Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine developed by the OISF and the Suricata community.

cybersecurityidsintrusion-detection-systemintrusion-prevention-systemipsnetwork-monitornetwork-monitoringnsmsecuritysuricatathreat-hunting

You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Victor Julien ea571add73 app-layer: disruption flags ... Stream GAPs and stream reassembly depth are tracked per direction. In many cases they will happen in one direction, but not in the other. Example: HTTP requests a generally smaller than responses. So on the response side we may hit the depth limit, but not on the request side. The asynchronious 'disruption' has a side effect in the transaction engine. The 'progress' tracking would never mark such transactions as complete, and thus some inspection and logging wouldn't happen until the very last moment: when EOF's are passed around. Especially in proxy environments with _very_ many transactions in a single TCP connection, this could lead to serious resource issues. The EOF handling would suddenly have to handle thousands or more transactions. These transactions would have been stored for a long time. This patch introduces the concept of disruption flags. Flags passed to the tx progress logic that are and indication of disruptions in the traffic or the traffic handling. The idea is that the progress is marked as complete on disruption, even if a tx is not complete. This allows the detection and logging engines to process the tx after which it can be cleaned up.		11 years ago
benches	Initial add of the files.	17 years ago
contrib	suri-graphite: add ouput to file option	11 years ago
doc	Fix make distcheck on CentOS 5.11	11 years ago
lua	output-lua: add SCPacketTimeString	12 years ago
m4	Prelude plugin: add detection in configure script	16 years ago
qa	parsing: s/strtok/strtok_r/g	11 years ago
rules	decode: add ERSPANv1 decoder	11 years ago
scripts	In non interactive mode, print errors to stderr	11 years ago
src	app-layer: disruption flags	11 years ago
.gitignore	unittest: make check use a qa/log dir for logging	13 years ago
.travis.yml	travis-ci: use make check	12 years ago
COPYING	Initial add of the files.	17 years ago
ChangeLog	Update changelog for 2.1beta4 release	11 years ago
LICENSE	import of gplv2 LICENSE	17 years ago
Makefile.am	Respect DESTDIR in install-conf and install-rules.	11 years ago
Makefile.cvs	Initial add of the files.	17 years ago
acsite.m4	Added C99 defs/macros to acsite.m4 for CentOS	17 years ago
autogen.sh	OpenBSD 5.2 build fixes, Unit test fix.	14 years ago
classification.config	Import of classification.config	16 years ago
config.rpath	Add file needed for some autotools version.	13 years ago
configure.ac	af-packet: sync header with latest features	11 years ago
doxygen.cfg	doxygen: add source browser	12 years ago
reference.config	Update reference.config	11 years ago
suricata.yaml.in	af-packet: implement rollover option	11 years ago
threshold.config	threshold: improve comments of shipped threshold.config, add links to wiki.	14 years ago