suricata

Commit Graph

Author	SHA1	Message	Date
Giuseppe Longo	edc2a583a9	rust/sip: add SIP logger	7 years ago
Zach Kelly	caef8b5b38	protocol parser: rdp Initial implementation of feature 2314: 1. Add protocol parser for RDP 2. Add transactions for RDP negotiation 3. Add eve logging of transactions	7 years ago
Jeff Lucovsky	1930b1f504	eve/ftp: Log FTP transactions This changeset includes changes that 1. Add transaction support to the FTP parser 2. Support eve json logging of FTP transactions	7 years ago
Pierre Chifflier	ed4823bbe8	SNMP: add missing case for profiling enum	7 years ago
Jeff Lucovsky	a8938f449d	logging: Anomaly logging This changeset adds anomaly logging to suricata for issue 2282. Anomaly logging is controlled via the `anomaly` section within eve-log. There is a single option -- `packethdr` -- for including the packet header in the anomaly.	7 years ago
Victor Julien	d6903e70c1	file-log: remove and add warning Feature was deprecated and scheduled for removal. Ticket #2376	7 years ago
jason taylor	683be94830	profiling: set loop limit to match array size Signed-off-by: jason taylor <jtfas90@gmail.com>	8 years ago
Victor Julien	17e7d179d0	profiling/csv: update output format Update output to be: pcap_cnt,total,receive,decode,flowworker,threading,proto detect,flow, stream,app-layer,detect,tcp-prune,loggers,<detect stages>,<loggers> For TCP, the app-layer cost is not part of stream anymore.	8 years ago
Jason Ish	ee3aba9008	templates: C stub output for Rust logger	8 years ago
Victor Julien	1f16b42d78	profiling: add missing logger labels	8 years ago
Victor Julien	75d7c9d64a	rust/smb: initial support Implement SMB app-layer parser for SMB1/2/3. Features: - file extraction - eve logging - existing dce keyword support - smb_share/smb_named_pipe keyword support (stickybuffers) - auth meta data extraction (ntlmssp, kerberos5)	8 years ago
Jason Ish	34811cf69e	json-vars: rename to metadata and use new metadata format	9 years ago
Victor Julien	11cb84ad35	detect: profiling update for new detect code	9 years ago
Victor Julien	cf2feeecf4	detect/prefilter: redo profiling	9 years ago
Victor Julien	044e7b8e20	output: add missing dnp3 profiling labels	9 years ago
Victor Julien	d634140fa2	logging: unique id's per log direction For loggers that register once per direction, use unique id's per direction. Reshuffle id's to keep tx log id's low so we can use u32 for tracking logged loggers.	9 years ago
Victor Julien	e7428b321d	profiling: fix app-layer profiling and csv output	9 years ago
Jason Ish	bb10bd7fca	profiling: fix const compiler warnings	9 years ago
Victor Julien	ab1200fbd7	compiler: more strict compiler warnings Set flags by default: -Wmissing-prototypes -Wmissing-declarations -Wstrict-prototypes -Wwrite-strings -Wcast-align -Wbad-function-cast -Wformat-security -Wno-format-nonliteral -Wmissing-format-attribute -funsigned-char Fix minor compiler warnings for these new flags on gcc and clang.	9 years ago
Victor Julien	e3bd5f371d	detect: more detailed state profiling	9 years ago
Victor Julien	5ca4a2e6fe	outputs: vars log EVE addition called 'vars' that logs pkt/flow vars for each packet/flow.	10 years ago
Victor Julien	addf64f1f7	profiling: fix memory leaks	10 years ago
Jason Ish	92885d6960	profiling: fix shadow error Local variable store was shadowing variable in function definition.	10 years ago
Victor Julien	dba14b676c	profiling: more prefilter profiling	10 years ago
Victor Julien	36f713c8d4	prefilter: in profiling print totals	10 years ago
Victor Julien	8798bf48b2	profiling: support prefilter engines	10 years ago
