the context of 'flow:stateless' Actions
Bug #1738: [ERRCODE: SC_ERR_MEM_ALLOC<1>] - Can not allocate fingerprint string - Suricata 2.0.11-1 Actions
Bug #1754: Inconsistent behavior with 'only_stream' flow keyword Actions
Bug #1770: Suricata takes very long time to start using hyperscan and large/custom detect settings Actions
Bug #1772: Inconsistent number of alerts while reading a pcap - runmode single/autofp,unix-socket Actions
Bug #1782: Unkown TLS's subject attributes Actions
Bug #1833: Transaction can be logged before stream reassembly and parsing are complete Actions
Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible) Actions
Bug #1881: pcap logging out of order Actions
Bug #1882: I don't know why the 2nd file TRUNCATED Actions
Bug #1911: Commandline provided configuration values don't persist after initial startup Actions
Bug #1922: runmodes: memory leaks Actions
Bug #1926: rule parsing: wrong content checked for fast_pattern (snort compatibility) Actions
Bug #1981: luajit states fail to run with valgrind Actions
Bug #2013: failure of TCP after DOS attack Actions
Bug #2042: Difference protocol of MD5 rule will restart Suricata automatically Actions
Bug #2056: missing warning on a rule using within with one content keyword Actions
Bug #2066: netmap/linux: can't capture packets in suricata-3.2 Actions
Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml Actions
Bug #2094: luajit: SCFlowvarGet always returns null Actions
Bug #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
Bug #2190: apparent 1000 character limit in threshold.conf IP lists Actions
Bug #2205: Buffer confusion with fast_pattern:only; Actions
Bug #2210: logging: SC_LOG_OP_FILTER still displays some lines not matching filter Actions
Bug #2220: When running on a single-CPU machine, pcap processing takes a long time Actions
Bug #2221: Suricata batch processing slowed down by 0.2s intervals Actions
Bug #2224: Negated http_* match returns false if buffer not populated Actions
Bug #2249: rule with file keyword used with ip or tcp not seen as invalid Actions
Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter Actions
Bug #2289: af-packet bpf filtering failed to select multiple vlan Actions
Bug #2305: unified2 alerts not including xff ips using extra-data mode Actions
Bug #2337: give warning if permissions won't allow log reopen after dropping privs Actions
Bug #2351: Suricata with alert-prelude option sending only one IDMEF message (not more). Actions
Bug #2355: Missing events with PF_RING 7.1.0 Actions
Bug #2358: Inconsistent DNS/flows extracted from pcap Actions
Bug #2369: option force-filestore generate truncated file Actions
Bug #2373: unix domain socket owner stays root when priviledges dropped Actions
Bug #2378: log rotation 'flag' should be atomic Actions
Bug #2386: check if default log dir is writable at start up Actions
Bug #2393: One way TLS traffic not properly identified Actions
Bug #2395: File_data inspection depth while inspecting base64 decoded data Actions
Bug #2404: Windows Installation Guide for Suricata bug Actions
Bug #2412: Suricatasc isn't showing or allowing pcap file continuous option Actions
Bug #2413: Pcap Interrupt Keeps Pcap File Processing Interrupted Actions
Bug #2423: Suricata 4.0.3 and Napatech crashing Actions
Bug #2424: suri->userid (SCInstance) does not reflect correct uid if suricata is started as non-root Actions
Bug #2429: TCP-session and wrong alert timestamp Actions
Bug #2434: memleak - possible/definite memleaks reported for libnss3 and pthread_create Actions
Bug #2458: memleak: gitmaster - 4.1.0-dev (rev c60decd) Actions
Bug #2462: memleak: gitmaster json dns logger - 4.1.0-dev (rev efdc592) Actions
Bug #2465: Eve Stats will not be reported unless stats.log is enabled Actions
Bug #2477: 802.1ah & Untagged Traffic Actions
Bug #2478: PCAP logging does not include 802.1q header when using af-packet Actions
Bug #2479: http_cookie negation fails if no cookie in traffic Actions
Bug #2494: Invalid Base64 payload for filemd5 alerts Actions
Bug #2500: stored will always equal false in fileinfo events Actions
Bug #2581: content match fails with on large streams Actions
Bug #2614: filemagic: pdf filemagic match Actions
Bug #2618: suricata 4.0.5 + pfring 7.2.0 crashes Actions
Bug #2623: Missing http.status information in eve.log according to tcp packets. Actions
Bug #2627: lua: load script from same location as rule file if not in default rule location Actions
