Project

General

Profile

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

27%

1140 issues   (300 closed — 840 open)

Issues by
Bug

167/345
Feature

53/435
Support

2/2
Optimization

34/136
Task

16/119
Documentation

28/101
Security

0/2
Related issues
JT Bug #317: Invalid Rules Actions
CT Bug #376: Windows - Failure when trying to get MTU Actions
CT Bug #437: filemagic / libmagic inconsistent between releases Actions
OD Bug #705: http.log missing lots of requests under high traffic load Actions
OD Bug #708: Flow vars issue in pcap file mode Actions
OD Bug #747: Reset async flag if stream is found to be non-async Actions
OD Bug #778: ipv6 addr with nat64 notation Actions
CT Bug #786: Windows - yaml directory paths Actions
OD Bug #849: Not alerting on invalid http request Content-Length Actions
CT Bug #868: Makefile[.in] doesn't use its own INSTALL variable definition Actions
OD Bug #924: missing space between variable and value in suricata.yaml Actions
OD Bug #992: Different alerts reported when reading from pcap file with runmode=single and runmode=autofp Actions
CT Bug #1083: pfring: valgrind: Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s) Actions
CT Bug #1084: pfring: valgrind: memory leak at exit in bpf filter Actions
CT Bug #1152: Write to ipfw divert socket failed: Message too long Actions
CT Bug #1382: BPF not reflected in suricata.log when using pf-ring Actions
CT Bug #1390: suricatasc return empty iface-stat.pkts in IPS nfqueue mode Actions
OD Bug #1526: Malformed encoded base64 packet in json logs Actions
CT Bug #1549: flow keywords rule parsing Actions
MK Bug #1560: Newline in certificate subject name results in premature line break in TLS log Actions
OD Bug #1593: Negative within error - works in snort Actions
CT Bug #1738: [ERRCODE: SC_ERR_MEM_ALLOC<1>] - Can not allocate fingerprint string - Suricata 2.0.11-1 Actions
OD Bug #1754: Inconsistent behavior with 'only_stream' flow keyword Actions
OD Bug #1772: Inconsistent number of alerts while reading a pcap - runmode single/autofp,unix-socket Actions
MK Bug #1782: Unkown TLS's subject attributes Actions
OD Bug #1833: Transaction can be logged before stream reassembly and parsing are complete Actions
OD Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible) Actions
OD Bug #1881: pcap logging out of order Actions
JI Bug #1911: Commandline provided configuration values don't persist after initial startup Actions
CT Bug #1918: Incorrect packet stats in pcap and pf_ring capture modes Actions
CT Bug #1922: runmodes: memory leaks Actions
CT Bug #1976: ioctl warnings at startup and shutdown with dropped privileges Actions
CT Bug #1981: luajit states fail to run with valgrind Actions
CT Bug #2013: failure of TCP after DOS attack Actions
CT Bug #2042: Difference protocol of MD5 rule will restart Suricata automatically Actions
OD Bug #2056: missing warning on a rule using within with one content keyword Actions
OD Bug #2069: eve: payload may not represent traffic the generated alert Actions
OD Bug #2094: luajit: SCFlowvarGet always returns null Actions
OD Bug #2249: rule with file keyword used with ip or tcp not seen as invalid Actions
OD Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter Actions
EL Bug #2289: af-packet bpf filtering failed to select multiple vlan Actions
CT Bug #2296: Unix Manager Should Not Use Conf Functions to Pass Information to source-pcap-file Actions
CT Bug #2305: unified2 alerts not including xff ips using extra-data mode Actions
CT Bug #2351: Suricata with alert-prelude option sending only one IDMEF message (not more). Actions
PA Bug #2358: Inconsistent DNS/flows extracted from pcap Actions
CT Bug #2378: log rotation 'flag' should be atomic Actions
MK Bug #2393: One way TLS traffic not properly identified Actions
DB Bug #2412: Suricatasc isn't showing or allowing pcap file continuous option Actions
DB Bug #2413: Pcap Interrupt Keeps Pcap File Processing Interrupted Actions
PY Bug #2423: Suricata 4.0.3 and Napatech crashing Actions
CT Bug #2424: suri->userid (SCInstance) does not reflect correct uid if suricata is started as non-root Actions
OD Bug #2429: TCP-session and wrong alert timestamp Actions
OD Bug #2434: memleak - possible/definite memleaks reported for libnss3 and pthread_create Actions
PM Bug #2462: memleak: gitmaster json dns logger - 4.1.0-dev (rev efdc592) Actions
OD Bug #2477: 802.1ah & Untagged Traffic Actions
OD Bug #2479: http_cookie negation fails if no cookie in traffic Actions
OD Bug #2494: Invalid Base64 payload for filemd5 alerts Actions
EB Bug #2500: stored will always equal false in fileinfo events Actions
CT Bug #2581: content match fails with on large streams Actions
PM Bug #2614: filemagic: pdf filemagic match Actions
VJ Bug #2623: Missing http.status information in eve.log according to tcp packets. Actions
OD Bug #2656: Alerts not triggered under some conditions on traffic containing rule matches Actions
OD Bug #2680: eve output filetype:unix_dgram does not start a socket Actions
OD Bug #2712: long wait time on exit - pcap read - unable to get all packet threads to process their packets in time Actions
OD Bug #2718: pkts/drops counters discrepancy Actions
CT Bug #2739: Incorrect detection of the jit support of libpcre Actions
OD Bug #2763: different number of events on exact same runs with asan and no asan builds Actions
JI Bug #2807: DNS LUA Logging does not have any way to log NXDOMAIN Actions
CT Bug #2814: suricatasc: hangs indefinitely and uses too much processing for pcap-file-continuos command Actions
MB Bug #2815: race condition during file-magic initialization Actions
PC Bug #2861: Suricata rule sid:2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman) not works Actions
JI Bug #2891: Empty rrname in DNS answer for non-recurse NS answers Actions
OD Bug #2928: alerts on icmp signatures in 4.0.x and 4.1.x Actions
CT Bug #2933: Suricata 4.1.3 block flow Actions
OD Bug #2934: VLAN tags stripped when saving pcap log Actions
CT Bug #2954: Strange interaction with afpacket - high CPU usage and no packet processing Actions
OD Bug #2960: valgrind gives 'Conditional jump or move depends on uninitialised value(s)' Actions
JS Bug #2973: the flow after match the rules Actions
CT Bug #2988: redis fails sometimes to reload rules to suricata; restart of redis fixes Actions
OD Bug #3040: pcap: with -r <single file> pcap_open_offline failure does not lead to non-zero exit code Actions
PC Bug #3041: snmp parsing error message Actions
CT Bug #3049: thread hangs in pfring mode Actions
OD Bug #3066: No documentation for hostbits Actions
OD Bug #3071: coverity warning in tls wrt tainted scalars Actions
OD Bug #3075: RX thread hang in pcap-file mode Actions
CT Bug #3087: Prelude output IDMEF message issue Actions
JL Bug #3093: FTP logging needs suricata-verify tests Actions
OD Bug #3095: default log dir not always honored - git master Actions
HB Bug #3097: build for eBPF programs needs a way to specify Linux header location Actions
OD Bug #3117: multiple valgrind reported warnings - 5.0.0-dev (9e126b210 2019-08-07) Actions
OD Bug #3146: scan-build warning for asn1 parser Actions
PM Bug #3179: http_header_names not generating alerts Actions
KN Bug #3191: When run suricata with pf_ring zc mode suricata did not try to connect redis. Actions
PM Bug #3221: EBPFDeleteKey -- ERRCODE: SC_ERR_SYSCALL(50) Actions
VJ Bug #3229: Abnormal traffic produces unexpected alerts for traffic that is opposite direction of rule Actions
OD Bug #3238: rust compile fail on ppc64el Actions
CT Bug #3257: Lua PANIC: unprotected error in call to Lua API (stack overflow) Actions
CT Bug #3258: VXLAN exceeds MTU maximum Actions
OD Bug #3336: Suricata compilation on windows / mingw Actions
TF Bug #3348: Possible detection issue with VXLAN parser Actions
OD Bug #3349: Suricata 5.0 crashes while rule reload Actions
CT Bug #3353: xdp_filter segmentation fault util-ebpf.c:728 Actions
PA Bug #3354: eve-log dns (possibly others) alerts miss metadata for all but first packet Actions
CT Bug #3358: bypass_filter AFPBypassCallback Segmentation Fault Actions
OD Bug #3359: suricata.log ownership not being set to run-as user/group Actions
LJ Bug #3370: Suricata 5.0.0 Crashes Intermittently Actions
OD Bug #3371: 'suricatasc -c conf-get ...' returns outdated values after reloading suricata Actions
OD Bug #3374: Windows: Suricata does not warn upon insufficient permissions Actions
OD Bug #3480: EVE JSON - Incorrect Packet Logged Actions
OD Bug #3493: installed libhiredis includes/libs not found by configure script Actions
OD Bug #3617: Missing icmp netflow Actions
JL Bug #3681: Rule reload causes segfault Actions
CT Bug #3698: Incorrect max length of windivert filter Actions
OD Bug #3702: windows: when using compile against latest npcap traffic not seen unless bpf is used Actions
OD Bug #3705: VarNameStoreLookupById: Assertion `!(current == ((void *)0))' Actions
Bug #3728: ftp file extraction failure Actions
SB Bug #3746: bsize needs to err upon non possible matching conditions (4.1.x) Actions
OD Bug #3771: Extreme performance degradation when doing IP-only rules with flow-keyword Actions
CT Bug #3800: Netronome XDP mode: Unable to find 'cpus_count' map" Actions
CT Bug #3801: Problem harware bypassing with Netronome Actions
OD Bug #3809: Thresholding file-store rule with flowbits saves empty file to disk Actions
CT Bug #3834: Suricata 'content' keyword does not match on IP *payload* when using IP keywords Actions
CT Bug #3873: NET_RAW capability dropped for NFQ mode when uid/gid is specified Actions
CT Bug #3889: Support interfaces with MTU > 1500 Actions
OD Bug #3900: After a completed rule reload, Suricata sometimes is stuck for 1h with `rs_nfs_state_get_tx` peak Actions
CT Bug #3986: suricata -r not working for sshfs-mounted folder but working for sshfs-mounted file Actions
CT Bug #3990: suricata -r not working for symbolic link linking to pcap in different folder but working for symbolic link linking to pcap within same folder Actions
CT Bug #4016: filesize with filestore store empty files Actions
VJ Bug #4063: rdata field not included in DNS log for NS rrtype Actions
OD Bug #4081: ICMP IPv6 signature not matching when source contains ! condition with IPv4 addresses only Actions
CT Bug #4107: Coredump with async-oneside: true enabled in suricata.yaml. Actions
OD Bug #4108: Rule reloading: Rules that change the action from alert to drop, or drop to alert don't have their action updated. Actions
CT Bug #4183: Timestamps sometimes off by 2 hours on Windows Actions
OD Bug #4200: Flows not deleted in bpf ipv4_maps Actions
