656 Commits (9e098020c9ed1e8839653ebc178179aa014108cf)

Author	SHA1	Message	Date
Andreas Herz	6f0794c16f	keyword-filesize: add units	8 years ago
Dana Helwig	3ab9120821	source-pcap-file: Pcap Directory Mode (Feature #2222) ... https://redmine.openinfosecfoundation.org/issues/2222 Pcap file mode that when passed a directory will process all files in that directory. If --pcap-file-continuous or continuous option is passed in json, the directory will be monitored until the directory is moved/deleted, suricata is interrupted, or the pcap-interrupt command is used with unix command socket. Existing file implementation and new directory implementation has moved from source-pcap-file into pcap-file-helper and pcap-directory-helper. Engine state will not reset between files. Also satisfies: * https://redmine.openinfosecfoundation.org/issues/2299 * https://redmine.openinfosecfoundation.org/issues/724 * https://redmine.openinfosecfoundation.org/issues/1476 Co-Authors: Dana Helwig <dana.helwig@protectwise.com> and Danny Browning <danny.browning@protectwise.com>	8 years ago
Eric Leblond	94e9d13791	doc: add ruleset commands available in unix socket	8 years ago
Pascal Delalande	0c99338e07	doc: update docs for DNS flags logging	8 years ago
Ralph Broenink	f6938933d9	doc: Amend the list of accepted protocols ... Based on the list in suricata.yaml	8 years ago
Ralph Broenink	d830177b7b	doc: Add my own name to the acknowledgements	8 years ago
Ralph Broenink	98a1ec490f	doc: Move IP reputation keyword to rules section	8 years ago
Ralph Broenink	722cff1862	doc: Restructure ToC ... * All sections up to 2 levels deep are now shown regardless of whether they are a separate page * Rename Xbits and Thresholding for more consistent naming * Minor adjustment in the Payload Keywords section	8 years ago
Ralph Broenink	196ba1da70	doc: Make the header keywords section separate sections in ToC	8 years ago
Ralph Broenink	a55a6cdb62	doc: Move flowint as integral part of flow keywords	8 years ago
Ralph Broenink	f6c766112c	doc: Minor changes in structuring of HTTP Keywords / Snort differences	8 years ago
Ralph Broenink	e9b25988ba	doc: Move pcre entirely to Payload Keywords section ... (plus remove lingering screenshot of a rule)	8 years ago
Ralph Broenink	bb1bf2643d	doc: Move fast_pattern and prefilter to dedicated page	8 years ago
Ralph Broenink	fea037fda8	doc: Moved explanation of normalized buffers to rules introduction	8 years ago
Ralph Broenink	11990c7117	doc: Move the definition of modifier keywords to the introduction	8 years ago
Ralph Broenink	dfae19247d	doc: Completely rewrite the rules introduction for more clearity	8 years ago
Ralph Broenink	274c36eb2f	doc: Meta-settings -> Meta Keywords plus some textual changes ... Most importantly, conventions are now placed in tip boxes	8 years ago
Ralph Broenink	3413793768	doc: Use lowercased keyword names as section titles	8 years ago
Ralph Broenink	a52aacb4ea	doc: Replace images of tables and rules with text in rules docs ... In some chapters of the rules documentation, many sections used examples of rules, but these were inserted into images. These have been replaced by text and HTML emphasis. Additionally, some tables embedded into images were also replaced by reST tables.	8 years ago
Ralph Broenink	44926e2369	doc: Add suricata.css to allow for some custom styling	8 years ago
Ruslan Usmanov	1090ee9d8d	rate_filter by_both through IPPair storage ... Ticket https://redmine.openinfosecfoundation.org/issues/2127	8 years ago