Bug #2639: Alert for tcp rules with established without 3whs Actions
Bug #2669: make install-full fails due to being unable to find libhtp.so.2 Actions
Bug #2680: eve output filetype:unix_dgram does not start a socket Actions
Bug #2712: long wait time on exit - pcap read - unable to get all packet threads to process their packets in time Actions
Bug #2718: pkts/drops counters discrepancy Actions
Bug #2737: Invalid memory read on malformed rule with Lua script Actions
Bug #2739: Incorrect detection of the jit support of libpcre Actions
Bug #2763: different number of events on exact same runs with asan and no asan builds Actions
Bug #2795: asan leak: processing of empty pcap Actions
Bug #2796: sigabrt core Actions
Bug #2802: sigabrt core. Actions
Bug #2809: Applayer Mismatch protocol both directions for kerberos AS-REQ/KDC_ERR_PREAUTH_REQUIRED exchange Actions
Bug #2810: enabling add request/response http headers in master Actions
Bug #2815: race condition during file-magic initialization Actions
Bug #2836: signature with filemagic do not honor flowbits Actions
Bug #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN Actions
Bug #2861: Suricata rule sid:2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman) not works Actions
Bug #2881: http.protocol parsing inaccuracy Actions
Bug #2886: IMAP fail to register app layer protocol detection Actions
Bug #2891: Empty rrname in DNS answer for non-recurse NS answers Actions
Bug #2913: SIGABRT reading a pcap Actions
Bug #2917: Unable to find the sm in any of the sm lists Actions
Bug #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific Actions
Bug #2928: alerts on icmp signatures in 4.0.x and 4.1.x Actions
Bug #2933: Suricata 4.1.3 block flow Actions
Bug #2934: VLAN tags stripped when saving pcap log Actions
Bug #2954: Strange interaction with afpacket - high CPU usage and no packet processing Actions
Bug #2960: valgrind gives 'Conditional jump or move depends on uninitialised value(s)' Actions
Bug #2963: scan-build warnings for pcap logging Actions
Bug #2973: the flow after match the rules Actions
Bug #2978: IRC traffic parsed by FTP Actions
Bug #2982: invalid dsize distance rule being loaded by suricata Actions
Bug #2986: stream bypass not making callback as expected Actions
Bug #2988: redis fails sometimes to reload rules to suricata; restart of redis fixes Actions
Bug #2992: Build failure on m68k with uclibc Actions
Bug #2997: IPS AF_Packet mode and decoder invalid Actions
Bug #2998: Rules Reload doesn't work properly Actions
Bug #3026: Windows MSI - add in service scripts Actions
Bug #3040: pcap: with -r <single file> pcap_open_offline failure does not lead to non-zero exit code Actions
Bug #3041: snmp parsing error message Actions
Bug #3049: thread hangs in pfring mode Actions
Bug #3065: tls_cert_XX keywords date format parsing error Actions
Bug #3066: No documentation for hostbits Actions
Bug #3071: coverity warning in tls wrt tainted scalars Actions
Bug #3073: AC_CHECK_FILE on cross compile Actions
Bug #3075: RX thread hang in pcap-file mode Actions
Bug #3083: DROP rule with "noalert" Actions
Bug #3087: Prelude output IDMEF message issue Actions
Bug #3090: pfring compile err - openSUSE Tumbleweed , Ubuntu Eoan/ Debian unstable Actions
Bug #3093: FTP logging needs suricata-verify tests Actions
Bug #3095: default log dir not always honored - git master Actions
Bug #3096: random failures on http-evader suricata-verify tests Actions
Bug #3097: build for eBPF programs needs a way to specify Linux header location Actions
Bug #3101: Suricata not using 'default-log-dir' in YAML Actions
Bug #3103: --engine-analysis warning for flow on an icmp request rule Actions
Bug #3107: Thread counter setting ignored within affinity section Actions
Bug #3108: Calculation of threads in autofp mode is wrong Actions
Bug #3109: dcerpc engine not generating alerts Actions
Bug #3113: python-yaml dependency is actually ptyhon3-yaml dependency Actions
Bug #3117: multiple valgrind reported warnings - 5.0.0-dev (9e126b210 2019-08-07) Actions
Bug #3120: nfq_handle_packet error -1 Resource temporarily unavailable warnings Actions
Feature #120: Capture full session on alert Actions
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #352: Switching to message queuing system for output Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #548: Use bloomfilter for filemd5 Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #614: Rate limiting messages Actions
