Project

General

Profile

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

13%

694 issues   (95 closed — 599 open)

Issues by
Bug

50/226
Feature

13/268
Support

2/2
Optimization

15/64
Task

2/52
Documentation

13/82
Related issues
Bug #317: Invalid Rules Actions
Bug #376: Windows - Failure when trying to get MTU Actions
Bug #437: filemagic / libmagic inconsistent between releases Actions
Bug #500: duplicate values in host-os-policy not detected Actions
Bug #551: Replace SCLogError by a counter for memory issue and other memcap Actions
Bug #569: display syntax requirement on keyword parsing error Actions
Bug #705: http.log missing lots of requests under high traffic load Actions
Bug #708: Flow vars issue in pcap file mode Actions
Bug #747: Reset async flag if stream is found to be non-async Actions
Bug #778: ipv6 addr with nat64 notation Actions
Bug #786: Windows - yaml directory paths Actions
Bug #849: Not alerting on invalid http request Content-Length Actions
Bug #868: Makefile[.in] doesn't use its own INSTALL variable definition Actions
Bug #923: memcap value in suricata.yaml Actions
Bug #924: missing space between variable and value in suricata.yaml Actions
Bug #992: Different alerts reported when reading from pcap file with runmode=single and runmode=autofp Actions
Bug #1083: pfring: valgrind: Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s) Actions
Bug #1084: pfring: valgrind: memory leak at exit in bpf filter Actions
Bug #1152: Write to ipfw divert socket failed: Message too long Actions
Bug #1247: Using suppress in threshold.config does not prevent dropping Actions
Bug #1370: sctp fp on suricata engine Actions
Bug #1382: BPF not reflected in suricata.log when using pf-ring Actions
Bug #1390: suricatasc return empty iface-stat.pkts in IPS nfqueue mode Actions
Bug #1399: Flowbits rules not always evaluated in necessary order Actions
Bug #1412: byte_test checks before byte_extract happens in some cases Actions
Bug #1457: Non-standard prefixes used for file size indication Actions
Bug #1484: Remove BUG_ON(1) statements in the packet path Actions
Bug #1526: Malformed encoded base64 packet in json logs Actions
Bug #1549: flow keywords rule parsing Actions
Bug #1560: Newline in certificate subject name results in premature line break in TLS log Actions
Bug #1593: Negative within error - works in snort Actions
Bug #1722: ip rules don't trigger under the context of 'flow:stateless' Actions
Bug #1738: [ERRCODE: SC_ERR_MEM_ALLOC<1>] - Can not allocate fingerprint string - Suricata 2.0.11-1 Actions
Bug #1754: Inconsistent behavior with 'only_stream' flow keyword Actions
Bug #1770: Suricata takes very long time to start using hyperscan and large/custom detect settings Actions
Bug #1772: Inconsistent number of alerts while reading a pcap - runmode single/autofp,unix-socket Actions
Bug #1782: Unkown TLS's subject attributes Actions
Bug #1833: Transaction can be logged before stream reassembly and parsing are complete Actions
Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible) Actions
Bug #1881: pcap logging out of order Actions
Bug #1911: Commandline provided configuration values don't persist after initial startup Actions
Bug #1918: Incorrect packet stats in pcap and pf_ring capture modes Actions
Bug #1922: runmodes: memory leaks Actions
Bug #1976: ioctl warnings at startup and shutdown with dropped privileges Actions
Bug #1981: luajit states fail to run with valgrind Actions
Bug #2000: eve.http: http_refer should be http_referer Actions
Bug #2013: failure of TCP after DOS attack Actions
Bug #2042: Difference protocol of MD5 rule will restart Suricata automatically Actions
Bug #2056: missing warning on a rule using within with one content keyword Actions
Bug #2069: logging: payload may not represent traffic the generated alert (eve and unified2) Actions
Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml Actions
Bug #2094: luajit: SCFlowvarGet always returns null Actions
Bug #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
Bug #2220: When running on a single-CPU machine, pcap processing takes a long time Actions
Bug #2221: Suricata batch processing slowed down by 0.2s intervals Actions
Bug #2224: Negated http_* match returns false if buffer not populated Actions
Bug #2249: rule with file keyword used with ip or tcp not seen as invalid Actions
Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter Actions
Bug #2289: af-packet bpf filtering failed to select multiple vlan Actions
Bug #2296: Unix Manager Should Not Use Conf Functions to Pass Information to source-pcap-file Actions
Bug #2305: unified2 alerts not including xff ips using extra-data mode Actions
Bug #2337: give warning if permissions won't allow log reopen after dropping privs Actions
Bug #2351: Suricata with alert-prelude option sending only one IDMEF message (not more). Actions