Gaurav Singh	637a7c8e55	Adds options to mark when a file is final. ... This takes the form of an option to add the pid of the process to file names. Additionally, it adds a suffix to the file name to indicate it is not finalized. Adding the pid to the file name reduces the likelihood that a file is overwritten when suricata is unexpectedly killed. The number in the waldo file is only written out during a clean shutdown. In the event of an improper shutdown, extracted files will be written using the old number and existing files with the same name will be overwritten. Writes extracted files and their metadata to a temporary file suffixed with '.tmp'. Renames the files when they are completely done being written. As-is there is no way to know that a file on disk is still being written to by suricata.	8 years ago
Mats Klepsland	9556d4fef3	doc: add documentation for tls_cert_fingerprint keyword	8 years ago
Victor Julien	1180687574	doc/file_data: add note on negated matching ... Explain issue #2216 and how to avoid it.	8 years ago
Victor Julien	456af8faa8	doc/napatech: formatting fixes	8 years ago
Andreas Herz	c048ee6505	doc: reflect most recent cpu affinity settings ... Some settings like output-cpu-set never been used and detect got renamed to worker. This reflects those changes already present in the yaml also within the documentation.	8 years ago
Julian	f27b4fc8fe	redis: support for rpush in list mode ... This adds a new redis mode rpush. Also more consistent config keywords orientated at the redis command: lpush and publish. Keeping list and channel config keywords for backwards compatibility	8 years ago
Phil Young	5f613e6e7d	napatech: Added section describing packet counters.	8 years ago
Phil Young	f6838f9085	napatech: Added description of hba usage.	8 years ago
Victor Julien	fc229430f8	doc: add rust and update version in install	8 years ago
Sebastian Garcia	d32ba60b51	Update public-data-sets.rst with stratosphere project ... Add the datasets of the Stratosphere project to the list.	8 years ago
Jason Ish	f715b0ae6b	doc: add pid-file section to suricata.yaml doc ... Redmine issue: https://redmine.openinfosecfoundation.org/issues/2104	8 years ago
Jason Ish	59d69666ea	doc: add more details to log rotation doc	8 years ago
Jason Ish	92f15b7ffb	doc: move log rotation to output section	8 years ago
Victor Julien	62b6f9fe25	decode: add config option to disable teredo ... Ticket #744.	8 years ago
Abbed	320b032a88	doc: small typo under '4.3.1.5' section	8 years ago
Eric Leblond	b763c7ec11	doc: document http-body logging	8 years ago
Eric Leblond	9e581436a7	doc: info about new config for alert events in EVE	8 years ago
Eric Leblond	ef88689f1e	doc: add app_proto to alert event	8 years ago
Selivanov Pavel	5162b58260	Fixed small typo: double sudo	9 years ago
Eric Leblond	f4374ffd0b	doc: some more info about alert format	9 years ago
Eric Leblond	f5ad6a2095	doc: document target keyword	9 years ago
Eric Leblond	a3f07ec02e	doc: document drop-invalid option.	9 years ago
Eric Leblond	e933eb849a	doc: document filestore update	9 years ago
Andreas Herz	bf1a8d08da	doc: rephrase nocase placement explanation	9 years ago
Victor Julien	71c6df1655	lua: add SCFlowId for getting the flow id	9 years ago
Victor Julien	4697330b73	doc: flowints formatting cleanup	9 years ago
Victor Julien	0af562d4c8	doc: move parts out of snort difference doc ... Move generic keyword descriptions to the keyword documentation.	9 years ago
David Wharton	a8d0ae460c	doc: removing (replaced) snort-compatibility.rst ... snort-compatibility.rst replaced by differences-from-snort.rst	9 years ago
David Wharton	8a53d49e81	doc: replacing snort-compatibility link ... The snort-compatibility.rst document is being replaced by differences-from-snort.rst. This commit updates the link.	9 years ago