Feature #641: Flowbits group for ORing Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #660: Update host policy from unix socket Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #713: tls.fingerprint - file usage Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #721: full nfq zero copy mode Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #808: Support the new GSO-avoidance NFQ feature Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: Conditional logging Actions
Feature #843: Custom http logging filter functionality Actions
Feature #845: Memory consumption in stats.log Actions
Feature #870: luajit: global vars Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #947: dynamic allocation of thread queues Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1005: conditional logging Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1017: Add support for content-range Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1096: Log TLS client certificate Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1199: LDAP support Actions
Feature #1215: journald logging support Actions
Feature #1229: Suricata alerts in CEF Format Actions
Feature #1233: Documentation for each keyword in stats.log file. Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1249: http/dns ip-reputation alike technique Actions
Feature #1250: Multipath TCP Actions
Feature #1274: ssh events Actions
Feature #1283: support for snort's file_data keyword Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1478: Active flow counters Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: better notification in verbose mode on luascript err Actions
Feature #1505: Show loaded lua scripts during live rule swap or normal start in verbose mode Actions
Feature #1520: multitenancy - verbose output clarity Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1542: dump-config - extend into multi-detect supplied yaml configuration Actions
Feature #1545: Add type variable into StatsRecord Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1576: http: byte-range support Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1691: Docs: Convert windows docs Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1726: pfring: IPS support Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1757: URL Reputation Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1828: YARA support Actions
Feature #1851: add verbosity level description to the help command Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1892: rule docs should include example rules Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1940: Debian Jessie - better message when trying to run 2 suricata with afpacket Actions
Feature #1947: HTTP2 decoder Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1971: lua: make mandatory Actions
Feature #1974: DNP3: document lua support Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1993: commandline: introduce --enable-all-outputs switch Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2016: doc: improve keywords self documentation Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2054: Extracting HTTPS URL´s from SMTP, currently only HTTP is supported Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2096: eve: event_type for MODBUS Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2127: Rate Limiting by Tracking Both Source & Destination IP Addresses Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2167: eve-ng Actions
Feature #2168: Rules files from Suricata sources (like decoder-events.rules) are packaged as config files and may not be updated on package update. Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2196: Add flow_id to the file extracted .meta file Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2200: Dynamically add md5 to blacklist without full restart Actions
Feature #2211: doc: document issues with --set and lists in the command line parameters section of the manual Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2219: Save pcap only if alert Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2284: detect partial file transfers Actions
Feature #2286: doc: document best practices around handling file extraction Actions
Feature #2290: lua: expose lua generated buffers to rule lang Actions