Bug #2358: Inconsistent DNS/flows extracted from pcap Actions
Bug #2373: unix domain socket owner stays root when priviledges dropped Actions
Bug #2378: log rotation 'flag' should be atomic Actions
Bug #2393: One way TLS traffic not properly identified Actions
Bug #2412: Suricatasc isn't showing or allowing pcap file continuous option Actions
Bug #2413: Pcap Interrupt Keeps Pcap File Processing Interrupted Actions
Bug #2423: Suricata 4.0.3 and Napatech crashing Actions
Bug #2424: suri->userid (SCInstance) does not reflect correct uid if suricata is started as non-root Actions
Bug #2429: TCP-session and wrong alert timestamp Actions
Bug #2434: memleak - possible/definite memleaks reported for libnss3 and pthread_create Actions
Bug #2462: memleak: gitmaster json dns logger - 4.1.0-dev (rev efdc592) Actions
Bug #2477: 802.1ah & Untagged Traffic Actions
Bug #2478: PCAP logging does not include 802.1q header when using af-packet Actions
Bug #2479: http_cookie negation fails if no cookie in traffic Actions
Bug #2494: Invalid Base64 payload for filemd5 alerts Actions
Bug #2500: stored will always equal false in fileinfo events Actions
Bug #2581: content match fails with on large streams Actions
Bug #2614: filemagic: pdf filemagic match Actions
Bug #2623: Missing http.status information in eve.log according to tcp packets. Actions
Bug #2627: lua: load script from same location as rule file if not in default rule location Actions
Bug #2656: Alerts not triggered under some conditions on traffic containing rule matches Actions
Bug #2680: eve output filetype:unix_dgram does not start a socket Actions
Bug #2712: long wait time on exit - pcap read - unable to get all packet threads to process their packets in time Actions
Bug #2718: pkts/drops counters discrepancy Actions
Bug #2739: Incorrect detection of the jit support of libpcre Actions
Bug #2763: different number of events on exact same runs with asan and no asan builds Actions
Bug #2807: DNS LUA Logging does not have any way to log NXDOMAIN Actions
Bug #2814: suricatasc: hangs indefinitely and uses too much processing for pcap-file-continuos command Actions
Bug #2815: race condition during file-magic initialization Actions
Bug #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN Actions
Bug #2861: Suricata rule sid:2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman) not works Actions
Bug #2886: IMAP fail to register app layer protocol detection Actions
Bug #2891: Empty rrname in DNS answer for non-recurse NS answers Actions
Bug #2917: Unable to find the sm in any of the sm lists Actions
Bug #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific Actions
Bug #2928: alerts on icmp signatures in 4.0.x and 4.1.x Actions
Bug #2933: Suricata 4.1.3 block flow Actions
Bug #2934: VLAN tags stripped when saving pcap log Actions
Bug #2954: Strange interaction with afpacket - high CPU usage and no packet processing Actions
Bug #2960: valgrind gives 'Conditional jump or move depends on uninitialised value(s)' Actions
Bug #2963: scan-build warnings for pcap logging Actions
Bug #2973: the flow after match the rules Actions
Bug #2978: IRC traffic parsed by FTP Actions
Bug #2988: redis fails sometimes to reload rules to suricata; restart of redis fixes Actions
Bug #3026: Windows MSI - add in service scripts Actions
Bug #3040: pcap: with -r <single file> pcap_open_offline failure does not lead to non-zero exit code Actions
Bug #3041: snmp parsing error message Actions
Bug #3049: thread hangs in pfring mode Actions
Bug #3065: tls_cert_XX keywords date format parsing error Actions
Bug #3066: No documentation for hostbits Actions
Bug #3071: coverity warning in tls wrt tainted scalars Actions
Bug #3075: RX thread hang in pcap-file mode Actions
Bug #3083: DROP rule with "noalert" Actions
Bug #3087: Prelude output IDMEF message issue Actions
Bug #3090: pfring compile err - openSUSE Tumbleweed , Ubuntu Eoan/ Debian unstable Actions
Bug #3093: FTP logging needs suricata-verify tests Actions
Bug #3095: default log dir not always honored - git master Actions
Bug #3097: build for eBPF programs needs a way to specify Linux header location Actions
Bug #3117: multiple valgrind reported warnings - 5.0.0-dev (9e126b210 2019-08-07) Actions
Bug #3145: scan-build warning for af-packet Actions
Bug #3146: scan-build warning for asn1 parser Actions
Bug #3147: scan-build warning for mime decoder Actions
Bug #3148: scan-build warnings for ac implementations Actions
Bug #3149: scan-build warnings in radix implementation Actions
Bug #3150: scan-build warnings for detect address handling Actions
Bug #3151: scan-build warning for detect port handling Actions
Bug #3152: scan-build warning for detect sigordering Actions
Bug #3179: http_header_names not generating alerts Actions