CT Bug #4214: Honor vlan: use-for-tracking in ebpf maps Actions
PM Bug #4223: rule loading takes too much time in certain cases Actions
CT Bug #4248: Suricata HTTP protocol resolves hostname exception Actions
PM Bug #4265: QA lab: add possibility to do repeatable replay tests Actions
CT Bug #4286: detect: FN due to setup failure with http_cookie after isdataat Actions
PY Bug #4356: Napatech memory leaks Actions
CT Bug #4357: Napatech memory corruption Actions
PM Bug #4391: Explicit path for datastes load/save in a rule is not honored if the default log path is different Actions
CT Bug #4426: XDP redirect cpu likely broken in 5.9 Actions
CT Bug #4499: Sudden and enormous memory leak Actions
CT Bug #4520: Suricata 6.0.2 segfault NFQ Actions
OD Bug #4553: Configuration test mode succeeds when reference.config file contains invalid content Actions
OD Bug #4583: xdp: libbpf xdp filter segfault with latest libbpf code Actions
OD Bug #4655: Dataset dumping to disk seems limited to 1000 Actions
GT Bug #4657: SSLv2 app-layer detection patterns incorrectly registered Actions
JL Bug #4669: threatexpert usage in reference.config Actions
CT Bug #4715: pcre keyword cause more alert! Actions
PA Bug #4736: ubsan: misaligned memory loads Actions
CT Bug #4755: eve: timestamp loses sub-second precision in some arm scenarios Actions
OD Bug #4843: IPv6 evasion : dos mld chiron Actions
OD Bug #4844: IPv6 evasion : redir6 Actions
OD Bug #4846: IPv6 evasion : flood + ndpexhaust26 Actions
OD Bug #4874: FN when using stream_size with http proto and buffers Actions
OD Bug #4875: FN when using flowbits and ftp protocol. Actions
OD Bug #4914: FLOW_DIR_REVERSED is not handled in multiple places Actions
SB Bug #4916: af-packet: Sending packet failed on socket 20: Message too long Actions
PA Bug #4940: ftp-data: protocol misclassification if the file begins with a protocol pattern Actions
Bug #5012: Remove duplicate definition of constants between C and Rust Actions
OD Bug #5013: fast pattern discrepancy when using engine-analysis Actions
OD Bug #5064: frames: duplicate alerts when no flow direction provided Actions
OD Bug #5071: Suricata RAM usage never decreasing Actions
JL Bug #5072: detect/ip_proto: inconsistent behavior when specifying protocol by string Actions
EP Bug #5087: smb: file.name sticky buffer doesn't match all smb files Actions
OD Bug #5135: DCERPC: dcerpc.iface keyword alert results differ from 5 vs 6/master Actions
JL Bug #5172: Napatech stream mismanagement following non-transient error Actions
OD Bug #5176: False positive when negated content is far ahead of matching content. Actions
OD Bug #5263: Flow is stuck if there is no traffic Actions
OD Bug #5264: random value for ja3 and ja3s hashes during the next scan Actions
OD Bug #5290: pip install failure Actions
OD Bug #5292: cppcheck: "portability" warnings: using void pointers in calculations Actions
OD Bug #5293: cppcheck: "portability" warnings: non thread-safe functions Actions
YZ Bug #5332: Smb2 can not store files! Actions
OD Bug #5406: HTTP Req and resp correlation incorrect Actions
OD Bug #5407: suricatasc runtime error Actions
OD Bug #5432: events: PACKET_RECYCLE does not reset event_last_logged (5.0.x backport) Actions
OD Bug #5480: Cannot compile Suricata 6.0.6 with PF_RING support Actions
OD Bug #5490: Applayer Detect protocol only one direction - NFS Actions
OD Bug #5492: Applayer Detect protocol only one direction - Kerberos Actions
OD Bug #5502: Suricata hangs and then exits when the first PCAP processed has 0 packets Actions
OD Bug #5520: If alert status code is 200, some fields are missing Actions
SM Bug #5562: rule_perf.log with multiple sort orders is invalid JSON Actions
EL Bug #5652: af-packet: remove emergency flush from yaml Actions
OD Bug #5656: rules: engine analysis gives false positive warning Actions
JI Bug #5721: http2: logging settings do not match what is seen in the RFC Actions
JL Bug #5748: iprep/ipv6: memory leak on same input in different forms Actions
JI Bug #5750: Spurious "SURICATA DNP3 Length too small" error and failed reassembly Actions
JI Bug #5751: DNP3 preprocessor incorrectly parses READ requests Actions
OD Bug #5754: I use the file-extraction to store the files transferred by HTTP2, but fileinfo does not have the filename field. Actions
EL Bug #5756: datasets: ipv4.src/dst, ip.src/dst check rules match on pseudo packets Actions
OD Bug #5766: Misparsing of DNP3 g70v1 objects and failed reassembly Actions
OD Bug #5767: Dangling pointer in SSL Parser Actions
OD Bug #5771: xdp: Flows with nested VLANs are not bypassed by XDP filter Actions
OD Bug #5778: ftp fileinfo and extraction seem not to trigger when it should Actions
VJ Bug #5788: files: output modifies file state Actions
OD Bug #5864: radix tree do not support "0.0.0.0/0 ::/0" Actions
OD Bug #5871: ips/af-packet: doesn't work between 2 virtio devices Actions
OD Bug #5880: pcap recursive mode not working as expected Actions
OD Bug #5938: for syslog output, the setting identity is not properly set Actions
OD Bug #5941: DNS rules not matching when traffic is over tcp Actions
OD Bug #5954: redis: output crash on Mac Actions
OD Bug #6088: xdp/ebpf: updated shipped bpf files to be supported by libbpf v1.0 and higher Actions
OD Bug #6108: http: leading gap in request data leads to invalid next request Actions
OD Bug #6110: Bad Checksum 0xffff - ICMPv4 & ICMPv6 Actions
OD Bug #6154: Conditional pcap-log fails to log packets for some alerts when using “pcap-file-continuous” flag Actions
OD Bug #6173: http: loss of backward compatibility in HTTP logs from v6 to v7 Actions
JI Bug #6175: eve/alert: deprecated fields can have unexpected side affects Actions
VJ Bug #6177: detect-engine: stream match for rules is interdependent Actions
JI Bug #6178: dns: erroneous app_proto settings in rule analysis Actions
VJ Bug #6197: stream: additional alerts being seen once sigs are added Actions
VJ Bug #6204: pcre: "Conditional jump or move depends on uninitialised value(s)" in valgrind Actions
OD Bug #6218: xbits inconsistent behavior when running a pcap file. Actions
JL Bug #6239: ASAN: double free when multi-tenancy enabled and configured Actions
OD Bug #6257: pcap: hang at shutdown for some interfaces Actions
CT Bug #6275: fail af_xdp at configure time when libxdp is missing? Actions
OD Bug #6283: FTP parsing yields in some cases smtp and http event types Actions
OD Bug #6307: Packet loss or client connection drop causes delayed detection on HTTP rules Actions
VL Bug #6365: Suricata AF_XDP not using libxdp XDP dispatcher and can't co-exist with another XDP program Actions
JL Bug #6372: napatech: Can produce invalid microsecond values. Actions
MK Bug #6385: NFQ: Dereference of pointer that potentially can be null Actions
OD Bug #6440: TLS logging and maybe more not working on tagged traffic Actions
OD Bug #6458: eve/http: discrepancy in http events and http objects logged in alerts Actions
OD Bug #6559: Signatures starting with space have invalid diagnosis Actions
OD Bug #6560: Suricata can’t output response when meet a tcp retransmission after a response Actions
OD Bug #6565: coverity: new issues after updating to 2023.6.2 Actions
OD Bug #6567: anomaly and file info logs discrepancy results between versions Actions
CT Bug #6587: bridge 'tap' modes don't alert on TCP protocol rules in virtual env Actions
CT Bug #6588: bridge 'ips' modes don't pass TCP traffic in virtual env Actions
OD Bug #6623: Suricata BPF filter differs from tcpdump (tcpdump behaviour seems correct) Actions
OD Bug #6655: invalid distance/within does not produce an error Actions
OD Bug #6713: Weak ciphers event in Kerberos protocol Actions
OD Bug #6716: fast.log enabled when running specifically without rules Actions
LS Bug #6722: dpdk: inconsistent stats reporting Actions
OD Bug #6731: eBPF XDP program is not attached when pinned-maps is true Actions
OD Bug #6789: Dns remarks without showing dns name Actions
OD Bug #6793: Unit tests failed to build on Solaris Actions
AS Bug #6815: util/decode-mime: Possible derefernce of nullptr Actions
AS Bug #6825: af-packet: possible free of unallocated memory Actions
AS Bug #6826: app-layer/htp: Possible dereference of null in HTPCallbackRequestLine Actions
OD Bug #6860: eve/alert: multiple issues for ICMP Actions
PA Bug #6874: libhtp appears to stop parsing HTTP client requests mid-pcap - /libhtp::request_uri_not_seen Actions
PA Bug #6886: HTTP Chunk Length Value disappearing Actions
OD Bug #6894: bsize validation FP on content negation with hex encoded 0d 0a Actions
OD Bug #6920: FR, FM and Global stats gone after 7.0.4 Actions
OD Bug #6933: dpdk: landlock support Actions
OD Bug #6963: rule-reload: potential memory leak in multiple rule reloads Actions
OD Bug #6997: Socket mode hard fail with pcap logging mode and multiple link layer pcap file Actions
OD Bug #7008: Static build failure on Linux since Actions
OD Bug #7016: tls: hello retry request handling issues Actions
OD Bug #7024: unix-socket: inconsistent default behavior Actions
OD Bug #7091: Segfault on 7.0.5 with generated live traffic Actions
OD Bug #7137: "invalid cpu range" when trying to use CPU affinity Actions
OD Bug #7179: Capture Kernel Drops happen when data transferring inside the intranet Actions
OD Bug #7184: failed to parse addresses Actions
OD Bug #7197: detect/flowvars: persist if the inspection happens on multiple packets Actions
OD Bug #7201: Thread 178 "W#21-84:00.0" received signal SIGSEGV, Segmentation fault. Actions
OD Bug #7259: Flaky behaviour of rules using Threshold keyword when running with --pcap-file-continuous Actions
OD Bug #7274: ssl_state:unknown not implemented Actions
OD Bug #7281: DNS Alerts Only Triggering on UDP, Not TCP – Is This Normal? Actions
VJ Bug #7284: rules: pass/drop <app proto> rules actions no longer apply to flow Actions
OD Bug #7312: configure script does not seem to take into consideration --with-libpcap-includes option (msys/windows) Actions
CW Bug #7331: Packet direction check incorrect for Lua TLS functions Actions
OD Bug #7343: SURICATA TLS invalid record type and SURICATA Applayer Detect protocol only one direction on TLS handshake Actions
EL Bug #7345: build fail when only --enable-profiling-rules is used Actions
EL Bug #7346: eve/fileinfo: sha256 should not be logged on incomplete file Actions
OD Bug #7356: Unexpected effect of filestore keyword Actions
EL Bug #7357: filestore keyword option seems not to work Actions
OD Bug #7363: Flows are not recycled when use multi Flow Manager. Actions