Feature #2300: DPDK integration Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2311: math on extracted values Actions
Feature #2312: http: parsing for async streams Actions
Feature #2313: save & restore state when suricata restarts Actions
Feature #2314: protocol parser: rdp Actions
Feature #2316: global memcap Actions
Feature #2318: matching on large amounts of data with dynamic updates Actions
Feature #2319: Expose flow lifetime to the rulelanguage Actions
Feature #2323: Applayer support for telnet Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2363: pcap: read directories recursively Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2375: Design and implement sensible per-thread capabilities Actions
Feature #2377: deprecate: ssh.softwareversion and ssh.protoversion Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2385: deprecate: unified2 Actions
Feature #2388: smtp: log md5 of attachments Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2448: Add additional buffers for DNS Responses Actions
Feature #2450: lua scripts access to calling rule informations Actions
Feature #2486: prefilter/fast_pattern logic for flowbits Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2524: Allow user to choose the reject iface Actions
Feature #2529: doc: include quick start guide Actions
Feature #2538: dsize keyword improvements Actions
Feature #2553: support 'by_both' in threshold rule keyword Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2644: Add direction of stream to eve-json events Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2689: Normalized HTTP client body buffer Actions
Feature #2693: libsuricata Actions
Feature #2694: thresholding: feature parity between global and per-rule options Actions
Feature #2695: websocket support Actions
Feature #2696: http parser in rust Actions
Feature #2697: prefilter support for stream_size Actions
Feature #2698: hassh and hasshServer for ssh fingerprinting Actions
Feature #2699: document all eve record types and fields Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2754: JA3 and JA3S - sets / reputation Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules input in json format Actions
Feature #2757: improve protocol detection Actions
Feature #2758: intel / reputation matching on arbitrary data Actions
Feature #2759: iprep: more granularity Actions
Feature #2764: dns logging v1 vs v2 Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2789: Use clang for building eBPF programs even if Suricata is built using GCC Actions
Feature #2816: vlan: support more than 2 layers Actions
Feature #2818: Napatech Bypass support Actions
Feature #2859: Oss-fuzz integration Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: Exposing byte extract to Lua Actions
Feature #2876: doc: add nftables with nfqueue section Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2958: Suricata 5.0.0beta1 and way too much anomaly logging Actions
Feature #2962: Suricata x Moloch - protocol detection. Proposals for IKEv2 Actions
Feature #2964: Near real time flow log Actions
Feature #2970: DNS: Parse and extract SOA app layer data from DNS packets Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3003: filestore to uses rename syscall instead of sendfile,which doesn't allow files to be sent across file systems Actions
Feature #3011: Add new 'cluster_peer' runmode to allow for load balancing by IP header (src<->dst) only Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3063: protocol decoder: geneve Actions
Feature #3084: SIP parser, logging and detection Actions
Feature #3086: app_proto for Torrent traffic? Actions
Feature #3105: Add kafka output Actions
Support #2322: create place for easy sharing of test cases Actions
Support #2470: Suricata does not always alert on traffic with content that matches rules Actions
Support #2640: http-body and http-body-printable in eve-log require metadata to be enabled, yet there is no indication of this anywhere Actions
Support #2656: Alerts not triggered under some conditions on traffic containing rule matches Actions
Support #2685: SuriCon 2018 brainstorm Actions
Support #2845: Counters for kernel_packets decreases at times without restart Actions
Support #3037: The rules detect order Actions
Optimization #426: sid based thresholding data structure improvement Actions
Optimization #536: share ctx for filemd5 keyword if identical files are used Actions
