Gurvinder Singh
7d0781b349
added support to log dropped packet as netfilter logs while in inline mode
15 years ago
Gurvinder Singh
e5edc6e8e3
add the support to log the fast.log alerts type to syslog
15 years ago
Anoop Saldanha
33f4beb0bc
batching of packets support for cuda b2g mpm. Supported for both 32 and 64 bit platforms
15 years ago
Jason MacLulich
835630efbd
Add initial support for reading packets from a DAG card, we only support reading from a single stream at this time.
...
Use the --dag <dagname> cmd line option to specify from which DAG card to read pkts
from.
Issue at the moment with pkts being ejected during shutdown -- at the moment we
ignore any packets that are not of link type Ethernet.
15 years ago
Victor Julien
4e7df60b2f
Make pcap file mode read multiple packets per 'read'. Update threading model to deal with this.
15 years ago
Jason Ish
a93b2e6b84
Support for reading ERF files.
15 years ago
William Metcalf
ce01927515
Import of GPLv2 Header 050410
15 years ago
Victor Julien
070ed778b8
Libcap-ng support by Gurvinder Singh and myself. Basic support for per thread caps is added, but not activated as it doesn't seem to work yet. Work around for incompatibility between libnet 1.1 and libcap-ng added.
15 years ago
Jason Ish
40f9653c06
Have output plugs use an OutputCtx which is a little more generic than LogFileCtx. The OutputCtx provides a place for module private data to avoi overriding the LogFileCtx.
16 years ago
Anoop Saldanha
41e6735b92
mpm b2g cuda support added
16 years ago
Pablo Rincon
cef12d30b5
Unified output fixes: alert count per module (not per thread), fix timestamps on pcap mode, write *all* the alerts of a packet, write the log header once also on unified alert
16 years ago
Jason Ish
763fb4a583
Fix threading issues with unified-log. - Only write the header once, on opening, not per thread init. - Track the size in the log file ctx, not per thread.
16 years ago
Pierre Chifflier
4515ae13e4
Add Prelude output plugin
...
Add support for reporting alerts to the Prelude SIEM system, using
libprelude to send IDMEF (RFC4765) messages.
Each message contains the alert description and reference (using
the SID/GID), and a normalized description (assessment, impact,
sources etc.)
libprelude handles the connection with the manager (collecting component),
spooling and sending the event asynchronously. It also offers transport
security (using TLS and trusted certificates) and reliability (events
are retransmitted if not sent successfully).
This modules requires a Prelude profile to work (see man prelude-admin
and the Prelude Handbook for help).
Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
16 years ago
Nick Rogness
2b7b78f1bf
Intial IPFW support FreeBSD and OSX
16 years ago
Jason Ish
844c444af1
Use the configuration file to setup alert logging (and http logging).
...
Only setup for the live pcap modes at the moment.
16 years ago
Pablo Rincon
e26833be3f
Changing mutex/spinlocks/conditions naming types
16 years ago
Pablo Rincon
769022f4be
Adding support for Mac OS X, FreeBSD, centrailizing mutex/spins/conditions in a macro API, and some unittests
16 years ago
Pablo Rincon
a64af4adca
Forgot to add this file
16 years ago
Gurvinder Singh
40b8afdd56
support for thread exit constants
16 years ago
Gurvinder Singh
48c94bbf03
initial thread code support
16 years ago
Pablo Rincon Crespo
a84cc38bc9
Preparing multithreading support for alert modules and logfilectx
16 years ago
William Metcalf
04b0f177fc
native PF_RING support with fixes
16 years ago
Breno Silva
a5e386ce52
Unified2
...
Signed-off-by: Breno Silva <breno.silva@gmail.com>
16 years ago
Victor Julien
a39108843e
Small tm module API rename to reflect that Init/Deinit/ExitPrintStats are per thread calls.
16 years ago
Brian Rectanus
fa5939ca91
64 bit cleanup part2
16 years ago
Victor Julien
689bbfdc45
Rename all structure definitions in the "typedef struct _SomeStruct" format to "typedef struct SomeStruct_" to make the Doxygen output more useful.
...
Remove the Trie multi pattern matcher code. It wasn't used anymore.
16 years ago
Victor Julien
9c7f5afa79
Large update: pcap support, threading fixes, initial stream tracking, time handling, pool support, runmodes, decoders added, autojunk update.
16 years ago
Victor Julien
5df5b35e90
Put all globals in the detection engine ctx. Add HashList type, a hash that also stores the items ina list to it can be traversed. Many cleanups.
16 years ago
Victor Julien
4c4862d838
Improve logging, add alert-output module, at module exit stats, add HTTP POST uri capture.
16 years ago
Victor Julien
edf8650a7e
Tunnel update.
16 years ago
William Metcalf
0ffa1c2465
updates for configure.in, added reject code, some decode stuff for tcp
16 years ago
Victor Julien
05fd319f6c
Add log-httplog module that logs http request uri's, hosts and useragents to a per line text format.
16 years ago
Victor Julien
6c1f2071be
Add unittest registration to the threading modules api.
16 years ago
Victor Julien
bab4b62376
Initial add of the files.
16 years ago