OD Bug #7369: xbits noalert does not appear to function, and syntax documentation is ambiguous. Actions
OD Bug #7387: cbindgen 0.20 does not work for Suricata and rustc 1.75 and we do not get a meaningful error message Actions
EL Bug #7388: runmodes: --unix-socket doesn't work w landlock Actions
EL Bug #7397: list-keywords command line option is crashing Actions
OD Bug #7410: Engine does not warn when a rule contains multiple threshold keywords Actions
OD Bug #7419: Incomplete logging message Actions
OD Bug #7454: Inconsistent behavior for ftp rules Actions
OD Bug #7473: DecodeIPV4Options：Check that the IPv4 option length should be an integer multiple of 4 bytes Actions
OD Bug #7530: Kerberos: sname/cname code and suricata documentation both wrong Actions
OD Bug #7541: `run-as` config option in Suricata remove capabilities needed for loading `ebpf` programs Actions
OD Bug #7551: TCP alerts missing from fast.log in Suricata 7.0 Actions
AH Bug #7612: modbus: regression from Suricata 6 to 7 Actions
JW Bug #7622: AFPacket V3 missing socket ref count decrement Actions
OD Bug #7640: pcap-log: issues with multiple instances of pcap-log Actions
OD Bug #7710: Suricata Shutting Down Due to Queue Issue Actions
OD Bug #7751: test mode: should not use default logging directory Actions
OD Bug #7754: http.host and http.host.raw contain the same Host header value twice, with a delimiter Actions
OD Bug #7763: windows: unable to override config and log directory Actions
OD Bug #7811: Starting from 7.0, after enabling Suricata, telnet curl wget timed out and returned to normal after shutting Suricata down Actions
JL Bug #7819: register-tenant deadlocks Actions
OD Bug #7845: Applayer and flowbits issues Actions
JL Bug #7853: transform/base64: error when no args are specified Actions
OD Bug #7870: rules: signature line not loaded if starts with space Actions
PM Bug #7873: stream_size: no error with udp rule Actions
OD Bug #7892: icmp detection corner case with dns app_proto Actions
OD Bug #7899: dhcp: client_id parsed incorrectly when htype is undefined Actions
JL Bug #7903: App layer protocols do not support new kibi-byte units in memcap (e.g. "64 MiB") Actions
OD Bug #7919: Suricata generates corrupted PCAPNG files with invalid packet capture length Actions
OD Bug #7925: http: dissection anomaly on repeated 'Vary' headers Actions
OD Bug #7988: dataset seems to artificially reduce priority of rules which use it? Actions
RW Bug #8017: Flowint: allow assigning variables from smvars. Actions
PI Bug #8030: None worker threads in af-xdp mode while use veth interface Actions
OD Bug #8033: BPF map (flow_table_v4) is not cleaned well even after network traffic stop being replayed Actions
CT Bug #8126: -funsigned-char makes int8_t unsigned on Solaris Actions
OD Bug #8165: FTP data is not blocked with drop rule and filemd5 match Actions
CT Bug #8193: Worker names cut off when having more than 99 workers and statistics incomplete in the json stats logging Actions
Bug #8238: Unsigned integer underflow in quoted-printable decoder with small input chunks Actions
SS Bug #8239: hyperscan: Segfault in hyperscan when running Suricata 8.0.3/8.0.1 on Fedora 43 Actions
SS Bug #8242: eBPF maps created by Suricata don't take vlan.use-for-tracking into account Actions
AP Bug #8303: tcp: flow treated as established without client ACK Actions
GT Bug #8338: Rules can parse incorrectly due to bug in threshold parse regex Actions
OD Bug #8348: enip: enabled by default in 8.0.x, but disabled by default in 7.0.x Actions
SS Bug #8377: OPNsense Suricata divert-to mode causes aborted HTTPS response streams (Axios / Node.js) – works with responseType: stream Actions
OD Bug #8389: firewall: Add monitor/observe mode to preview firewall policy without enforcing drops Actions
OD Bug #8458: detect/variable: warn if rules try to use byte vars before they're extracted Actions
Bug #8576: Suricata stops processing packets when receiving via GRE/ERSPAN Actions
JI Bug #8580: lua: system headers can accidentally be picked up instead of headers from crate Actions
OD Bug #8581: http2: HPACK varint overflow can cause IDS evasion Actions
OD Bug #8603: pcap-file mode keeps threshold state across pcaps Actions
OD Bug #8626: detect: SOCKS is misdetected as dcerpc Actions
OD Bug #8630: Silent failure when ignore-unknown-requirements is set to an invalid value Actions
DB Bug #8641: malloc-error-check.cocci: broken regex alternation makes script a no-op Actions
Bug #8654: CPU exhaustion related to app-layer quic protocol parsing observed in Suricata 8.0.3 Actions
JI Bug #8681: unix-socket: select() off-by-one breaks multi-chunk V2 commands Actions
UK Bug #8742: base64: SCBase64Decode creates an out-of-bounds slice when callers allocate only the decoded size Actions
Bug #8811: ldap: Microsoft Sicily authentication causes parser errors and stops subsequent LDAP transactions Actions
OD Bug #8878: eve: format strings in filename change position of thread number when threaded logging enabled Actions
JL Bug #8880: ftp: memcap is neither enforced nor adjustable at runtime Actions
JL Bug #8887: detect/flowvar: capture buffers leak when the var store fails to allocate Actions
AB Bug #8919: ebpf bypass: flow end timestamp and age are the flow manager check time Actions
OD Bug #8940: Suricata 8.0.6: af-packet cluster_cpu breaks TCP reassembly — HTTP detected by Zeek but missed by Suricata Actions
OD Bug #8953: detect: signature ordering prefers the previous criteria Actions
Bug #9115: firewall: null pointer dereference on packets whose direction has no sig group Actions
Bug #9118: detect: byte_extract 64-bit value truncated to 32-bit at content modifier sites Actions
Bug #9121: Suricata 8.0.7 Windows EVE Timestamp Reports Incorrect Timezone Offset Actions
Bug #9178: Bad error message when wd is not writable in user mode Actions
Bug #9181: Modbus: a midstream flow picked up from a server response is oriented backwards and is never swapped Actions
Bug #9208: modbus: "SURICATA Modbus Data mismatch" (sid 2250008) fires on every valid Read Holding/Input Registers response Actions
OD Bug #9232: SNI not evaluated for a second QUIC connection that reuses the UDP source port Actions
Bug #9244: threshold/detection_filter track by_src|by_dst|by_both: global per-table free-list mutex in the entry-creation path causes severe throughput collapse under high source/destination address cardinality Actions
Bug #9245: SCFlowRunFinishCallbacks() not invoked when FlowWorker evicts a flow locally (CheckWorkQueue), unlike FlowRecycler and the emergency flow-reuse path Actions
SZ Bug #9247: Type mismatch in bytetest/bytejump Actions
Bug #9252: Rule metadata missing from eve alert output in unix-socket mode until rules are reloaded after a pcap-file run Actions
Bug #9268: doh2: dns response rules disrupted by an http2 rule in the ruleset Actions
CT Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
CT Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
CT Feature #266: log http raw request for network forensic Actions
CT Feature #273: IRC protocol detection support Actions
CT Feature #276: Libcap support for dropping privileges Actions
CT Feature #294: Limit inspection of a stream and/or rule... Actions
JL Feature #328: Traceability and QA with regards to rules loaded Actions
CT Feature #365: expose interface(unix socket command) to reset tcp connection Actions
CT Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
CT Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
CT Feature #432: PCAP-NG support Actions
CT Feature #448: dlp: md5sum based on part of files Actions
VJ Feature #465: benchmark runmode Actions
CT Feature #473: pcap log: alert log with packet indexes Actions
CT Feature #511: Port indepedent protocol identification (nDPI) Actions
CT Feature #535: new keywords - time , day Actions
CT Feature #544: Live traffic decryption Actions
CT Feature #547: libinjection -- sqli library Actions
CT Feature #584: lua: expose file buffers Actions
CT Feature #596: rule profiling: multiple outputs per run Actions
CT Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
CT Feature #659: Update IP reputation from unix socket. Actions
CT Feature #716: configurable packet_stats.csv and packet_stats.log Actions
CT Feature #728: Add support for OpenCL Actions
CT Feature #745: Tunnel configuration Actions
OD Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
OD Feature #783: LuaJIT be able to return various messages for a single script. Actions
VJ Feature #816: TCP SACK: limits per stream Actions
CT Feature #821: conditional logging: output steering Actions
CT Feature #843: Custom http logging filter functionality Actions
OD Feature #870: luajit: global vars Actions
OD Feature #880: memcap http parser Actions
CT Feature #902: VLAN host table support Actions
CT Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
CT Feature #936: support tzsp protocol Actions
CT Feature #960: persistent TCP resets Actions
CT Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
OD Feature #1015: add chained content info to rule analysis Actions
OD Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
CT Feature #1095: Integration of support for STIX-based indicators Actions
OD Feature #1132: set rpath for libs not in the default linker paths Actions
OD Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
CT Feature #1191: EVE log does not support customformat Actions
CT Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
CT Feature #1215: journald logging support Actions
CT Feature #1234: nfqueue: use mnl API Actions
OD Feature #1239: Best effort TCP stack Actions
CT Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
CT Feature #1247: Using suppress in threshold.config does not prevent dropping Actions
OD Feature #1250: protocol: Multipath TCP (mptcp) Actions
CT Feature #1290: handle SIGHUP signal Actions
OD Feature #1300: profiling: per flow recording of profiling data Actions
CT Feature #1323: automated eve.json rotation Actions
CT Feature #1370: sctp: fp on suricata engine Actions
OD Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
OD Feature #1389: suppress by host Actions
OD Feature #1469: Use ISO 8601 date/time formats Actions
CT Feature #1489: Log a message when memcap limit is reached Actions
OD Feature #1504: lua: better notification in verbose mode on script errors Actions
OD Feature #1505: lua: show lua scripts during rule (re)loading Actions
CT Feature #1541: multi-detect - vlan range mapping Actions
CT Feature #1566: ICMPv4 control channel detection Actions
CT Feature #1571: Socket permissions setting in suricata.yaml Actions