David Wharton	6bc7c64794	doc: overhaul of the snort-compatibility document ... This is intended to replace the existing 'snort-compatibility.rst' document. Based on "The Suricata Rule Writing Guide for The Snort Expert" 2016 SuriCon talk.	9 years ago
Victor Julien	f6e3755b5c	lua: extend SCFlowAppLayerProto ... Change SCFlowAppLayerProto to return 5 values: <alproto> <alproto_ts> <alproto_tc> <alproto_orig> <alproto_expect>: alproto: detected protocol alproto_ts: detected protocol in toserver direction alproto_tc: detected protocol in toclient direction alproto_orig: pre-change/upgrade protocol alproto_expected: expected protocol in change/upgrade Orig and expect are used when changing and upgrading protocols. In a SMTP STARTTLS case, orig would normally be set to "smtp" and expect to "tls".	9 years ago
Victor Julien	79389558ac	doc: update for stream changes	9 years ago
Victor Julien	245a89b7e7	doc: http keywords update	9 years ago
Ray Ruvinskiy	7539973109	tls: logging for session resumption ... We assume session resumption has occurred if the Client Hello message included a session id, we have not seen the server certificate, but we have seen a Change Cipher Spec message from the server. Previously, these transactions were not logged at all because the server cert was never seen. Ticket: https://redmine.openinfosecfoundation.org/issues/1969	9 years ago
fooinha	36667ab8a1	doc: async mode for redis eve output ... async: true ## if redis replies are read asynchronously	9 years ago
psanders240	1223de4208	doc: Napatech docs improvement ... Fix errors and simplify filters.	9 years ago
Victor Julien	aca27ff383	doc: expand on bpf	9 years ago
Mats Klepsland	8b9f84bff2	doc: add documentation for date modifiers in eve-log	9 years ago
Mats Klepsland	37a12fe799	doc: add documentation for eve-log file rotation	9 years ago
fooinha	20d4d40051	log: tls custom format log	9 years ago
Mats Klepsland	7b1dae6251	doc: add documentation for Lua SCFlowTimestamps	9 years ago
Mats Klepsland	3b23387664	doc: add documentation for eve-log file permissions	9 years ago
Jon Zeolla	ce8a65a58e	docs: fix statement about flow:to_server	9 years ago
Jon Zeolla	1589a15495	docs: clarify how iprep works	9 years ago
Mats Klepsland	285b566205	doc: add documentation for TlsGetCertSerial Lua function	9 years ago
Mats Klepsland	ee9f822b8e	doc: add documentation for tls_cert_serial keyword	9 years ago
David Wharton	1bf7ded224	doc: specify buffers that can be used for fast_pattern ... Updated notes on the following buffers indicating that they can be used for fast_pattern: tls_cert_subject tls_cert_issuer tls_sni	9 years ago
David Wharton	b1ad770b36	doc: removed references to older Suricata versions ... docs are versioned; references to older Suricata versions undesired.	9 years ago
Mats Klepsland	e91bb09c91	doc: add documentation for TLS eve-log	9 years ago
Jason Ish	89ba5816dc	doc: update unified2 section ... Remove documentation on older unified formats that have been removed.	9 years ago
Mats Klepsland	6a382259f8	doc: documentation for custom JSON flags in eve-log	9 years ago
Victor Julien	c477c4370e	doc: update for unix socket hostbits	9 years ago
Victor Julien	71607c905a	doc: update unix socket	9 years ago
Eric Leblond	c357dafed9	doc: document the tls_sni keyword	9 years ago
Mats Klepsland	edbb035160	doc: add documentation for Lua SCFlowHasAlerts	9 years ago
Victor Julien	a2d31b5e04	doc: napatech formatting fixes	9 years ago
Victor Julien	b7b9b5b682	doc: add napatech to userguide	9 years ago
Peter Sanders	28c1516be7	doc: initial Napatech documentation	9 years ago
Victor Julien	bc38cd5932	doc: initial xbits documentation	9 years ago
Victor Julien	41074a87a0	doc: DNP3 support is now available	9 years ago