Mats Klepsland	4172c4c8ac	tls: add (mpm) keyword tls_cert_subject This keyword is a replacement for tls.subject.	10 years ago
Mats Klepsland	9b2717799c	tls: add (mpm) keyword tls_cert_issuer This keyword is a replacement for tls.issuerdn.	10 years ago
Jason Ish	04a44a077d	logging: convert pcap log to non-thread module	10 years ago
Jason Ish	fa27a76462	logging: add profiling back for non-tmm loggers The loggers moved away from a TMM required a new profiling support.	10 years ago
Victor Julien	b3bf7a5729	output: introduce config and perf output levels Goal is to reduce info output	10 years ago
Victor Julien	e09643c396	flow worker: profiling Previously the detect and stream code lived in their own thread modules. This meant profiling showed their cost as part of the thread module profiling logic. Now that only the flow worker is a thread module this no longer works. This patch introduces profiling for the 3 current flow worker steps: flow, stream, detect.	10 years ago
Victor Julien	4a96820320	stream-tcp: more cleanups	10 years ago
Mats Klepsland	a13df67864	detect: add (mpm) keyword for tls_sni Match on server name indication (SNI) extension in TLS using tls_sni keyword, e.g: alert tls any any -> any any (msg:"SNI test"; tls_sni; content:"example.com"; sid:12345;)	10 years ago
Jason Ish	796dd5223b	tests: no longer necessary to provide successful return code 1 pass, 0 is fail.	10 years ago
Victor Julien	cc4f7a4b96	detect: add profiling for non-mpm list build & filter	12 years ago
Victor Julien	485f34134e	unix socket: support profiling	12 years ago
Ken Steele	8f1d75039a	Enforce function coding standard Functions should be defined as: int foo(void) { } Rather than: int food(void) { } All functions where changed by a script to match this standard.	12 years ago
Victor Julien	2646edc129	Profiling: fix compilation on CentOS5 Bug #1207	12 years ago
Victor Julien	6dd10443ce	profiling: output log api modules separately Skip log api thread modules in the regular 'thread modules' list, instead print them in a separate list.	13 years ago
Victor Julien	a37a1d9de7	profiling: fix percentage of detect phases Use proper 'total' to calculate weigth of each detection phase.	13 years ago
Victor Julien	8a735a9b90	profiling: add sample-rate yaml option Add option "profiling.sample-rate": # Run profiling for every xth packet. The default is 1, which means we # profile every packet. If set to 1000, one packet is profiled for every # 1000 received. #sample-rate: 1000 This allows for configuration of the sample rate.	13 years ago
Victor Julien	2c3a92a1c9	profiling: conditional rule profiling Add support for conditional rule profiling. Currently only simple rate limiting is supported, but hardcoded to inspecting rules for each packet.	13 years ago
Victor Julien	13d491f577	profiling: lower overhead when disabled Instead of a large (6k+) structure in the Packet, make the profiling storage dynamic. To do this the Packet->profile is now a pointer. Initial support for selective sampling, e.g. only profile every 1000th packet.	13 years ago
Anoop Saldanha	127ef8f903	Use a typdef AppProto <-> uint16_t for representing app layer protocol. Some minor refactoring/cleanup, including renaming functions.	13 years ago
Eric Leblond	34abd818dd	Prefix util-conf function with Config	13 years ago
Eric Leblond	54006de40c	Use new function GetLogDirectory()	13 years ago
Victor Julien	43ba5a677e	DNS: enable mpm/fast_pattern support for dns_query	13 years ago
Victor Julien	ffffe6c10e	profiling: add formatted totals, percents to packet stats	13 years ago
Victor Julien	82769a1b37	profiling: fix missing profile names	14 years ago

1 2

86 Commits (873bc290bc010fa24eed9b2953ebc7a8a6ef2e2e)