Bug #3182: warn user on wildcard usage without quotes Actions
Bug #3191: When run suricata with pf_ring zc mode suricata did not try to connect redis. Actions
Bug #3220: ssl_version keyword negation (!) not working Actions
Bug #3221: EBPFDeleteKey -- ERRCODE: SC_ERR_SYSCALL(50) Actions
Bug #3235: Makefile:936: recipe for target 'install-rules' failed Actions
Bug #3238: rust compile fail on ppc64el Actions
Bug #3253: tls: handling of 'Not Before' date before unix epoch Actions
Bug #3257: Lua PANIC: unprotected error in call to Lua API (stack overflow) Actions
Bug #3309: xdp: some bypass stats/counters do not update properly Actions
Bug #3323: tracking: ipv6 evasions Actions
Bug #3336: Suricata compilation on windows / mingw Actions
Bug #3348: Possible detection issue with VXLAN parser Actions
Bug #3349: Suricata 5.0 crashes while rule reload Actions
Bug #3353: xdp_filter segmentation fault util-ebpf.c:728 Actions
Bug #3354: eve-log dns (possibly others) alerts miss metadata for all but first packet Actions
Bug #3358: bypass_filter AFPBypassCallback Segmentation Fault Actions
Bug #3359: suricata.log ownership not being set to run-as user/group Actions
Bug #3370: Suricata 5.0.0 Crashes Intermittently Actions
Bug #3371: 'suricatasc -c conf-get ...' returns outdated values after reloading suricata Actions
Bug #3617: Missing icmp netflow Actions
Bug #3681: Rule reload causes segfault Actions
Bug #3692: delta calculations come up negative Actions
Bug #3698: Incorrect max length of windivert filter Actions
Bug #3728: ftp file extraction failure Actions
Bug #3746: bsize needs to err upon non possible matching conditions (4.1.x) Actions
Bug #3889: Support interfaces with MTU > 1500 Actions
Bug #3900: After a completed rule reload, Suricata sometimes is stuck for 1h with `rs_nfs_state_get_tx` peak Actions
Bug #4063: rdata field not included in DNS log for NS rrtype Actions
Bug #4178: DNS Query triggers alert but no output in alert-debug.log Actions
Bug #4214: Honor vlan: use-for-tracking in ebpf maps Actions
Bug #4356: Napatech memory leaks Actions
Bug #4357: Napatech memory corruption Actions
Bug #4370: the latest release of Suricata V6.0.1 for Windows use high CPU Actions
Bug #4426: XDP redirect cpu likely broken in 5.9 Actions
Bug #4843: IPv6 evasion : dos mld chiron Actions
Bug #5012: Remove duplicate definition of constants between C and Rust Actions
Bug #5064: frames: duplicate alerts when no flow direction provided Actions
Bug #5071: Suricata RAM usage never decreasing Actions
Bug #5072: detect/ip_proto: inconsistent behavior when specifying protocol by string Actions
Bug #5087: smb: file.name sticky buffer doesn't match all smb files Actions
Bug #5133: DCERPC: master - logs not created Actions
Bug #5134: DCERPC: dcerpc.iface keyword not using fast pattern/mpm causes severe performance degradation Actions
Bug #5135: DCERPC: dcerpc.iface keyword alert results differ from 5 vs 6/master Actions
Bug #5140: nfs: NFS3/NFS2 procedure conflict Actions
Bug #5160: smb: Misguiding keyword smb.named_pipe Actions
Bug #5172: Napatech stream mismanagement following non-transient error Actions
Bug #5176: False positive when negated content is far ahead of matching content. Actions
Bug #5185: MIME URL extraction missing. Actions
Bug #5186: tenant_id should have consistent data type across all structs Actions
Bug #5199: Setting flow memcap too low tries to allocate the whole system memory Actions
Bug #5200: libbpf: Use of legacy code in eBPF/XDP programs Actions
Bug #5204: Memory leak caused by ippair processing Actions
Bug #5222: SSH built-in rules are not included in the source tarball Actions
Bug #5247: Applayer Detect protocol only one direction Actions
Bug #5255: Reported pcap_filename in alerts are not correct Actions
Bug #5263: Flow is stuck if there is no traffic Actions
Bug #5264: random value for ja3 and ja3s hashes during the next scan Actions
Bug #5287: (Maybe) issues in FTP decoder, Suricata stop analyzing traffic Actions
Bug #5290: pip install failure Actions
Bug #5292: cppcheck: "portability" warnings: using void pointers in calculations Actions
Bug #5293: cppcheck: "portability" warnings: non thread-safe functions Actions
Bug #5299: YAML warning from default config on 6.0.5 Actions
Bug #5320: Key collisions in HTTP JSON eve-logs Actions
Bug #5332: Smb2 can not store files! Actions
Bug #5362: Suricata version is 6.0.4 on Ubuntu 22.04 "Jammy" Actions
Bug #5363: Memory leak in rust SMB file tracker Actions
Bug #5406: HTTP Req and resp correlation incorrect Actions
Bug #5407: suricatasc runtime error Actions
Bug #5410: Shivani's test Actions
Bug #5432: events: PACKET_RECYCLE does not reset event_last_logged (5.0.x backport) Actions
Bug #5437: 'unseen' http midstream packets Actions
Bug #5439: Invalid certificate when Issuer is not present. Actions
Bug #5445: RX thread hang in pcap-file mode Actions