CT Feature #1590: lua: force file magic and md5 lookup from script Actions
CT Feature #1608: Add option to disable JSON escape slash Actions
OD Feature #1662: Disable action / rule ordering option Actions
CT Feature #1710: unix-socket: Send output to unix socket Actions
CT Feature #1712: multitenancy: 'lite' tenants Actions
CT Feature #1741: flow: use capture methods flow hash Actions
CT Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
CT Feature #1752: Netmap for Windows Actions
MK Feature #1766: TLS keyword expansion Actions
OD Feature #1767: Support DTLS protocol Actions
CT Feature #1783: lua: create buffers to expose L2, L3, and L4 headers Actions
CT Feature #1794: test suricata rules over unix-socket Actions
CT Feature #1799: netmap: capture drop stats Actions
CT Feature #1819: Silent installer for suricata windows Actions
AH Feature #1872: add --list-decoder-protos or similar Actions
CT Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
OD Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
CT Feature #1950: allow configuration of file-store types Actions
CT Feature #1956: Add option to re-initialise Lua output scripts Actions
CT Feature #1977: get the os info from TCP HTTP fingerprint Actions
CT Feature #1995: fast.log should show if packet has been dropped or rejected Actions
CT Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
OD Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
OD Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
CT Feature #2107: eve: rotate log output based on size Actions
OD Feature #2115: Changing interfaces Actions
OD Feature #2145: Relate directly flowid with certificate file Actions
CT Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
OD Feature #2166: output: log only triggering buffers Actions
CT Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
OD Feature #2213: file matching: allow generic file matching / store Actions
CT Feature #2227: more detailed output about number of threads created Actions
OD Feature #2232: Allow Large value in suricata.yaml file Actions
OD Feature #2233: Allow log for payload and packet only for defined sid Actions
CT Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
CT Feature #2269: tls: tls.version: allow negation or comparison Actions
CT Feature #2273: engine analysis: enable analysis by default during startup Actions
CT Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
VJ Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
JI Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
JI Feature #2301: netflow: dump records at interval Actions
TM Feature #2308: threshold/suppress by http_host Actions
CT Feature #2310: lua: expose xbits Actions
OD Feature #2316: global memcap Actions
CT Feature #2342: Write PCAP files directly to Unix Socket Actions
OD Feature #2343: Add "flush" command to unix socket Actions
OD Feature #2371: lua: list all available /exposed fields to lua Actions
OD Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
CT Feature #2409: Push signatures without reloading the entire set. Actions
CT Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
CT Feature #2426: tls: extend logging Actions
OD Feature #2478: PCAP logging does not include 802.1q header when using af-packet Actions
OD Feature #2488: HTML Parsing / Buffers Actions
CT Feature #2513: sslproxy: handle HTTP header Actions
CT Feature #2519: XFF iprep support Actions
CT Feature #2538: dsize keyword improvements Actions
CT Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
CT Feature #2613: stats: add xdp counters to stats Actions
DJ Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
CT Feature #2648: store captured data into file Actions
CT Feature #2661: output the http-body-data to eve.json Actions
CT Feature #2672: Split out DHCP parser to be reusable Actions
CT Feature #2673: Split out DNS parser to be reusable Actions
CT Feature #2674: Split out NFS parser to be reusable Actions
CT Feature #2675: Split out SMB parser to be reusable Actions
OD Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
PC Feature #2700: ja3/ja3s functionality for IKEv2 Actions
CT Feature #2701: flow: counter for allocations at runtime Actions
PC Feature #2713: protocol detection w/o protocol parsing Actions
OD Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
OD Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
OD Feature #2756: rules: input in json format Actions
CT Feature #2759: iprep: more granularity Actions
OD Feature #2764: dns logging v1 vs v2 Actions
CT Feature #2767: Interception of network stack attacks Actions
WV Feature #2771: MPLS over Vlan support Actions
CT Feature #2772: Add MPLS labels to alert output Actions
CT Feature #2818: Napatech Bypass support Actions
CT Feature #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN Actions
PC Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
JL Feature #2871: lua: Exposing byte extract to script Actions
CT Feature #2925: Support for SPB encapsulation Actions
CT Feature #2931: Perform privdrop without libcap-ng support Actions
CT Feature #2932: add batman-adv decode support Actions
CT Feature #2935: Support for multiple-logger for drop eve-log Actions
CT Feature #2939: Suricata enhancements - proposals Actions
MV Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
MV Feature #2962: eve: log more IKEv2 fields Actions
CT Feature #2987: Suggestions for new keywords (streambits) Actions
AH Feature #2996: Extend decode events and rules Actions
OD Feature #3042: stats: allow per second stats updates Actions
CT Feature #3105: Add kafka output Actions
CT Feature #3212: Prevent duplicate pcaps from being re-processed Actions
CT Feature #3244: IMAP Support Actions
CT Feature #3245: Email extraction to separate folder Actions
CT Feature #3246: Logging of Email body Actions
OD Feature #3260: SMTP Base64 Decoding of Message Body Actions
OD Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
OD Feature #3271: Add keyword to determine flow based speed/bw Actions
OD Feature #3290: use config vars everywhere Actions
CT Feature #3295: unix-socket: support to receive flow bypass information Actions
CT Feature #3296: Include in the fileinfo if it was a duplicate Actions
JI Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
CT Feature #3310: ease suricata configuration with xdp Actions
OD Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
CT Feature #3316: unix-socket: support dumping flow table Actions
JI Feature #3317: rules: use rust for tokenizing rules Actions
OD Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
CT Feature #3321: Evaluate different encoders for eve-log Actions
JI Feature #3333: Research: Unwind panic's from Rust modules Actions
PM Feature #3373: add init service file example script for Debian/Ubuntu Actions
GL Feature #3383: nflog: use mnl api Actions
OD Feature #3439: bpf-filter does not accept path/file Actions
CT Feature #3454: Add support to communicate with other networking products Actions
OD Feature #3494: rules: Keyword for determining if the http_host is an ip address Actions
OD Feature #3503: decoders: handle trailing data Actions
CT Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
SD Feature #3554: modbus: support GAP recovery Actions
OD Feature #3555: DNP3: support GAP recovery Actions
OD Feature #3556: dns: improve GAP recovery Actions
OD Feature #3557: ftp: support GAP recovery Actions
OD Feature #3558: smtp: support GAP recovery Actions
OD Feature #3560: ssl/tls: support GAP recovery Actions
OD Feature #3561: krb5: support GAP recovery Actions
OD Feature #3562: rdp: support GAP recovery Actions
OD Feature #3563: rfb: support GAP recovery Actions
JI Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
CT Feature #3663: DNS: Parse and extract DNS NULL records Actions
VM Feature #3675: Testimony support Actions
JW Feature #3688: Re-implement fast_pattern:only; in some way Actions
CT Feature #3845: Threshold Hit Counter (for SID/IP) Actions
CT Feature #3848: Keep a Reference to Matched Items in Suricata Datasets for Rule-Writing Actions
CT Feature #3852: Ability to build with sanitizers Actions
CT Feature #3875: Support multiple XFF Actions
CT Feature #3894: Option "ttl" exclusive range behavior is non-intuitive Actions
OD Feature #3954: Optimize handling of encapsulation in cloud deployment Actions
CT Feature #4070: capture plugins: receive notification when suricata is done with a packet Actions
OD Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
OD Feature #4138: A stable flow ID for dump/restore of state as well as state synchronization Actions
CT Feature #4147: Map rules to MITRE ATT&CK Actions
CT Feature #4148: Research: SSH Support for additional protocol analysis Actions
CT Feature #4149: Research: Dynamic datasets Actions
CT Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
CT Feature #4159: Log flow age as fractional value Actions
JL Feature #4162: rules: entropy rule keyword Actions
OD Feature #4172: Split eve.json into multiple files based on alert severity Actions
CT Feature #4175: dcerpc: higher level logging Actions
CT Feature #4179: tunnel-Node for flow, netflow and dns-events in eve.json Actions
OD Feature #4213: smb: higher level logging Actions
CT Feature #4217: not complete cmd start line does not produce expliccit enough warning or msg Actions
OD Feature #4227: breakout components of tls.cert_subject and tls.cert_issuer into additional "sub" buffers Actions
OD Feature #4242: config: support predefined default configuration profiles Actions
SD Feature #4249: ics protocol: SS7 Protocol Support Actions
CT Feature #4250: Diameter Protocol Support Actions
CT Feature #4270: load rules from database Actions
JW Feature #4279: Optionally allow hashing truncated files, and a maximum length to hash Actions
CT Feature #4325: xdp compile warnings on 5.4 kernels Actions
CT Feature #4333: Include the ‘short name’ from classification.config in the all-eve.log Actions
CT Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
CT Feature #4398: support regex match and flowvars as keywords value Actions
OD Feature #4408: definitive log count mode for qa purposes Actions
CT Feature #4547: pcrexform not support tcp and other protocol Actions
CT Feature #4559: Tags for rules that enables mapping to Mitre Att&ck Actions
JL Feature #4573: add IPS drop total to eve log output Actions
OD Feature #4617: Add ThreatFox (by Abuse.ch) to suricata ruleset index Actions
CT Feature #4649: Autonomous System Number (ASN) support similar to GeoIP Actions
OD Feature #4656: rust: research tracking of memory used by a parser Actions