Jason Ish	0c6c9784a2	doc: document that that ;, \, " need to be escaped in rules	9 years ago
Victor Julien	3012edae1c	luajit: update default yaml and doc for 'states'	9 years ago
Jason Ish	0792f80909	doc: only build pdf on dist if pdflatex is installed	9 years ago
Jason Ish	ee16b86900	doc: fix build pdf on non gnu make platforms ... The Makefile generated by sphinx-build is GNU Make specific causing the PDF phase to fail. Instead call pdflatex directly based on how the generated Makefile was doing it.	9 years ago
Victor Julien	1aa70fb39e	doc: add rate_filter	9 years ago
Jason Ish	1a724ba851	doc: flow: update and add new keywords	9 years ago
Victor Julien	56ffba9fd8	doc: initial app-layer keywords ... Document app-layer-protocol and make a start with app-layer-event.	9 years ago
Victor Julien	c6134e007e	doc: app-layer tls including no-reassemble	9 years ago
Nicolas Thill	3750c15632	doc: add SCPacketTimestamp Lua function ... Signed-off-by: Nicolas Thill <ntl@p1sec.com>	9 years ago
Victor Julien	4126fd82a0	doc: small eve update: add dns	9 years ago
Victor Julien	e3b2d95100	doc: add recent tls keywords	9 years ago
Victor Julien	08b875c03b	doc: clean up fast_pattern	9 years ago
Victor Julien	f1046db113	doc: fix header keywords layout	9 years ago
Victor Julien	d80914d350	doc: move rule reload and adding rules into rule-management	9 years ago
Victor Julien	e24c3937b3	doc: add rule-management chapter	9 years ago
Victor Julien	80bd59ae86	doc: improve install doc, configure	9 years ago
Victor Julien	48274218df	doc: multi-tenancy is not work in progress	9 years ago
Victor Julien	f64decf5e2	doc: clean up log rotation	9 years ago
Victor Julien	729fd2e406	doc: update libcap-ng doc	9 years ago
Victor Julien	e5ee665f24	doc: rewrite rule reload doc	9 years ago
Victor Julien	6a831f8125	doc: add simple install guide	9 years ago
Jason Ish	2c60e9b4de	doc: remove userguide.pdf on clean instead of suricata.pdf ... As the pdf is a built artifact, it needs to be removed to satisfy distcheck.	9 years ago
Jason Ish	afead7e565	doc: add missing docs to EXTRA_DIST	9 years ago
Jason Ish	dbde356053	doc: exclude docs in partials/ from reference errors ... These docs are already included with the include statement, but older versions of Sphinx still complain that they are not in a table of contents.	9 years ago
Victor Julien	aaf0fe4d29	doc: eve update	9 years ago
Victor Julien	a35bea28f3	doc: rules-meta typo	9 years ago
Victor Julien	76b55214f0	doc: rules-meta small cleanup	9 years ago
Victor Julien	3cf1b12061	doc: http sticky vs modifier	9 years ago
Victor Julien	0d15593258	doc: move urilen to other uri keywords	9 years ago
Victor Julien	34bfacdee0	doc: add minimal http request/response line sections	9 years ago
Victor Julien	adb6c75e2e	doc: only make sphinx warnings fatal on html/pdf	9 years ago
Jason Ish	82a6bfd599	doc: manpage: add bugs and notes section	9 years ago
Jason Ish	a4450b768e	doc: manpage: add signals section	9 years ago
Jason Ish	5c78fdbc9c	doc: break out command line options into a common doc ... The command line options can now be consumed by the man page and the user guide. Some attempt was made to order the options from common/basic progressing to advanced with some notion of options grouped together.	9 years ago
Jason Ish	cd4c9e73f8	doc: fix sphinx warnings ... This involved removing documents that were intentionally not referenced as they are not good candidates for the user guide.	9 years ago
Jason Ish	3df7f97a33	doc: fail on sphinx warnings	9 years ago
Jason Ish	79d21e9eee	docs: include userguide.pdf in dist	9 years ago
Jason Ish	214e97814c	doc: bring in unix socket interaction from wiki	9 years ago