Bug #5451: Non-Deterministic Behavior with HTTPS Checksum Verification Actions
Bug #5462: IPS bridge mode -- warn/error if there's an IP address associated with any monitoring interface Actions
Bug #5464: eve: if alert and drop rules match for a packet, "alert.action" is ambigious Actions
Bug #5480: Cannot compile Suricata 6.0.6 with PF_RING support Actions
Bug #5486: Ethernet metadata is missing for some protocols or parts of a protocol Actions
Bug #5490: Applayer Detect protocol only one direction - NFS Actions
Bug #5491: SMTP response 221 appears to generate an SMTP invalid response alert Actions
Bug #5492: Applayer Detect protocol only one direction - Kerberos Actions
Bug #5493: Suricata 6.0.6 compile fails on Mingw64 multiple times Actions
Bug #5498: Core crash with flow-worker.c Assertion CheckWorkQueue Actions
Bug #5502: Suricata hangs and then exits when the first PCAP processed has 0 packets Actions
Bug #5520: If alert status code is 200, some fields are missing Actions
Bug #5541: Unexpected behavior of `endswith` in combination with negated content matches Actions
Bug #5562: rule_perf.log with multiple sort orders is invalid JSON Actions
Bug #5576: Dataset is setting data despite the signature being a complete match Actions
Bug #5582: dpdk: iface shortening for pcie addresses Actions
Bug #5625: FlowSwapFileFlags function is incorrect Actions
Bug #5656: rules: engine analysis gives false positive warning Actions
Bug #5667: Enable rule profiling via socket Actions
Bug #5704: Filestore is not working if landlock is enabled Actions
Bug #5711: runmodes: Suricata does not hint anything about missing runmode Actions
Bug #5713: TLSv1 not logged into tls events. Actions
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #548: Use bloomfilter for filemd5 Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #614: Rate limiting messages Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #721: full nfq zero copy mode Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #808: Support the new GSO-avoidance NFQ feature Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: conditional logging: output steering Actions
Feature #843: Custom http logging filter functionality Actions
Feature #845: Memory consumption in stats.log Actions
Feature #870: luajit: global vars Actions
Feature #880: memcap http parser Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1215: journald logging support Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1250: protocol: Multipath TCP (mptcp) Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1469: Use ISO 8601 date/time formats Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: lua: better notification in verbose mode on script errors Actions
Feature #1505: lua: show lua scripts during rule (re)loading Actions
Feature #1520: multitenancy - verbose output clarity Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1971: lua: make mandatory Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2167: eve-ng Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2284: detect partial file transfers Actions
Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2316: global memcap Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2363: pcap: read directories recursively Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2388: smtp: log md5 of attachments Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2538: dsize keyword improvements Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2644: Add direction of stream to eve-json events Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2695: websocket support Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2727: DCERPC UID to name mapping Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules: input in json format Actions
Feature #2757: improve protocol detection Actions
Feature #2759: iprep: more granularity Actions
Feature #2764: dns logging v1 vs v2 Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2818: Napatech Bypass support Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: lua: Exposing byte extract to script Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2932: add batman-adv decode support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2962: eve: log more IKEv2 fields Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3105: Add kafka output Actions
Feature #3212: Prevent duplicate pcaps from being re-processed Actions
Feature #3243: POP3 Support Actions
Feature #3244: IMAP Support Actions
Feature #3245: Email extraction to separate folder Actions
Feature #3246: Logging of Email body Actions
Feature #3260: SMTP Base64 Decoding of Message Body Actions
Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
Feature #3271: Add keyword to determine flow based speed/bw Actions
Feature #3290: use config vars everywhere Actions