CT Feature #4758: dns: weird query should have app-layer-event? Actions
CT Feature #4770: eve: specialized output for ML on packet sizes and similar properties Actions
OD Feature #4774: rules: analysis output that shows rules per 'progress' value Actions
OD Feature #4781: config: add command to dump built-in config defaults Actions
OD Feature #4840: stats: distinguish between observational stats and performance stats Actions
CT Feature #4845: IPv6 evasion : parasite6 + dos new ipv6 + fake mldrouter6 advertise Actions
CT Feature #4951: decode: datalink type 276 not yet supported Actions
OD Feature #4976: frames: implement/complete profiling support Actions
OD Feature #4982: frames: selective frame logging Actions
PA Feature #4985: quic: support frames Actions
OD Feature #4988: frames: logging improvements Actions
OD Feature #4989: eve/alert: make frame logging configurable Actions
OD Feature #5014: Enable suricatasc to use configured command socket by default Actions
OD Feature #5051: output/frames: allow tx logging to reference frames Actions
EP Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
OD Feature #5069: smb: keyword for matching smb command Actions
JL Feature #5128: Light weight packet profiling Actions
OD Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
OD Feature #5206: Buffer Dump Utility Actions
CT Feature #5209: Add "status" mode to Suricata's socket command interface Actions
OD Feature #5247: Applayer Detect protocol only one direction : RTSP protocol Actions
OD Feature #5365: Limit rust 'filetracker' memory in configuration Actions
CT Feature #5372: Add support for encrypted traffic analysis Actions
OD Feature #5405: Make suricata point to where to report a bug Actions
OD Feature #5440: multiple stats EVE logs with different intervals Actions
OD Feature #5450: Rule keyword for non midstream flows Actions
OD Feature #5461: eve: Use threaded output by default Actions
OD Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
OD Feature #5470: reject: allow reject dev to be specified in the yaml Actions
CT Feature #5499: PCAP-over-IP client Actions
OD Feature #5618: setup-app-layer: add option to choose TCP/UDP protocol Actions
OD Feature #5641: dns: frame based keywords for "raw" fields in requests and responses Actions
OD Feature #5648: flowworker: heuristic to see how busy a thread is with elephant flows Actions
OD Feature #5649: eve.flow: add thread id(s) processing a flow to the record Actions
OD Feature #5650: unix socket: query threads about most recent elephant flows Actions
OD Feature #5655: host: make memuse and memcap reached counters for host table Actions
OD Feature #5657: byte_test: allow comparison with static value Actions
OD Feature #5668: eve: optionally add rule fast_pattern Actions
CT Feature #5670: Support wide strings somehow Actions
OD Feature #5673: capture: option to decapsulate everything first Actions
OD Feature #5674: Support layered protocols Actions
CT Feature #5675: protocol: MMS SCADA support Actions
OD Feature #5676: ASN1 Spec to Rust nom generator Actions
OD Feature #5677: protocol: BGP support Actions
CT Feature #5681: datasets: add more transform layers to match on domains Actions
OD Feature #5687: eve: "auth" and/or "auth_fail" log Actions
PC Feature #5705: protocol: Wireguard parser Actions
OD Feature #5716: rdp: add app-layer frame support Actions
OD Feature #5727: krb: add frame support Actions
OD Feature #5728: modbus: add frame support Actions
OD Feature #5729: bittorrent-dht: add frame support Actions
OD Feature #5730: dhcp: add frame support Actions
OD Feature #5732: ntp: add frame support Actions
OD Feature #5733: snmp: add frame support Actions
CT Feature #5737: smtp body extract Actions
OD Feature #5745: exceptions: allow setting via unix-socket Actions
OD Feature #5752: Proposed new DNP3 keywords and operators Actions
JI Feature #5764: logging: add a format string for a more standard log format Actions
OD Feature #5774: Addressing Mixed Case in HTTP Headers Names and HTTP2 Actions
CT Feature #5776: PCRE fast_patterns via hyperscan Actions
DS Feature #5798: New transformation: dropbytes Actions
CT Feature #5872: file structure awareness - precise identification of fields in file structs Actions
VJ Feature #5894: file: file classification keyword Actions
CT Feature #5913: rfb: add more record types Actions
OD Feature #5956: Report traffic with missing VLAN tag Actions
OD Feature #6004: Add retry option to redis outputs using a socket instead of IP Actions
OD Feature #6051: app-layer: dhcpv6 support Actions
OD Feature #6067: Add field to track SID of Flowbit Matches Actions
OD Feature #6101: icap: app-layer protocol support Actions
OD Feature #6102: Translate NAT64 ranges (also custom ranges) Actions
AH Feature #6161: file-store: missing hash on TRUNCATED files Actions
OD Feature #6198: smtp: add keywords for use in rules Actions
CT Feature #6200: output: suricata.yaml dump-all-headers applied for alerts Actions
CT Feature #6206: Investigate a more intuitive use of the timestamp field in traffic/metadata events Actions
CT Feature #6216: http: HHHash support Actions
JR Feature #6251: AF-XDP ability to bind custom program Actions
VJ Feature #6268: Recognize related ICMP request/response pairs Actions
EL Feature #6295: output: add stream-size to flow output Actions
OD Feature #6296: smtp: BDAT chunking support incl MIME parsing Actions
CT Feature #6356: detect/analyzer: add more details for the tcp.hdr keyword Actions
CT Feature #6358: detect/analyzer: add more details for the ICMP itype keyword Actions
OD Feature #6373: main/startup: support sentinel file signal for initial rule processing completion Actions
OM Feature #6410: Log packets/bytes per second in Suricata stats Actions
OD Feature #6453: Support DNS over TLS Actions
OD Feature #6456: output: binary logging Actions
OD Feature #6457: eve: configurable list of fields in output Actions
GL Feature #6461: ics protocol: bacnet Actions
CT Feature #6462: ics protocol: IEC104 Protocol Support Actions
CT Feature #6464: protocol: profibus Actions
OD Feature #6465: multi-tenant: support vxlan as a selector Actions
OD Feature #6466: multi-tenant: support mpls as a selector Actions
OD Feature #6467: flow tracking: add other parameters to flow tracking Actions
OD Feature #6468: flow-tracking: add geneve as a flow tracking parameter Actions
OD Feature #6469: flow-tracking: add erspan as a flow tracking parameter Actions
OD Feature #6470: flow-tracking: add vxlan as a flow tracking parameter Actions
OD Feature #6471: flow-tracking: add mpls as a tracking parameter Actions
OD Feature #6482: Deployment: detect if capture is good enough Actions
OD Feature #6625: Apply netflow per network Actions
OD Feature #6649: Add a keyword to match on raw data within headers especially for protocols without a dedicated parser Actions
OD Feature #6650: dns: support extended response/error codes Actions
OD Feature #6683: stats: add packet time elapsed indicator Actions
EL Feature #6692: Have keywords export JSON dump function for engine analysis Actions
OD Feature #6701: Auto-bypass optimization Actions
OD Feature #6779: http.header_names behavior when encountering duplicate header names Actions
SJ Feature #6794: Tie signature to live device in IPS mode Actions
OD Feature #6802: Support Domain rollup using existing dataset library Actions
OD Feature #6807: Support the use of variables within transforms Actions
OD Feature #6808: Quantify how a Suricata rule matches against a PCAP Actions
OD Feature #6823: SC_WARN_POOR_RULE on to_lowercase/to_uppercase transformation with non-possible matching content Actions
OD Feature #6853: Support of variables from byte_math / byte_extract in bsize / dsize comparisons Actions
OD Feature #6885: references: new "wayback" reference and update others Actions
OD Feature #6914: support inspecting http.uri or http.request_body Actions
OD Feature #6915: How to write the filepath to the alert log when using default mode with pcap-log? Actions
OD Feature #6916: decoding : add support of IEEE 802.2, 802.3 frames Actions
OD Feature #6922: Have a way to manually request decompression/inflate if headers are not present Actions
OD Feature #6925: multi-buffer support for HTTP cookies Actions
OD Feature #6926: rules: new buffer that includes HTTP headers and the start of HTTP body Actions
OD Feature #6993: rule macros for commonly used logic in rules Actions
OD Feature #6995: raw option for http.request/response_header Actions
OD Feature #7052: Add facility to move data from code into data files Actions
OD Feature #7056: version info not reported in stats json Actions
OD Feature #7057: monitored interface information in stats json Actions
SS Feature #7082: redis: support EVE output to a Redis stream Actions
OD Feature #7095: rdp: keywords additions Actions
OD Feature #7096: detect/flow: additions to time detection Actions
OD Feature #7097: Additions to flow detection - size Actions
OD Feature #7099: Addition of total bytes to the flow logs Actions
OD Feature #7100: smb: additional keywords Actions
PM Feature #7101: eve: add number of flowbits in protocol records and alerts Actions
OD Feature #7103: ssh: extra fields and keywords Actions
OD Feature #7127: extended http.referer buffers/keywords Actions
JL Feature #7129: decode: Create a decode event for unknown ethertypes Actions
OD Feature #7132: threshold: add thresholding options for all decode events Actions
JL Feature #7146: decode: Create a decode event for unknown IP types Actions
CT Feature #7175: Response module API Actions
OD Feature #7221: Sanity checking on IP network prefix base addresses Actions
CT Feature #7283: installing suricatasc functionality without installing suricata entirely Actions
OD Feature #7321: rules: cross buffer byte_* keyword support Actions
OD Feature #7328: detect: use hyper scan streaming mode Actions
CT Feature #7364: deciphering https traffic from linux system Actions
OD Feature #7384: vlan: flowID should take MPLS into consideration Actions
OD Feature #7391: detect/config: 'scope' can't be applied to 'flow' Actions
OD Feature #7400: eve: optionally support logging pcap output file Actions
OD Feature #7402: tls: ability to detect self signed certs Actions
OD Feature #7446: add logic to parse QUIC CRYPTO frames and provide a keyword to access the reassembled data Actions
OD Feature #7518: add "blocking" argument to pcap-file socket command Actions
OD Feature #7535: detect/ldap: add ldap.search_request.filter and also log the filter Actions
OD Feature #7550: detect/ldap: add keywords for LDAP ExtendedResponse Actions