Optimization #570: memory fragmentation Actions
Optimization #595: document csum keywords Actions
Optimization #749: pcre 8.32 introduces JIT pcre_jit_exec(...) Actions
Optimization #795: stream: use pool instead of direct SACK record allocs Actions
Optimization #945: remove useless includes Actions
Optimization #1020: 1.4.6: sc_log_config->op_filter not filled in Actions
Optimization #1038: Flow Queue should be a stack Actions
Optimization #1094: Special check for first character of buffer Actions
Optimization #1188: Don't use iface name in GetIfaceMaxHWHeaderLength Actions
Optimization #1218: BoyerMooreNocase could avoid tolower() call Actions
Optimization #1220: Boyer Moore SPM pass in ctx instead of indivual bmBc and bmBg Actions
Optimization #1222: Boyer Moore content not shared between same content Actions
Optimization #1313: All Free functions should correctly handle NULL pointers Actions
Optimization #1595: Suricata starts in known conditions of no data Actions
Optimization #1718: Time stamp in Log files should be ISO 8601 format Actions
Optimization #1749: Log PACKET_DROP in inline mode for invalid states as well Actions
Optimization #1791: Kernel Drops: Thread occasionally Spike to 100% Actions
Optimization #2266: no documentation for file-store-waldo Actions
Optimization #2272: Analyze DNS response if query is not present Actions
Optimization #2317: rcu Actions
Optimization #2321: yaml: clean up usage of lists Actions
Optimization #2405: Use FileTruncateAllOpenFiles for every app layer protocol Actions
Optimization #2460: Reduce timeout in unix-socket when multiple pcaps are enqueued Actions
Optimization #2582: document flags keyword Actions
Optimization #2584: document tag keyword Actions
Optimization #2585: document replace keyword Actions
Optimization #2586: document flowvar keyword Actions
Optimization #2587: document pktvar keyword Actions
Optimization #2589: document decode-event Actions
Optimization #2590: document nfq_set_mark keyword Actions
Optimization #2593: document pkt_data keyword Actions
Optimization #2594: document dce keywords Actions
Optimization #2595: document asn1 keyword Actions
Optimization #2596: document engine-event keyword Actions
Optimization #2597: document stream-event keyword Actions
Optimization #2598: document l3_proto keyword Actions
Optimization #2599: document base64 keywords Actions
Optimization #2620: Documentation: tagged_packets / event_type packet Actions
Optimization #2687: current suricata.yaml is missing rotate-interval "example" Actions
Optimization #2750: document nfs-keywords Actions
Optimization #2780: Convert DNP3 from C to Rust Actions
Optimization #2781: Convert ENIP from C to Rust Actions
Optimization #2782: Convert Modbus from C to Rust Actions
Optimization #2977: replace asn1 parser with rust based implementation Actions
Optimization #2979: replace mime decoder with rust based implementation Actions
Optimization #3039: configure: don't generate warnings on missing features Actions
Task #2278: tracking: failing better Actions
Task #2381: deprecate: 'drop' log output Actions
Task #2588: document hostbits keyword Actions
Task #2778: Protocol Parsing Rust Conversion Tracking Actions
Task #2959: deprecate: filestore v1 Actions
Task #2975: convert unittests to new FAIL/PASS API Actions
Task #3014: Missing documentation for "flags" option Actions
Task #3015: Missing documentation for "tag" keyword Actions
Task #3016: No documentation for "endswith" keyword Actions
Task #3017: No documentation for "rawbytes" keyword Actions
Task #3018: No documentation for "flowvar" keyword Actions
Task #3019: No documentation for "pktvar" keyword Actions
Task #3022: No documentation for "nfq_set_mark" keyword Actions
Task #3023: No documentation for "bsize" keyword Actions
Task #3025: Missing docs for "http." keywords Actions
Task #3027: No documentation for "nfs" keywords Actions
Task #3028: No documentation for "pkt_data" keyword Actions
Task #3029: No documentation for "dcerpc" keywords Actions
Task #3030: No documentation for "smb" keywords Actions
Task #3031: No documentation for "asn1" keyword Actions
Task #3032: No documentation for "engine-event" keyword Actions
Task #3033: No documentation for "stream-event" keyword Actions
Task #3034: No documentation for "l3_proto" keyword Actions
Task #3035: No docs for "base64_" keywords Actions
Task #3036: No documentation for "template2" keyword Actions