Jason Ish	bec128bbf9	doc: attempt to parse version if not in environment ... Should fix the version displayed on readthedocs.	9 years ago
Giuseppe Longo	3f214b506a	file-store: add depth setting ... When a rules match and fired filestore we may want to increase the stream reassembly depth for this specific. This add the 'depth' setting in file-store config, which permits to specify how much data we want to reassemble into a stream.	9 years ago
Giuseppe Longo	9ab1194f68	modbus: set stream depth ... Some protocol like modbus requires a infinite stream depth because session are kept open and we want to analyze everything. Since we have a stream reassembly depth per stream, we can also set a stream reassembly depth per proto.	9 years ago
Victor Julien	92b393ee9a	doc: include enip page	9 years ago
Victor Julien	a2d8cfb5d3	doc: reorder rule docs	9 years ago
kwong	a3ffebd835	Adding SCADA EtherNet/IP and CIP protocol support ... Add support for the ENIP/CIP Industrial protocol This is an app layer implementation which uses the "enip" protocol and "cip_service" and "enip_command" keywords Implements AFL entry points	9 years ago
Victor Julien	5bd906ae9f	doc: prefilter keyword and config	9 years ago
Victor Julien	3ab405dc50	doc: reorganize hyperscan guide	9 years ago
Victor Julien	99d5bf4e68	doc: improve tuning/perf docs	9 years ago
Victor Julien	c7c8de7d59	doc: fix ET example URL	9 years ago
Victor Julien	485544d885	doc: improve commandline options	9 years ago
Victor Julien	7011d8f34c	doc: remove/cleanup 'guides'	9 years ago
Victor Julien	73b355e24a	doc: fix lua keyword name	9 years ago
Victor Julien	43c2db0a55	doc: update what is suricata section	9 years ago
Victor Julien	1f2f1d7063	doc: commandline improvements	9 years ago
Victor Julien	879ab41ade	doc: move drop privs into configuration	9 years ago
Jason Ish	7fa390de39	doc: bundle pre-built man page in distribution	9 years ago
Victor Julien	f511f86398	doc: rename to 'Suricata User Guide'	9 years ago
Victor Julien	7ad667f282	doc: move snort compat to rule chapter	9 years ago
Jason Ish	614e2f1d43	doc: make target for pdf, and suricata.1 shortcut	9 years ago
Jason Ish	6149b014ec	doc: shorten some paths to satisfy distcheck ... Long paths were being dropped from the source package.	9 years ago
Jason Ish	2e78bf0ba8	doc: list files/directories in EXTRA_DIST ... So files get included in the distribution and pass make distcheck.	9 years ago
Jason Ish	b1ced40ee4	doc: get Suricata version from autoconf vars	9 years ago
Jason Ish	ab93eb97b9	doc: use - instead of _ in filenames for consistency	9 years ago
Jason Ish	b8521a52f3	doc: link up hyperscan and packet capture	9 years ago
Jason Ish	b9a7335ec4	doc: expose variables for substition in docs	9 years ago
Jason Ish	15d2a7a49d	doc: minimal man page: suricata.1	9 years ago
Jason Ish	6eedd0068b	doc: hook sphinx into build	9 years ago
Jason Ish	5e76a54714	doc: packet capture: sync up with wiki	9 years ago
Jason Ish	7f5ffeebad	doc: dns: sync up with wiki	9 years ago
Jason Ish	ba4931ddb6	doc: flow:not_established not supported	9 years ago
Andreas Herz	7806ae8f57	docs: sync up to recent redmine	9 years ago
Jason Ish	0e63c9ca41	doc: add GPL and CC licenses	9 years ago
brandonlattin	7e3591e3ce	doc: performance: Replace 'medium' with 'custom' ... I assume the intent was to use the custom-values that are being defined.	9 years ago
Andi	8e655cf107	eve-json-format: add newest version from the wiki ... This was added by pevma in the wiki, so should go into the sphinx doc as well.	9 years ago
Jason Ish	a96225527a	doc: update url to modbus paper as advised by David Diallo.	9 years ago
Jason Ish	2751baae46	doc: rename from "sphinx" to "userguide"	9 years ago