OD Feature #7559: Allow rule comment at end of rule line using # Actions
OD Feature #7572: Relative offset support for the entropy keyword Actions
OD Feature #7594: mime: add email.status keyword Actions
OD Feature #7621: rules: add lua extension or function Actions
OD Feature #7654: detect: rule keywords for matching on file hashes Actions
OD Feature #7655: Allow using flow id in pcap log file name Actions
OD Feature #7675: Custom content detection Actions
JL Feature #7679: output/log: log the entropy value Actions
OD Feature #7696: output: configuration for simple loggers, and reuse in alerts Actions
VJ Feature #7697: firewall: allow request/response action scopes Actions
VJ Feature #7700: firewall: make verdict fields in alert and drop mandatory Actions
VJ Feature #7706: firewall: default settings; locked settings Actions
OD Feature #7729: Ability to use local fqdns (to get ipv4 and/or ipv6) in address-groups vars Actions
OD Feature #7785: pcap-log: support packet context for conditional alerts Actions
OD Feature #7787: krb5: add encryption keyword Actions
OD Feature #7788: krb5: add failed_request keyword Actions
OD Feature #7796: Support for TLS decryption in pcap mode using sslkeylog file Actions
OD Feature #7844: websocket: add option to log payloads in Eve websocket events Actions
PM Feature #7882: icmp malware channel activity events in one sided flows Actions
EL Feature #7888: eve: add app_proto to all event_type Actions
OD Feature #7895: Identify tunnel parent flow ID in flow logs Actions
OD Feature #7896: Report stream/socket bytes transferred in flow logs Actions
OD Feature #7949: affinity: evaluate verbal and relative definition of CPU sets Actions
OD Feature #7951: (Feature Request) Ability to reference content matches across buffers. Actions
OD Feature #7970: tls: Log elliptic curve ID Actions
OD Feature #7971: tls: log state history Actions
OD Feature #8019: mpm: support `endswith` condition to the fast pattern in hyperscan Actions
JL Feature #8124: datasets: support subnets Actions
CT Feature #8132: Add decompression support to pcap-file capture method Actions
CT Feature #8133: Relative pcre with negative distance to previous content match Actions
VJ Feature #8221: http: header handling should treat duplicates as multi-buffer, not concat Actions
AB Feature #8245: Add payload-only-classtypes filter for EVE alert payload extraction Actions
OD Feature #8246: af-packet: allow specifying IPS mode on the commandline Actions
OD Feature #8277: rules: add negation support for ipopts keyword Actions
CT Feature #8319: Add threaded output socket support for unix_dgram Actions
GT Feature #8329: Implement ERSPAN type 3 Actions
SS Feature #8427: Feature request: support glob patterns in include directive Actions
OD Feature #8436: rules: allow rule to modify midstream behavior per flow Actions
OD Feature #8470: detect/transform: Create anomaly log on transform failure Actions
OD Feature #8479: eve/firewall: dedicated log record type Actions
CT Feature #8517: ikev2: new buffers and keywords Actions
KS Feature #8593: ndpi: adding the "category" keyword for the ndpi pluggin Actions
JL Feature #8671: detect/transforms: support inline variable-key extraction (var <nbytes> <offset>) Actions
JL Feature #8680: ftp: discover server side filename for STOU file transfers Actions
OD Feature #8691: detect: SNMP Varbind Keywords Actions
OD Feature #8693: detect: smtp/email body and header inspection keywords Actions
OD Feature #8748: detect: rule keyword to match on unregistered ip protocol payload Actions
OD Feature #8764: smb/dcerpc: add recognition of wkssvc and netlogon named pipes Actions
JL Feature #8766: detect: add "exact" keyword — match a content spanning the whole buffer Actions
SB Feature #8767: dcerpc: user defined opnum uuid map Actions
Feature #8779: list all fields produced by suricata Actions
Feature #9128: rfb: VNC connect back support missing Actions
Feature #9150: libsuricata: support stream input without synthetic packets Actions
Feature #9151: detect: Add option to disable tag tracking Actions
Feature #9205: dnp3: events for link-layer recovery, optional resync on bad start bytes Actions
CT Feature #9228: QUIC: support concurrent handshakes within the same UDP flow Actions
Feature #9260: stats: output stats in an OpenTelemetry-compatible format Actions
LI Support #2998: Rules Reload doesn't work properly Actions
Support #3037: The rules detect order Actions
CT Optimization #536: share ctx for filemd5 keyword if identical files are used Actions
CT Optimization #548: Use bloomfilter for filemd5 Actions
OD Optimization #551: Replace SCLogError by a counter for memory issue and other memcap Actions
CT Optimization #569: display syntax requirement on keyword parsing error Actions
OD Optimization #573: reduce allocs in signature parsing Actions
CT Optimization #614: Rate limiting messages Actions
CT Optimization #721: full nfq zero copy mode Actions
CT Optimization #795: stream: use pool instead of direct SACK record allocs Actions
CT Optimization #808: Support the new GSO-avoidance NFQ feature Actions
CT Optimization #923: memcap value in suricata.yaml : erroring if config value is bigger than what is available Actions
PA Optimization #945: remove useless includes Actions
CT Optimization #1046: replace pcre_get_substring with pcre_copy_substring Actions
OD Optimization #1094: Special check for first character of buffer Actions
CT Optimization #1188: Don't use iface name in GetIfaceMaxHWHeaderLength Actions
OD Optimization #1222: Boyer Moore content not shared between same content Actions
CT Optimization #1313: All Free functions should correctly handle NULL pointers Actions
PM Optimization #1348: OOBE -6- increasing max-pending-packets default value Actions
OD Optimization #1595: Suricata starts in known conditions of no data Actions
CT Optimization #1718: Time stamp in Log files should be ISO 8601 format Actions
CT Optimization #1749: Log PACKET_DROP in inline mode for invalid states as well Actions
OD Optimization #2220: When running on a single-CPU machine, pcap processing takes a long time Actions
OD Optimization #2221: Suricata batch processing slowed down by 0.2s intervals Actions
OD Optimization #2317: rcu Actions
OD Optimization #2321: yaml: clean up usage of lists Actions
OD Optimization #2337: give warning if permissions won't allow log reopen after dropping privs Actions
OD Optimization #2373: unix domain socket owner stays root when priviledges dropped Actions
CT Optimization #2460: Reduce timeout in unix-socket when multiple pcaps are enqueued Actions
CT Optimization #2582: document flags keyword Actions
CT Optimization #2584: document tag keyword Actions
CT Optimization #2586: document flowvar keyword Actions
CT Optimization #2587: document pktvar keyword Actions
CT Optimization #2590: document nfq_set_mark keyword Actions
CT Optimization #2593: document pkt_data keyword Actions
CT Optimization #2594: document dce keywords Actions
CT Optimization #2595: document asn1 keyword Actions
CT Optimization #2596: document engine-event keyword Actions
CT Optimization #2597: document stream-event keyword Actions
CT Optimization #2598: document l3_proto keyword Actions
BS Optimization #2599: document base64 keywords Actions
CT Optimization #2627: lua: load script from same location as rule file if not in default rule location Actions
CT Optimization #2687: current suricata.yaml is missing rotate-interval "example" Actions
OD Optimization #2725: stream/packet on wrong thread Actions
CT Optimization #2750: document nfs-keywords Actions
CT Optimization #2780: Convert DNP3 from C to Rust Actions
CT Optimization #2781: Convert ENIP from C to Rust Actions
PA Optimization #2979: replace mime decoder with rust based implementation Actions
CT Optimization #3127: Unable to set XDP on 'ens2f0': Invalid argument (-22) - Mellanox cards and Intel cards with jumbo frames Actions
OD Optimization #3206: improve int handling Actions
OD Optimization #3213: improve rule parsing warnings Actions
OD Optimization #3304: generic way to register buffers for logging and detection Actions
CT Optimization #3305: Tracking ticket: which parts of the engine should be dynamic Actions
PC Optimization #3314: rust: integrate log crate with suricata logging Actions
CT Optimization #3322: Use standard CRC32 for hash-like functions Actions
JI Optimization #3337: Python is assumed to be installed in the same --prefix as suricata Actions
CT Optimization #3544: Have small signature match context without allocation Actions
CT Optimization #3797: Filestore Setup Excess Directory Slash Actions
CT Optimization #3829: pcap source: Counters, counters and... counters Actions
CT Optimization #3830: pcap source: PcapThreadVars and cache lines Actions
CT Optimization #4087: excessive CPU usage on Windows with --pcap-file-continuous option Actions
PM Optimization #4234: Filemagic logging puts big pressure on performance Actions
OD Optimization #4318: app-layer: "close" all txs if protocol reaches error state Actions
OD Optimization #4370: the latest release of Suricata V6.0.1 for Windows use high CPU Actions
OD Optimization #4589: threading: debug validate mutexes with PTHREAD_MUTEX_ERRORCHECK Actions
OD Optimization #4651: malloc / memory handling improvement Actions
OD Optimization #4809: stats: human readable sizes in the stats.log Actions
OD Optimization #4813: stream: reset stream-depth if parser reaches error state Actions
SB Optimization #5083: Proposal: new and compact rule parser for Suricata in Rust Actions
OD Optimization #5089: unifiy address range parsing Actions
OD Optimization #5134: DCERPC: dcerpc.iface keyword not using fast pattern/mpm causes severe performance degradation Actions
OD Optimization #5160: smb: Misguiding keyword smb.named_pipe Actions
OD Optimization #5434: app-layer: fix AppLayerParserGetTx (and friends) param confusion posibilities Actions
OD Optimization #5462: IPS bridge mode -- warn/error if there's an IP address associated with any monitoring interface Actions
OD Optimization #5522: decode: optional optimized tunnel packet handling Actions
CT Optimization #5545: prefilter keyword: increase code coverage Actions
JS Optimization #5583: output: iface shortening more compact Actions
OD Optimization #5643: pcap: rule based conditional pcap logging Actions
OD Optimization #5671: Better way to decide on flows memcap and timeouts Actions
OD Optimization #5679: tracking: useful log output Actions
CT Optimization #5680: eve-log: reduce duplication of info Actions