Feature #3295: Unix socket: support to receive flow shunting information Actions
Feature #3296: Include in the fileinfo if it was a duplicate Actions
Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
Feature #3310: ease suricata configuration with xdp Actions
Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
Feature #3316: Unix socket: support dumping flow table Actions
Feature #3317: rules: use rust for tokenizing rules Actions
Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
Feature #3321: Evaluate different encoders for eve-log Actions
Feature #3338: vxlan: log vni in eve Actions
Feature #3351: sip: parse traffic over tcp Actions
Feature #3373: add init service file example script for Debian/Ubuntu Actions
Feature #3383: nflog: use mnl api Actions
Feature #3446: app-layer: implement MySQL parser Actions
Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
Feature #3663: DNS: Parse and extract DNS NULL records Actions
Feature #3675: Testimony support Actions
Feature #3688: Re-implement fast_pattern:only; in some way Actions
Feature #3953: 8021BR E packet decoder Actions
Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
Feature #4140: IEC104 Protocol Support Actions
Feature #4147: Map rules to MITRE ATT&CK Actions
Feature #4148: Research: SSH Support for additional protocol analysis Actions
Feature #4149: Research: Dynamic datasets Actions
Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
Feature #4175: dcerpc: higher level logging Actions
Feature #4249: SS7 Protocol Support Actions
Feature #4250: Diameter Protocol Support Actions
Feature #4325: xdp compile warnings on 5.4 kernels Actions
Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
Feature #4398: support regex match and flowvars as keywords value Actions
Feature #4547: pcrexform not support tcp and other protocol Actions
Feature #4573: add IPS drop total to eve log output Actions
Feature #4853: eve: Add information about Suricata version Actions
Feature #4951: datalink type 276 not yet supported Actions
Feature #4968: QUIC v2 support Actions
Feature #4974: Log references to Eve Actions
Feature #4985: quic: support frames Actions
Feature #5051: output/frames: allow tx logging to reference frames Actions
Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
Feature #5069: smb: SMB keyword for match the smb command Actions
Feature #5075: smb: keyword for the SMB version Actions
Feature #5128: Light weight packet profiling Actions
Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
Feature #5206: Buffer Dump Utility Actions
Feature #5209: Add "status" mode to Suricata's socket command interface Actions
Feature #5217: ips: allow dropping of flow if applayer specific memcap is hit Actions
Feature #5245: allow fast_pattern on base64_data strings Actions
Feature #5365: Limit rust 'filetracker' memory in configuration Actions
Feature #5372: Add support for encrypted traffic analysis Actions
Feature #5405: Make suricata point to where to report a bug Actions
Feature #5415: tftp: support keywords such as file.name, file.data etc... Actions
Feature #5440: multiple stats EVE logs with different intervals Actions
Feature #5446: allow ranges in dns.opcode value Actions
Feature #5450: Rule keyword for non midstream flows Actions
Feature #5461: eve: Use threaded output by default Actions
Feature #5466: detect: allow alert-then-pass logic Actions
Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
Feature #5470: reject: allow reject dev to be specified in the yaml Actions
Feature #5489: research: multi version rules; or version dependent rules Actions
Feature #5499: PCAP-over-IP client Actions
Feature #5618: setup-app-layer: add option to choose TCP/UDP protocol Actions
Feature #5639: Allow dataset to match on extracted domain Actions
Feature #5640: frames: tx frames Actions
Feature #5641: dns: frame based keywords for "raw" fields in requests and responses Actions
Feature #5642: DNS: parity between log fields and detection Actions
Feature #5646: rules: allow matching on flow pkts and bytes Actions
Feature #5647: rules: mark flow as elephant flow Actions
Feature #5648: flowworker: hearistic to see how busy a thread is with elephant flows Actions
Feature #5649: eve.flow: add thread id(s) processing a flow to the record Actions
Feature #5650: unix socket: query threads about most recent elephant flows Actions
Feature #5653: Add OID values to SNMP logs Actions
Feature #5655: host: make memuse and memcap reached counters for host table Actions
Feature #5657: byte_test: allow comparison with static value Actions
Feature #5665: rules: bidirectional transaction matching Actions
Feature #5668: eve: optionally add rule fast_pattern Actions
Feature #5670: Support wide strings somehow Actions
Feature #5673: capture: option to decapsulate everything first Actions
