Commit Graph

22 Commits (42a85c37f129cd984d77de19c6316fa245275457)

Author SHA1 Message Date
Jason Ish a11aaadd86 plugins: add --plugin command line option to load plugins
Add --plugin <PATH> to load an additional plugin from the command
line. This is more convenient than "--set plugins.X" especially when
you may already have a plugins loaded and you want to load an
additional one.

Ticket: 8463
4 months ago
Ofer Dagan e1f9d8a067 pcap: refactor delete-when-done to support non-alerts
Refactor pcap file deletion to use a single delete-when-done option
with three values instead of separate boolean options:
- false (default): No deletion
- true: Always delete files
- "non-alerts": Delete only files with no alerts

Also account for alerts produced by pseudo packets (flow timeout / shutdown flush):
- Introduce small capture hooks and invoke on pseudo-packet creation so the
  capture layer can retain references and observe alerts emitted after the last
  live packet
- Call the hook from both TmThreadDisableReceiveThreads and TmThreadDrainPacketThreads

Key changes:
- Replace should_delete/delete_non_alerts_only bools with enum
- Move alert counter from global to per-file PcapFileFileVars
- Relocate alert counting from PacketAlertFinalize to pcap module
- Ensure thread safety for both single and continuous pcap modes
- Add unit tests for configuration parsing and pseudo-packet alert path

The --pcap-file-delete command line option overrides YAML config
and forces "always delete" mode for backward compatibility.

Documentation updated to reflect the new three-value configuration.

Fixes OISF#7786
6 months ago
Lukas Sismis eb52e337da pcap-file: document capture method options 1 year ago
Victor Julien 688bd538cf pcap: implement pcap-file-buffer-size option
Allows easy specification of buffer size on the commandline.

Ticket: #7155.
2 years ago
Victor Julien 0903536fd6 doc: spelling
Thanks to Josh Soref.
3 years ago
Jason Ish 1b844cd7f7 doc/userguide: document --include command line option 4 years ago
Richard McConnell b39a4c63fe doc: document AF_XDP feature 4 years ago
jason taylor db5cf1f8f9 userguide: Add rule file globbing option details
Signed-off-by: jason taylor <jtfas90@gmail.com>
4 years ago
Jason Ish 4b9af8d2ce doc/userguide: document --disable-hashing 6 years ago
Victor Julien ca47d75c80 doc/userguide: explain --strict-rule-keywords 6 years ago
Jason Ish f70e1f571e doc/userguide: add info about --set and lists 6 years ago
James Dutrisac 8d5e54c046 pcap: recusively reading pcaps / documentation
Changes to doc/userguide/partials/options.rst for feature 2363
   (reading pcaps recursively)
6 years ago
Victor Julien 75727c05e0 doc/manpage: add --reject-dev option 6 years ago
Jeff Lucovsky 3385859176 doc/userguide: Update for dump-features 7 years ago
Daisu fccdb1c642 doc/commandline: -i option is useable several times 7 years ago
Jason Ish 9111b9df57 doc: cleanup enging logging
Attempt cleanup the engine logging a bit.

Also a include a verbatim excerpt of the default configuration
here for reference purposes.
7 years ago
Jason Ish c97195bf0b doc: -v verbose option documentation update
Update -v documentation to reflect the new behaviour discussed
in bug #1851 where -v changes the log level to fixed levels
instead of an offset of the default log level configured
in suricata.yaml.
7 years ago
Victor Julien 6fcd2db043 tile: remove files 8 years ago
Danny Browning 2dc6b6ee14 source-pcap-file: delete when done (2417)
https://redmine.openinfosecfoundation.org/issues/2417

Add option to have pcap files deleted after they have been processed.
This option combines well with pcap file continuous and streaming
files to a directory being processed.
8 years ago
Brandon Sterne a01a229b37 doc: use standard spelling of daemon 9 years ago
Dana Helwig 3ab9120821 source-pcap-file: Pcap Directory Mode (Feature #2222)
https://redmine.openinfosecfoundation.org/issues/2222

Pcap file mode that when passed a directory will process all files in
that directory. If --pcap-file-continuous or continuous option is passed
in json, the directory will be monitored  until the directory is
moved/deleted, suricata is interrupted, or the pcap-interrupt command
is used with unix command socket. Existing file implementation and new
directory implementation has moved from source-pcap-file into
pcap-file-helper and pcap-directory-helper.

Engine state will not reset between files.

Also satisfies:
 * https://redmine.openinfosecfoundation.org/issues/2299
 * https://redmine.openinfosecfoundation.org/issues/724
 * https://redmine.openinfosecfoundation.org/issues/1476

Co-Authors: Dana Helwig <dana.helwig@protectwise.com> and
Danny Browning <danny.browning@protectwise.com>
9 years ago
Jason Ish 5c78fdbc9c doc: break out command line options into a common doc
The command line options can now be consumed by the man page
and the user guide.

Some attempt was made to order the options from common/basic
progressing to advanced with some notion of options
grouped together.
10 years ago