EL Optimization #5755: datasets: ipv4.src/dst, ip.src/dst check rules should be ip-only Actions
CT Optimization #5801: filemagic keywords: increase code coverage and update documentation (if need be) Actions
OD Optimization #5865: Remove dual tracking mechanisms in output loggers Actions
OD Optimization #5902: detect: "alert dcerpc" sig sets up smb inspect engines Actions
SB Optimization #6011: Research potential performance penalty with filestore feature Actions
OD Optimization #6065: warning _FORTIFY_SOURCE requires compiling with optimization Actions
OD Optimization #6126: compiling with outdated cbindgen does not have a corresponding err msg Actions
AH Optimization #6160: filestore: decide on the impact of eve output over the global filestore settings Actions
OD Optimization #6176: Multi-tenancy: Tenant selector to tenant ID mapping is o(n) Actions
OD Optimization #6190: flow_spare_pool_block_size is a constant defined as a variable Actions
OD Optimization #6221: build: check for compiler warnings/messages Actions
OD Optimization #6246: initialization: do config validation before runtime Actions
OD Optimization #6277: Attach XDP filter with libxdp Actions
CT Optimization #6314: Convert unittests to new FAIL/PASS API - tests/detect-http-client-body.c Actions
CT Optimization #6316: Convert unittests to new FAIL/PASS API - app-layer-detect-proto.c Actions
CT Optimization #6319: Convert unittests to new FAIL/PASS API - util-bloomfilter.c Actions
CT Optimization #6330: Convert unittests to new FAIL/PASS API - tests/stream-tcp-list.c Actions
CT Optimization #6331: Convert unittests to new FAIL/PASS API - util-bloomfilter-counting.c Actions
CT Optimization #6341: Convert unittests to new FAIL/PASS API - decode-ethernet.c Actions
SA Optimization #6343: Convert unittests to new FAIL/PASS API - tests/stream-tcp.c Actions
OD Optimization #6375: detect: merge urilen and bsize implementations Actions
CT Optimization #6416: Suricata not using Myricom SNF driver in a performant way Actions
OD Optimization #6572: runmodes: fix `--list-runmodes` output Actions
CT Optimization #6583: rust: get rid of unused final zeroes in protocol detection patterns Actions
OD Optimization #6611: Fake Tunnels In Fragmented IP Packets Actions
OD Optimization #6632: Do not have any warning with -Wsign-conversion Actions
SB Optimization #6720: flow: explore how red black trees compare to linked list in hash buckets Actions
OD Optimization #6721: hash tables: explore how red black trees compare to linked list in hash buckets Actions
OD Optimization #6730: threading: warn if cpu affinity assigns more than one thread to a core Actions
OD Optimization #6754: libsuricata: restructure directory and files to allow for include files to be name spaced Actions
OD Optimization #6928: source-netmap: improve netmap receive loop packet processing performance Actions
OD Optimization #7006: spm: boyermoore implementation appears to underperforming Actions
PA Optimization #7089: rust transaction iterator runs a useless iteration of the loop Actions
CT Optimization #7163: unix-socket: refuse to startup if compiled w/o --enable-unixsocket Actions
CT Optimization #7189: http/conf: warn or error on invalid value in custom headers logging Actions
OD Optimization #7205: detect: prefilter for app-layer events Actions
PA Optimization #7317: HTTP2 push Actions
CT Optimization #7342: applayer/htp: convert complex unittests to SV ones Actions
OD Optimization #7352: Remove disable-hashing command line option Actions
PA Optimization #7408: GitHub CI: run only CodeQL for python if python fils have changed Actions
EL Optimization #7474: Pcap file mode locking on time synchronization Actions
OD Optimization #7476: Suricata tls.sni check fails when PQC KEMs like kyber Actions
OD Optimization #7483: detect: split SIG_FLAG_INIT_STATE_MATCH Actions
OD Optimization #7563: detect: use named values for buffer priority Actions
OD Optimization #7775: applayer: deduplicate parsers smb/dcerpc and dcerpc Actions
OD Optimization #7792: thresholding: record flow_id's and log them in the eve alert Actions
OD Optimization #7941: landlock: hyperscan cache dir not auto-added Actions
PA Optimization #7966: Relevance of QA UBSan article Actions
OD Optimization #8125: profiling: help investigating memory consumption Actions
OD Optimization #8150: conf: do not use linked lists, but hash tables when needed Actions
OD Optimization #8282: strings: refresh vendored strlcpy/strlcat Actions
OD Optimization #8466: detect/base64: determine behavior if buf size > buf length Actions
SP Optimization #8503: utli/ja3: make Ja3BufferAppendBuffer "consistent" Actions
CT Optimization #8754: Optimizing behavior in case of iplen_smaller_than_hlen Actions
Optimization #8939: datasets/cidr: shadow-swap on bulk update to avoid blocking readers Actions
PA Optimization #8960: http2: improve handling of partially delivered large DATA frames Actions
SZ Optimization #9246: Replace magical numbers in bytetest/bytejump/util-byte by macro Actions
OD Task #570: tracking: memory fragmentation Actions
OD Task #2167: tracking: eve enhancements Actions
VJ Task #2278: tracking: failing better Actions
VJ Task #2309: SuriCon 2017 brainstorm Actions
OD Task #2313: tracking: save & restore state when suricata restarts Actions
VJ Task #2685: SuriCon 2018 brainstorm Actions
PA Task #2757: tracking: improve protocol detection Actions
OD Task #2778: tracking: port app-layer parsers to Rust Actions
JF Task #2975: tracking: convert unittests to new FAIL/PASS API Actions
TG Task #3016: No documentation for "endswith" keyword Actions
VJ Task #3195: tracking: rustify all input Actions
VJ Task #3288: Suricon 2019 brainstorm Actions
CT Task #3291: research: collect common mistakes rulewriters might run into Actions
JI Task #3294: research: Test the maximum size for messages passed to the unix socket Actions
CT Task #3299: tracking: Add support for industrial protocol Actions
CT Task #3300: tracking: Add support for medical protocols Actions
CT Task #3301: Research: Failover support within the current IPS implementation Actions
CT Task #3302: Research: ruleset optimizations Actions
OD Task #3307: Research: evaluate future of lua support in Suricata Actions
OD Task #3318: Research: NUMA awareness Actions
OD Task #3323: tracking: ipv6 evasions Actions
JI Task #3329: Research: WASM as a Lua alternative and for dynamically loadable modules Actions
PA Task #3392: Tracking: protocol detection evasions Actions
OD Task #3553: Tracking: enable GAP recovery for all TCP app-layer protocols Actions
OD Task #3768: research: investigate branch prediction vs likely/unlikely macros Actions
PC Task #3803: Research: use nom-derive Actions
OD Task #3828: pfring support: remove in favor of (externally maintained) plugin Actions
EL Task #3837: research: Investigate clang-tidy usage to enforce coding standards Actions
CT Task #3950: Suricata bash completion Actions
CT Task #3959: Python tool to take ip rules and convert into iprep rule(s) Actions
CT Task #3960: test: python tool to simulate GAP testing Actions
OD Task #4095: tracking: unify rule keyword value parsing Actions
VJ Task #4097: Suricon 2020 brainstorm Actions
JI Task #4101: tracking: plugins Actions
VJ Task #4123: Research: handle different flow tuples in TLS decrypt Actions
CT Task #4146: Research: Hand off packet streams on alerts Actions
CT Task #4151: Research: New protocol support Actions
CT Task #4252: SCTP: session tracking Actions
VJ Task #4380: tracking: improvements to bits, ints, vars Actions
OD Task #4431: libsuricata: Example showing libsuricata as a replacement for libnids (network grep) Actions
OD Task #4432: libsuricata: Wireshark plugin as an example Actions
JI Task #4684: libsuricata: define global context types for instance and per thread storage Actions
CT Task #4714: Improve unittests coverage for Suricata's application layers rust nom parsers Actions
OD Task #4735: tracking: ubsan clean Actions
VJ Task #4762: Suricon 2021 brainstorm Actions
VJ Task #4763: tracking: Suricon brainstorms Actions
VJ Task #4772: tracking: parity between fields logged and fields available for detection Actions
OD Task #4780: tracking config: configuration usability improvements Actions
CT Task #4841: tracking: research evasions wrt malformed IP and TCP options Actions
CT Task #4865: rust/smb/*: add unit tests Actions
OD Task #4867: rust/src/ike/*: add unit tests Actions
OD Task #4868: rust/src/krb/*: add unit tests Actions
OD Task #4869: rust/src/snmp/*: add unit tests Actions
OD Task #4871: tracking: implement frames for all parsers Actions
CT Task #4911: tracking: detect: cleanup tests Actions
OD Task #5052: unittest: create test for checking all app_proto registrations Actions
OD Task #5074: tracking: rules: structured rule input Actions
VJ Task #5195: tracking: give more insight into detection pipeline Actions
OD Task #5257: ci: cargo audit job Actions
JI Task #5433: tracking: reduce number of public data structures Actions
OD Task #5460: eol: include EOL dates in a per branch file in the repo Actions
VJ Task #5488: Suricon 2022 brainstorm Actions
OD Task #5593: research: tunnel: review locking logic Actions
OD Task #5611: tracking: counters: improve efficiency of stats tracking Actions
OD Task #5645: tracking: elephant flow detection Actions
VJ Task #5666: rules: help to visualize how a Suricata rule matches (different contents/offsets) Actions
VJ Task #5685: tracking: active directory protocols support Actions
OD Task #5892: config: remove requirement for suricata.yaml to start with %YAML 1.1 Actions
VJ Task #5893: tracking: deep file awareness and inspection Actions
OF Task #6310: detect/analyzer: add more details for the ttl keyword Actions
OF Task #6315: Convert unittests to new FAIL/PASS API - ippair-storage.c Actions
JS Task #6317: Convert unittests to new FAIL/PASS API - detect-filestore.c Actions
JS Task #6320: Convert unittests to new FAIL/PASS API - detect-base64-data.c Actions
JS Task #6322: Convert unittests to new FAIL/PASS API - util-pool.c Actions
OF Task #6325: Convert unittests to new FAIL/PASS API - detect-urilen.c Actions
CT Task #6326: Convert unittests to new FAIL/PASS API - detect-ssh-software-version.c Actions
OF Task #6327: Convert unittests to new FAIL/PASS API - threads.c Actions
JL Task #6357: detect/analyzer: add more details for the dsize keyword Actions
VJ Task #6443: Suricon 2023 brainstorm Actions
OD Task #6447: readthedocs: CI integration Actions
VJ Task #6473: tracking: detect: smtp keyword coverage Actions
OD Task #6475: detect: smtp.subject keyword Actions