Feature #5674: Support layered protocols Actions
Feature #5675: protocol: MMS SCADA support Actions
Feature #5676: ASN1 Spec to Rust nom generator Actions
Feature #5677: protocol: BGP support Actions
Feature #5681: datasets: add more transform layers to match on domains Actions
Feature #5687: eve: "auth" and/or "auth_fail" log Actions
Feature #5692: Add brotli content encoding to HTTP/1.1 Actions
Feature #5705: Add Wireguard parser Actions
Support #2998: Rules Reload doesn't work properly Actions
Support #3037: The rules detect order Actions
Optimization #426: sid based thresholding data structure improvement Actions
Optimization #536: share ctx for filemd5 keyword if identical files are used Actions
Optimization #573: reduce allocs in signature parsing Actions
Optimization #795: stream: use pool instead of direct SACK record allocs Actions
Optimization #945: remove useless includes Actions
Optimization #1046: replace pcre_get_substring with pcre_copy_substring Actions
Optimization #1094: Special check for first character of buffer Actions
Optimization #1188: Don't use iface name in GetIfaceMaxHWHeaderLength Actions
Optimization #1222: Boyer Moore content not shared between same content Actions
Optimization #1313: All Free functions should correctly handle NULL pointers Actions
Optimization #1595: Suricata starts in known conditions of no data Actions
Optimization #1718: Time stamp in Log files should be ISO 8601 format Actions
Optimization #1749: Log PACKET_DROP in inline mode for invalid states as well Actions
Optimization #2317: rcu Actions
Optimization #2321: yaml: clean up usage of lists Actions
Optimization #2405: Use FileTruncateAllOpenFiles for every app layer protocol Actions
Optimization #2460: Reduce timeout in unix-socket when multiple pcaps are enqueued Actions
Optimization #2582: document flags keyword Actions
Optimization #2584: document tag keyword Actions
Optimization #2586: document flowvar keyword Actions
Optimization #2587: document pktvar keyword Actions
Optimization #2590: document nfq_set_mark keyword Actions
Optimization #2593: document pkt_data keyword Actions
Optimization #2594: document dce keywords Actions
Optimization #2595: document asn1 keyword Actions
Optimization #2596: document engine-event keyword Actions
Optimization #2597: document stream-event keyword Actions
Optimization #2598: document l3_proto keyword Actions
Optimization #2599: document base64 keywords Actions
Optimization #2687: current suricata.yaml is missing rotate-interval "example" Actions
Optimization #2750: document nfs-keywords Actions
Optimization #2780: Convert DNP3 from C to Rust Actions
Optimization #2781: Convert ENIP from C to Rust Actions
Optimization #2979: replace mime decoder with rust based implementation Actions
Optimization #3127: Unable to set XDP on 'ens2f0': Invalid argument (-22) - Mellanox cards and Intel cards with jumbo frames Actions
Optimization #3160: clean up error codes Actions
Optimization #3206: improve int handling Actions
Optimization #3213: improve rule parsing warnings Actions
Optimization #3304: generic way to register buffers for logging and detection Actions
Optimization #3305: Tracking ticket: which parts of the engine should be dynamic Actions
Optimization #3314: rust: integrate log crate with suricata logging Actions
Optimization #3322: Use standard CRC32 for hash-like functions Actions
Optimization #3337: Python is assumed to be installed in the same --prefix as suricata Actions
Optimization #3524: Remove unsafe Rust code for ALPROTO_X constants Actions
Optimization #3544: Have small signature match context without allocation Actions
Optimization #3637: Performance impact of Cisco Fabricpath Actions
Optimization #3847: mpm: use Rust Aho-Corasick crate Actions
Optimization #4318: app-layer: "close" all txs if protocol reaches error state Actions
Optimization #4591: Fix Rust clippy lints Actions
Optimization #5083: Proposal: new and compact rule parser for Suricata in Rust Actions
Optimization #5089: unifiy address range parsing Actions
Optimization #5311: ftp: use unsigned integer for input_len Actions
Optimization #5434: app-layer: fix AppLayerParserGetTx (and friends) param confusion posibilities Actions
Optimization #5453: af-packet ips: floods packets that should be learned Actions
Optimization #5517: decode: big clean up (macros and functions) Actions
Optimization #5522: decode: optional optimized tunnel packet handling Actions
Optimization #5583: output: iface shortening more compact Actions
Optimization #5634: Unify ValidateCallback for MD5-like keywords Actions
Optimization #5636: template: remove C app-layer (as there is the rust one) Actions
Optimization #5643: pcap: rule based conditional pcap logging Actions
Optimization #5671: Better way to decide on flows memcap and timeouts Actions
