Commit Graph

9386 Commits (8d2883f3fa3ac0f4811a7ede46f35ec9456bdff5)
 

Author SHA1 Message Date
Victor Julien 17e7d179d0 profiling/csv: update output format
Update output to be:

pcap_cnt,total,receive,decode,flowworker,threading,proto detect,flow,
stream,app-layer,detect,tcp-prune,loggers,<detect stages>,<loggers>

For TCP, the app-layer cost is not part of stream anymore.
8 years ago
Victor Julien 85f2486e0b multi-tenant: document per tenant settings 8 years ago
Victor Julien 6781146556 test mode: parse interface list in test mode 8 years ago
Victor Julien 77c7cf0211 windivert: fix whitespace issue 8 years ago
Victor Julien b86e176262 af-packet: suppress noisy info message 8 years ago
Victor Julien d6460392c5 detect/transforms: fix doc urls 8 years ago
Victor Julien 3ba2c9fba7 pfring: multiple receive threads is not experimental 8 years ago
Victor Julien 57921d95d6 eve: improve error handling for Rust loggers
Give useful warning message if Rust is not compiled in.
8 years ago
Victor Julien 24b18e47bd pfring: minor cleanups 8 years ago
Victor Julien 4f84672d7c stats: decoder/stream events as stats 8 years ago
Victor Julien 014056f686 detect/analyzer: add detection for sigs that could use http keywords 8 years ago
Victor Julien 127937b2dd detect/analyzer: add debug statements 8 years ago
Victor Julien c05459ce89 detect/analyzer: fix json analyzer being called on incomplete rules 8 years ago
Victor Julien c62273f4fd rust/smb: silence noisy debug messages 8 years ago
Victor Julien 6c97909a92 stream/events: log as stats 8 years ago
Victor Julien fa06879563 detect/events: cleanup keyword 8 years ago
Victor Julien 5afeebf884 doc/flow: updates and cleanups to flow section 8 years ago
Victor Julien 2ae8d1a208 cocci/detect: add flags check to SigTableElmt 8 years ago
Victor Julien ecb5d6419b rules/transform: add to list-keywords 8 years ago
Victor Julien 72dd4a5f92 doc/rules: initial transforms documentation 8 years ago
Victor Julien 226fe5cab3 doc/performance: redo runmodes explanation 8 years ago
Victor Julien 17e2d39531 doc/install: update Rust info in generic install overview 8 years ago
Victor Julien 473688746b doc/eve: add community id 8 years ago
Mats Klepsland 81cdcd315b detect-ssh-software: fix url for keyword 8 years ago
Mats Klepsland 08efbdc632 detect-ssh-software-version: add description and url to keyword 8 years ago
Mats Klepsland f4da3050f2 detect-ssh-proto-version: add description and url to keyword 8 years ago
Mats Klepsland c58252bb3b detect-ssh-proto: fix url for keyword 8 years ago
Mats Klepsland e92fda37c9 doc: add documentation for SSH keywords 8 years ago
Victor Julien fd13970bfa changelog: update for 4.1rc2 8 years ago
Victor Julien 083908f3be rust/ike2: free destate on tx free
Bug #2604
8 years ago
Jason Ish 6f00ba0659 rust: fix (again) out of tree builds
As the generated Cargo.toml is shipped as part of a release
tarball, build from the source directory but set the cargo
CARGO_TARGET_DIR to the build directory.
8 years ago
Pascal Delalande 64922a476e doc: remove deprecated force-md5 flag from userguide 8 years ago
Travis Green 576b3b6a81 Added new classifications to classification.conf
Added classifications from rule-writing community feedback.
8 years ago
Victor Julien daaa90d515 rust/smb: suppress noisy messages 8 years ago
Victor Julien c4d8508f51 eve/json: introduce community flow id
Add support for community flow id, meant to give a records a
predictable flow id that can be used to match records to
output of other tools.

Takes a 'seed' that needs to be same across sensors and tools
to make the id less predictable.
8 years ago
Victor Julien e956b484c5 eve/json: handle common options in central function 8 years ago
Victor Julien df1ec82b55 eve/json: move common settings into it's own struct 8 years ago
Victor Julien 116c03cf17 nfs: use common json output structures 8 years ago
Victor Julien 04edc7cb6c smb: use common json output structures 8 years ago
Victor Julien 8b8270e732 eve/json: add common helper funcs
Add simple helper funcs for option-less loggers
8 years ago
Victor Julien f357ad1df2 eve/flow: minor cleanups 8 years ago
Victor Julien 7bf71805b8 hash/sha1: optimize by avoiding mem alloc
Don't allocate an output buffer for each call. These buffers
would have the exact same size every time.
8 years ago
Victor Julien c54acd3a6e travis: update rust to 1.29.1, add auto & disabled tests 8 years ago
Victor Julien ed712768d5 rust: enable by default
Remove 'experimental' label for Rust, and enable it by default if
rustc and cargo (and libjansson) are available.

Add rustc and cargo versions to the build-info.
8 years ago
Victor Julien 4ece6ba758 configure: fix and cleanup nss and nspr detection 8 years ago
Victor Julien 4d5024255f smb/dcerpc: remove now unused ssn2maxsize_map 8 years ago
Victor Julien 4d044483cf smb/dcerpc: clean up and unify DCERPC probe logic 8 years ago
Victor Julien ac4e888597 smb2/dcerpc: probe if response data is dcerpc
If we missed the tree connect we can't know for sure if we're
reading from a (DCERPC) PIPE or not. In this case probe the data
to see if it looks like DCERPC.

If the detection succeeds, use a special 'suricata::dcerpc' service
in the TX.

Simplify handling of DCERPC records that cross records

Update logging for the response only TXs.
8 years ago
Victor Julien 9dd7c38113 smb2: skip rest of READ response if status is not success 8 years ago
jason taylor 7f4e5e6eac userguide: update hyperscan documentation
Signed-off-by: jason taylor <jtfas90@gmail.com>
8 years ago