suricata

Commit Graph

Author	SHA1	Message	Date
Ken Steele	235cd0211a	Alert file formatting clean up. Put { on new line for function declarations. Remove space after function name. Add static to unit tests delcaration.	12 years ago
Victor Julien	a536e73695	alert-pcapinfo: clean up Make functions static. Move registration to the bottom.	12 years ago
Eric Leblond	27f1d88374	Add pcap-info alert format. This patch adds a new alert format called pcap-info. It aims at providing an easy to parse one-line per-alert format containing the packet id in the parsed pcap for each alert. This permit to add information inside the pcap parser. This format is made to be used with suriwire which is a plugin for wireshark. Its target is to enable the display of suricata results inside wireshark. This format doesn't use append mode per default because a clean file is needed to operate with wireshark. The format is a list of values separated by ':': Packet number:GID of matching signature:SID of signature:REV of signature:Flow:To Server:To Client:0:0:Message of signature The two zero are not yet used values. Candidate for usage is the part of the packet that matched the signature.	14 years ago

Author

SHA1

Message

Date

Ken Steele

235cd0211a

Alert file formatting clean up.

Put { on new line for function declarations. Remove space after function
name.

Add static to unit tests delcaration.

Victor Julien

a536e73695

alert-pcapinfo: clean up

Make functions static.
Move registration to the bottom.

Eric Leblond

27f1d88374

Add pcap-info alert format.

This patch adds a new alert format called pcap-info. It aims at
providing an easy to parse one-line per-alert format containing
the packet id in the parsed pcap for each alert. This permit to
add information inside the pcap parser.

This format is made to be used with suriwire which is a plugin for
wireshark. Its target is to enable the display of suricata results
inside wireshark.

This format doesn't use append mode per default because a clean file
is needed to operate with wireshark.

The format is a list of values separated by ':':
  Packet number:GID of matching signature:SID of signature:REV of signature:Flow:To Server:To Client:0:0:Message of signature
The two zero are not yet used values. Candidate for usage is the
part of the packet that matched the signature.

3 Commits (9ec23bd59302b296868fd7b72c5f550713f5d62e)