Optimization #5679: tracking: useful log output Actions
Optimization #5680: eve-log: reduce duplication of info Actions
Optimization #5699: dcerpc: switch to incomplete api for tcp Actions
Task #570: tracking: memory fragmentation Actions
Task #2278: tracking: failing better Actions
Task #2313: tracking: save & restore state when suricata restarts Actions
Task #2685: SuriCon 2018 brainstorm Actions
Task #2778: tracking: port app-layer parsers to Rust Actions
Task #2975: convert unittests to new FAIL/PASS API Actions
Task #3016: No documentation for "endswith" keyword Actions
Task #3153: tracking: scan-build warnings Actions
Task #3195: tracking: rustify all input Actions
Task #3291: collect common mistakes rulewriters might run into Actions
Task #3294: Test the maximum size for messages passed to the unix socket Actions
Task #3299: Tracking: Add support for industrial protocol Actions
Task #3300: Tracking: Add support for medical protocols Actions
Task #3301: Research: Failover support within the current IPS implementation Actions
Task #3302: Research: ruleset optimizations Actions
Task #3307: Research: evaluate future of lua support in Suricata Actions
Task #3318: Research: NUMA awareness Actions
Task #3329: Research: WASM as a Lua alternative and for dynamically loadable modules Actions
Task #3554: modbus: support GAP recovery Actions
Task #3803: Research: use nom-derive Actions
Task #3828: pfring support: remove in favor of (externally maintained) plugin Actions
Task #4146: Research: Hand off packet streams on alerts Actions
Task #4151: Research: New protocol support Actions
Task #4252: SCTP: session tracking Actions
Task #4380: tracking: improvements to bits, ints, vars Actions
Task #4431: libsuricata: Example showing libsuricata as a replacement for libnids (network grep) Actions
Task #4714: Improve unittests coverage for Suricata's application layers rust nom parsers Actions
Task #4735: tracking: ubsan clean Actions
Task #5052: unittest: create test for checking all app_proto registrations Actions
Task #5074: rules: structured rule input Actions
Task #5181: detect/engine-analyzer: add rule analyzer warnings about rules that could use the frame keyword/semantics/feature Actions
Task #5195: tracking: give more insight into detection pipeline Actions
Task #5256: rust: see if we can reduce number of crate deps Actions
Task #5257: ci: cargo audit job Actions
Task #5433: tracking: reduce number of public data structures Actions
Task #5460: eol: include EOL dates in a per branch file in the repo Actions
Task #5496: detect/parse: add tests for parsing signatures with reject and drop action Actions
Task #5504: exceptions: error out when invalid configuration value is passed Actions
Task #5510: stream (midstream): investigate - Suri drops flow but still logs second packet of the flow Actions
Task #5586: rust/applayertemplate: remove pub and no_mangle from extern functions that don't need it Actions
Task #5593: tunnel: review locking logic Actions
Task #5611: tracking: counters: improve efficiency of stats tracking Actions
Task #5613: counters: reduce size of data structure Actions
Task #5614: counters: compress id space in a thread Actions
Task #5615: counters: avoid duplicate work Actions
Task #5626: doc: document file.data Actions
Task #5628: github-ci: add windows + windivert build Actions
Task #5632: Disable swf decompression by default Actions
Task #5645: tracking: elephant flow detection Actions
Task #5666: rules: help to visualize how a Suricata rule matches (different contents/offsets) Actions
Task #5678: tracking: Parse protocols that are not over TCP/UDP Actions
Task #5685: tracking: active directory protocols support Actions
Documentation #595: document csum keywords Actions
Documentation #1233: Documentation for each keyword in stats.log file. Actions
Documentation #1691: Docs: Convert windows docs Actions
Documentation #1892: rule docs should include example rules Actions
Documentation #1974: DNP3: document lua support Actions
Documentation #2016: doc: improve keywords self documentation Actions
Documentation #2266: no documentation for file-store-waldo Actions
Documentation #2404: Windows Installation Guide for Suricata bug Actions
Documentation #2470: document content inspection in chunks Actions
Documentation #2585: document replace keyword Actions
Documentation #2588: document hostbits keyword Actions
Documentation #2589: document decode-event Actions
Documentation #2620: Documentation: tagged_packets / event_type packet Actions
Documentation #2699: document all eve record types and fields Actions
Documentation #2976: review userguide from beginners point of view Actions
Documentation #3015: Missing documentation for "tag" keyword Actions
Documentation #3018: No documentation for "flowvar" keyword Actions
Documentation #3019: No documentation for "pktvar" keyword Actions
Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
Documentation #3023: No documentation for "bsize" keyword Actions
Documentation #3025: Missing docs for "http." keywords Actions
Documentation #3027: No documentation for "nfs" keywords Actions
Documentation #3028: No documentation for "pkt_data" keyword Actions
Documentation #3031: No documentation for "asn1" keyword Actions
Documentation #3032: No documentation for "engine-event" keyword Actions
Documentation #3033: No documentation for "stream-event" keyword Actions
Documentation #3034: No documentation for "l3_proto" keyword Actions
Documentation #3035: No docs for "base64_" keywords Actions
Documentation #3036: No documentation for "template2" keyword Actions
Documentation #3046: Document each default value from the config file Actions
Documentation #3180: tracking: document all decoder and app-layer events Actions
Documentation #3181: document http engine events Actions
Documentation #3222: Configuring ipv6 Actions
Documentation #3268: Add links to additional information at the wiki to the userguide Actions
Documentation #3274: doc: some inconsistency between http docs keywords description Actions
Documentation #3303: Add a documentation about the used sid and gid ranges Actions
Documentation #3313: Document 40Gbps IPS set up Actions
Documentation #3748: Add documentation for flags keyword Actions
Documentation #4584: Rust doc: add docstring to rust module files Actions
Documentation #4658: Add/improve documentation for pcre substring capture logging Actions
Documentation #4662: Add documentation section covering Suricata rule grammar Actions
Documentation #4697: devguide: document app-layer frame support Actions
Documentation #4706: Guide for rulewriting Actions
Documentation #4709: Add page about Analizing Suricata performance Actions
Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
Documentation #4929: devguide: bring Contributing process page into it Actions
Documentation #5068: nfs: document rule keyword Actions
Documentation #5088: file.name sticky buffer is not documented Actions
Documentation #5129: devguide: clarify style guide for getframe functions Actions
Documentation #5182: userguide: better document rule keywords Actions
Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
Documentation #5267: Meaning of insert_list_fail counter Actions
Documentation #5274: devguide: document how the alert flow works Actions
Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
Documentation #5367: byte_test: all examples in doc missing a required argument Actions
Documentation #5375: Improve documentation for TLS logging options Actions
Documentation #5393: devguide: move github workflow document from redmine into devguide Actions
Documentation #5449: userguide: document how suricata processes rules internally Actions
Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
Documentation #5485: userguide: explain that the http.header_names buffer is normalized Actions
Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
Documentation #5494: userguide: update tls eve-log fields 'not_before' and 'not_after' Actions
Documentation #5512: userguide: add subsection about setting up Suri in IPS mode with Netmap Actions
Documentation #5513: userguide: add a chapter for IPS mode Actions
Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
Documentation #5515: userguide: add a dedicated chapter/section for the Exception Policies Actions
Documentation #5519: userguide: update 'dsize' examples and documentation Actions
Documentation #5523: userguide: document the tcp-stream keyword Actions
Documentation #5531: userguide: ensure documentation is up to date Actions
Documentation #5532: userguide: have a section to mention and document the various ways stream-depth can be set Actions
Documentation #5534: userguide: better document what TCP midstreams are for Suricata Actions
Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
Documentation #5543: userguide: document which keywords accept the prefilter keyword Actions
Documentation #5585: devguide: bring section about installation from redmine wiki into DevGuide Actions
Documentation #5591: devguide: bring section about OpenBSD Installation from git into devguide Actions
Documentation #5596: doc/optimization: move 'suricata.git/doc/userguide/convert.py' to Python3 Actions
Documentation #5612: devguide: add a chapter about Suricata's exception policies Actions
Documentation #5620: doc: add vectorscan instructions Actions
Documentation #5660: userguide: add (more) documentation for the GRE protocol Actions
Documentation #5662: Review/Update Hyperscan Documentation Actions
Documentation #5669: Better link together the bits keywords Actions
Documentation #5690: Document the differences between IPS and IDS mode. Actions