VJ Task #6491: multi-tenant: add selectors Actions
PA Task #6644: tracking: detect: integer as first-class support Actions
OD Task #6752: libsuricata: don't include autoconf.h from other includes Actions
OD Task #6851: eve/syslog: stats message too long for many default configurations Actions
OD Task #6858: libsuricata: hook for flow expectation creation Actions
OD Task #6968: decode: unify decode thread module with receive thread module Actions
OD Task #7080: rust/core: rename and unify namestyling for internal fns Actions
VJ Task #7118: tracking: add support for new protocols Actions
VJ Task #7123: tracking: improve detection capabilities Actions
VJ Task #7336: Suricon 2024 brainstorm Actions
OD Task #7472: Fuzz Target Compilation and Code Coverage Actions
OD Task #7484: engine/analysis: report rule dependencies Actions
OD Task #7499: tracking: rust/plugins: first class support for rust plugins Actions
OD Task #7500: rust/plugins: first class support for eve filtetype plugins Actions
OD Task #7501: rust/plugins: first class support for app-layer plugins Actions
OD Task #7512: engine/analysis: show warning when flowbit wasn't set Actions
OD Task #7531: output: rename "ether_type" field Actions
OD Task #7703: lua: add detection support to the suricata.file lua lib Actions
OD Task #7764: tracking: windows support Actions
JI Task #7782: lib: use libabigail to detect changes to the application binary interface (ABI) Actions
OD Task #7784: detect: list app-layer-event keywords Actions
OD Task #7839: setup-app-layer: update to use full dynamic registration Actions
CT Task #8077: plugins: ndpi 5.0.0 not supported Actions
OD Task #8081: multi-tenant: better handling of "no tenant selector set" error Actions
OD Task #8094: plugins: suricata package manager for plugins and other "packages" Actions
VJ Task #8123: Suricon 2025 Brainstorm Actions
LS Task #8226: dpdk: evaluate use of two net_pcap devices to test IPS Actions
VJ Task #8388: firewall: support protocol hooks for all app-layer protocols Actions
OD Task #8423: stats: add tx count for packets transmitted in ips mode Actions
OD Task #8424: reject: investigate replacing libnet with libpcap Actions
OD Task #8435: firewall: investigate handling of encapsulation/tunneling like GRE/VXLAN Actions
OD Task #8478: firewall: reconsider built-in hooks for UDP protocols Actions
OD Task #8491: firewall: support multi hook rules Actions
JI Task #8549: http: consider making extended the default Actions
OD Task #8631: lib: stream-tcp-private.h is not actually private Actions
OD Task #9022: tracking: app-layer events lost when no open transaction Actions
OD Task #9034: firewall: add PGSQL hooks Actions
AH Documentation #595: document csum keywords Actions
AH Documentation #1233: Documentation for each keyword in stats.log file. Actions
PM Documentation #1691: Docs: Convert windows docs Actions
CT Documentation #1892: rule docs should include example rules Actions
CT Documentation #1974: DNP3: document lua support Actions
OD Documentation #2016: doc: improve keywords self documentation Actions
CT Documentation #2266: no documentation for file-store-waldo Actions
PM Documentation #2404: Windows Installation Guide for Suricata bug Actions
EU Documentation #2470: document content inspection in chunks Actions
OD Documentation #2585: document replace keyword Actions
OD Documentation #2588: document hostbits keyword Actions
SS Documentation #2699: document all eve record types and fields Actions
CT Documentation #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific Actions
CT Documentation #2976: review userguide from beginners point of view Actions
OD Documentation #3018: No documentation for "flowvar" keyword Actions
OD Documentation #3019: No documentation for "pktvar" keyword Actions
OD Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
JT Documentation #3023: No documentation for "bsize" keyword Actions
JT Documentation #3025: Missing docs for "http." keywords Actions
OD Documentation #3027: No documentation for "nfs" keywords Actions
OD Documentation #3031: No documentation for "asn1" keyword Actions
OD Documentation #3032: No documentation for "engine-event" keyword Actions
OD Documentation #3033: document: "stream-event" keyword Actions
OD Documentation #3034: No documentation for "l3_proto" keyword Actions
OD Documentation #3035: No docs for "base64_" keywords Actions
OD Documentation #3036: No documentation for "template2" keyword Actions
AH Documentation #3046: Document each default value from the config file Actions
OD Documentation #3180: tracking: document all decoder and app-layer events Actions
OD Documentation #3181: document http engine events Actions
CT Documentation #3222: userguide: improve guidance on ipv6 configuration Actions
AH Documentation #3268: Add links to additional information at the wiki to the userguide Actions
JT Documentation #3274: doc: some inconsistency between http docs keywords description Actions
OD Documentation #3303: Add a documentation about the used sid and gid ranges Actions
PM Documentation #3313: Document 40Gbps IPS set up Actions
CT Documentation #3748: Add documentation for flags keyword Actions
CT Documentation #3751: Alert metadata JSON configs in suricata.yaml.in should match the RTD documentation Actions
CT Documentation #3762: update documentation for user modes Actions
CT Documentation #4662: Add documentation section covering Suricata rule grammar Actions
CT Documentation #4706: Guide for rulewriting Actions
CT Documentation #4743: Improve Suricata code documentation (C files) Actions
SS Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
CT Documentation #5068: nfs: document rule keyword Actions
OD Documentation #5182: userguide: better document rule keywords Actions
JF Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
OD Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
OD Documentation #5367: byte_test: all examples in doc missing a required argument Actions
OD Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
OD Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
OD Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
OD Documentation #5523: userguide: document the tcp-stream keyword Actions
OD Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
CT Documentation #5591: devguide: bring section about OpenBSD Installation from git into devguide Actions
AH Documentation #5620: doc: add vectorscan instructions Actions
OD Documentation #5660: userguide: add (more) documentation for the GRE protocol Actions
JT Documentation #5662: Review/Update Hyperscan Documentation Actions
OD Documentation #5669: Better link together the bits keywords Actions
OD Documentation #5724: Why does reject-dev option work only in Sniff Mode Actions
OD Documentation #5772: docs: A wrong rule matching example provided by the official doc Actions
OD Documentation #5837: Unify documentation of command-line parameters Actions
OD Documentation #5841: tracker: bring documentation from old wiki on redmine to readthedocs guides Actions
CT Documentation #5842: userguide: bring section about Suricata installation from Ubuntu PPA Actions
OD Documentation #5995: userguide: ips upgrade guide Actions
JI Documentation #6059: docs: fix build failure - urllib3 issue Actions
OD Documentation #6071: eve/schema: add descriptions to the schema Actions
VJ Documentation #6072: eve/schema: document smb Actions
JI Documentation #6073: eve/schema: document dns Actions
VJ Documentation #6074: eve/schema: document nfs Actions
JI Documentation #6077: eve/schema: document sip Actions
OD Documentation #6133: tracking: security deployment documentation Actions
AH Documentation #6150: doc: improve the file-store documentation for the eve output and the dedicated section Actions
CT Documentation #6361: userguide: add note about severity<-> priority on alert section Actions
JT Documentation #6386: Add tls.cert_chain_len Documentation Actions
OD Documentation #6404: flow.reason value is misleading? Actions
OD Documentation #6478: schema: add missing fields Actions
CT Documentation #6694: placement of bitmask note about right shift behavior Actions
JT Documentation #6924: replicate http.cookie behavior from "Differences From Snort" to http.cookie Actions
OD Documentation #6982: offset: no documentation that offset can be a name Actions
JT Documentation #6991: add note about case sensitivity to flowbits docs Actions
OD Documentation #6992: Document normalization of header name/value separator Actions
OD Documentation #7145: userguide: update legacy keyword mentions to new ones Actions
OD Documentation #7217: userguide: add config section on reading pcap-files Actions
CT Documentation #7220: guides: add a post on using 'ip' and 'tcpdump' to Suricata forum's Guides Actions
CT Documentation #7222: userguide: document decoder events Actions
OD Documentation #7223: document 'stream-event' keyword Actions
OD Documentation #7237: userguide: default's to latest development branch instead of latest release tag Actions
CT Documentation #7244: userguide: explain multi-tenant default config Actions
CT Documentation #7298: schema/netflow: add missing field Actions
CT Documentation #7299: eve/schema: document tls Actions
OD Documentation #7355: Non working signatures in filestore explanation Actions
OD Documentation #7385: userguide/redmine: have some instructions for bug reports Actions
OD Documentation #7386: userguide: list which config fields are updated w/ rule reload Actions
OD Documentation #7395: engine/analysis: document the output for user friendliness Actions
OD Documentation #7396: userguide: standardize rst formatting for chapters Actions
OD Documentation #7545: userguide: document user mode and system mode and their relation to the log directory Actions
OD Documentation #7770: json schema : extend to describe how a log field matches to a keyword in complex cases Actions
OD Documentation #7833: Complete list of commands supported by suricatasc Actions
OD Documentation #7897: doc: byte_test missing documentation for bitmask option Actions
OD Documentation #8018: datasets: a rule using "load" can use an absolute or relative filename Actions
OD Documentation #8236: byte_math: fails to list valid values Actions
OD Documentation #8283: flow: better documenation and guidance for recyclers and managers Actions
Documentation #9216: docs: PCRE 'O' modifier applies configured limits instead of overriding them Actions
OD Security #5851: rust: handle allocation failures Actions
OD Security #6187: detect: handle allocation failures during rule reload Actions

Also available in: TXT