Commit Graph

911 Commits (cc28284598cea084112d19529cd271b3ce5d5916)
 

Author SHA1 Message Date
Jason Ish cc28284598 Set the ethernet header pointer. Without this, alert-unified-log will add an extra ethernet header to every alert logged. 15 years ago
Kirby Kuehl 565eab1f54 fix bug88 15 years ago
Kirby Kuehl a334a87109 smb safety checks 15 years ago
Kirby Kuehl bea30a6db6 bug 88 validate dcerpc header 15 years ago
Jason Ish 9e4da4f8e7 supply pcre_get_substring with the proper start of the string. 15 years ago
Kirby Kuehl a8c3718b56 signed unsigned comparision fix for 64 bit 15 years ago
William Metcalf 7099da431b small fix for source-pfring.c after stat err rename 15 years ago
Jason Ish e87d4f8a28 Split the defrag counters into ipv4 and ipv6. 15 years ago
Victor Julien 2cb2989ad8 Apply configurable max pending packets to nfq and ipfw 15 years ago
Jason Ish 7142fdb780 quick way to make max_pending configurable. 15 years ago
Victor Julien 187949b9ad Make urilen inspect the normalized uri, cleanup uri (error) handling. 15 years ago
Jason Ish 6b562f7aa6 Issue 82 - fragment counters. - number of fragments - number reassembled - number of timeouts 15 years ago
Victor Julien 3d0355bae8 Compile fix. 15 years ago
William Metcalf c3e70accd2 pcap and pfring exit stats 15 years ago
Victor Julien b99e10236c Fix a endless loop condition in the smb parser and make dcerpc parser more quiet. 15 years ago
Victor Julien 16aebe5add Fixup smb tests. 15 years ago
Kirby Kuehl 957b43b3d6 signed unsigned comparision cleanup 15 years ago
Kirby Kuehl 40a0fd5e97 fix warning 15 years ago
Kirby Kuehl 4b05bc281d fix padding bug 15 years ago
Kirby Kuehl 6aac8d55a6 reset smb bytesprocessed when complete 15 years ago
Kirby Kuehl 4dd2f621ac smb writeandx dcerpc over smb 15 years ago
Pablo Rincon 583c686170 Allowing no case options for flow keyword. Adding unittests for this 15 years ago
Victor Julien 194015c6cf Fix reject code to not send resets for all alerts. 15 years ago
William Metcalf f925ac9351 printf to logging subsys conversion for src/detect-bytejump.c 15 years ago
Gurvinder Singh 999a200bc9 pattern matcher options support 15 years ago
Pablo Rincon d0404d8447 Renaming errors with naming conventions 15 years ago
Pablo Rincon ad2c136e8f Renaming errors (naming conventions) 15 years ago
Jason Ish 8f618b2121 - actually re-inject ipv6 re-assembled packets. - set the next header. 15 years ago
Jason Ish 8570976ee0 Fix for lists that are children of another list. Fix memory leak by only setting the sequence index value to the first item found. 15 years ago
Victor Julien 501c8814b6 fix crash in urilen 15 years ago
Victor Julien ed7762e843 Disable unused jabber proto detection as it made the proto detection code look way more into the stream than without it. 15 years ago
Jason Ish 6f73aca1e8 I know Snort defaults to syslog in daemon mode, but should we?
Stick to the logging configuration defined in the config file
in daemon mode.
15 years ago
Jason Ish c72d6be58b Making logging configurable. If no logging outputs are defined the default will be used. - Currently per output log formatting is not available. 15 years ago
Breno Silva a857fa7170 FragOffset Rule Keyword 15 years ago
Breno Silva 7e299834d2 FragOffset Rule Keyword 15 years ago
Victor Julien f96511a8b1 Check reassembly limits against correct stream direction. Set proper direction flag in stream msgs. 15 years ago
Gurvinder Singh ed99e73622 bug 78 15 years ago
Kirby Kuehl 58c8103a4b fix unittest 15 years ago
Victor Julien 53c9276d51 Cleanup pcap output. 15 years ago
Victor Julien e0aacac4c6 Move bpf string retrieval to it's own function. Clean up pcap sourcres a bit. 15 years ago
William Metcalf ba46c16aac bpf support for pcap modes 15 years ago
Victor Julien 424ff432ec Build update 15 years ago
Victor Julien faf6e82aa4 Build sys update after applying prelude patches. 15 years ago
Pierre Chifflier 4515ae13e4 Add Prelude output plugin
Add support for reporting alerts to the Prelude SIEM system, using
libprelude to send IDMEF (RFC4765) messages.

Each message contains the alert description and reference (using
the SID/GID), and a normalized description (assessment, impact,
sources etc.)

libprelude handles the connection with the manager (collecting component),
spooling and sending the event asynchronously. It also offers transport
security (using TLS and trusted certificates) and reliability (events
are retransmitted if not sent successfully).

This modules requires a Prelude profile to work (see man prelude-admin
and the Prelude Handbook for help).

Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
15 years ago
Pierre Chifflier eb33dc163f Prelude plugin: add detection in configure script
Add the --enable-plugin option to configure script (disabled by default).

Signed-off-by: Pierre Chifflier <chifflier@inl.fr>
15 years ago
Gurvinder Singh cf5266094d bug 66 patch 15 years ago
Victor Julien 148883cedf Work around for unsupported CONNECT support handling. 15 years ago
Victor Julien 7deb4e9f09 Cleanup AppLayerDetectGetProto a bit. 15 years ago
Victor Julien fd409049cb First step for proper HTTP CONNECT handling. 15 years ago
Victor Julien 9f3f9e9ba1 Fix ipfw verdict. 15 years ago