Breno Silva
67f2026279
Global Threshold config
16 years ago
William Metcalf
b0faeb91d7
small PF_RING update cmd line opts changed
16 years ago
Jason Ish
acaee78b1c
Fix bug 125. - Always bail on parse errors. - Exit if loading the config file fails. - Display the line number where the parsing failed.
16 years ago
root
ddf995da3b
pfring support lb type, and now uses logging subsys
16 years ago
Jason Ish
5c3ab2b73f
Load host OS info from the configuration.
16 years ago
Victor Julien
80dc4f1dbe
Further simplify content api: merge flags that indicate a next relative match, remove chunks as they are unnecessary now, make negated a bitflag.
16 years ago
Pablo Rincon
25a3a5c6d8
Adding mem wrapper to debug runtime alloc()/free() functions. Fixing some memory leaks.
16 years ago
Jason Ish
7537013e16
Fix bug 99.
...
- Handle the case where the parent node already exists in ConfSet.
- Deal with allow_override properly when a node has already been
set with ConfSet.
16 years ago
Pablo Rincon
7719216575
Setting thread priorities with nice
16 years ago
Jan Jezek
fe6a72befc
Code is now compilable on the Win32 platform
16 years ago
Anoop Saldanha
1a5ee37bd3
Added cuda logs for the engine, which shows device info and memory usage
16 years ago
Anoop Saldanha
8cf60d6645
Changed the way cuda dispatcher passes back results. Now each detection thread has it's own queue to which the dispatcher can pump packets back to the detect thread. Also, with cuda enabled and a non-cuda mpm being used, we won't create a dispatcher and instead call the b2g scan/search funtions directly instead of using the dispatcher.
16 years ago
Anoop Saldanha
c26e92733d
handle the cuda cleanup at shutdown. should get rid of any errors from the call to SigGroupCleanup
16 years ago
Victor Julien
d281a6b8ac
CUDA build system support & compile fixes
...
- add configure support for CUDA
- make sure all code compiles if CUDA is disabled
- fix compiler warnings
16 years ago
Anoop Saldanha
a2948fc25c
valgrind fixes for b2g cuda mpm
16 years ago
Anoop Saldanha
41e6735b92
mpm b2g cuda support added
16 years ago
Anoop Saldanha
84df26d3fd
cuda interface
16 years ago
Pablo Rincon
b482471a7d
Adding auto runmodes based on available core/cpu's. Setting thread priorities
16 years ago
Breno Silva
b02bb6b6b4
VLAN Support
16 years ago
Pablo Rincon
0165b3f0d8
pcre P modifier support (pcre match over http body requests)
16 years ago
Victor Julien
2cb2989ad8
Apply configurable max pending packets to nfq and ipfw
16 years ago
Jason Ish
7142fdb780
quick way to make max_pending configurable.
16 years ago
Pablo Rincon
d0404d8447
Renaming errors with naming conventions
16 years ago
Pablo Rincon
ad2c136e8f
Renaming errors (naming conventions)
16 years ago
Victor Julien
e0aacac4c6
Move bpf string retrieval to it's own function. Clean up pcap sourcres a bit.
16 years ago
William Metcalf
ba46c16aac
bpf support for pcap modes
16 years ago
Pierre Chifflier
4515ae13e4
Add Prelude output plugin
...
Add support for reporting alerts to the Prelude SIEM system, using
libprelude to send IDMEF (RFC4765) messages.
Each message contains the alert description and reference (using
the SID/GID), and a normalized description (assessment, impact,
sources etc.)
libprelude handles the connection with the manager (collecting component),
spooling and sending the event asynchronously. It also offers transport
security (using TLS and trusted certificates) and reliability (events
are retransmitted if not sent successfully).
This modules requires a Prelude profile to work (see man prelude-admin
and the Prelude Handbook for help).
Signed-off-by: Pierre Chifflier <chifflier@edenwall.com>
16 years ago
Gurvinder Singh
cf5266094d
bug 66 patch
16 years ago
Gurvinder Singh
3cad20946d
bug 64 patch
16 years ago
Victor Julien
6a53ab9c5a
Stream engine memory handling update
...
The stream engine memory handling needed updating as it didn't scale. Changes:
- pools can now be initialized to size 0, meaning unlimited
- stream engine uses a memcap setting. Sessions, segments and aldata is part
of this, app layer state isn't.
- memory is accounted using a global int that is spinlocked.
- a counter for sessions that have not been picked up because of memcap was
added.
- all reassembly errors are converted to debug msgs.
16 years ago
Nick Rogness
2b7b78f1bf
Intial IPFW support FreeBSD and OSX
16 years ago
Pablo Rincon
7f250a814a
Fixing redeclaration of run_mode
16 years ago
Pablo Rincon
5592189c04
Loading flow settings from config
16 years ago
Jason Ish
0a5bc2d600
Fix issue 74. separate initialization of run modes from adding them to a thread. - fixes issues with multiple output threads.
16 years ago
Pablo Rincon
260e581929
First version of the reputation API
16 years ago
Pablo Rincon
256d745b39
Including header file for cpu detection
16 years ago
Pablo Rincon
17cd010b0c
Detect the number of CPUs configured and online. Printing a small summary at the startup
16 years ago
Victor Julien
d446b85237
Remove obsolete files.
16 years ago
William Metcalf
82978f9f27
new pfring runmode for quad core, other small pfring fixes
16 years ago
Pablo Rincon
705471e4ee
Adding single pattern matcher algorithms. If you cannot store a context for the patterns, use SpmSearch() macro. Adding unittests and stats
16 years ago
Gurvinder Singh
5c8d90afc8
memory leak fixes
16 years ago
William Metcalf
8a64321340
raw pcap support additionl ipv4/6 validation
16 years ago
Pablo Rincon
b6a3395c08
Adding unittest helper functions for building generic packets, checking arrays of expected match results, perform generic tests, etc. Look at util-unittest-helper.c and detect-ipproto.c for references
16 years ago
Jason Ish
095f2cf6ef
Consistency fix.. Xxxlog -> XxxLog.
16 years ago
Jason Ish
e204d07717
Have output modules register themselves so run mode configurator becomes aware of them for purposes of being configured from the config file.
16 years ago
Victor Julien
56556eb550
Set payload no inspect flag for packets with encapsulated packets as these are inspected separately
16 years ago
Victor Julien
9ececacda3
Fix packet timestamp handling for encapsulated packets.
16 years ago
Jason Ish
cf95fa7c74
configurable outputs for nfq and pcap file.
16 years ago
Jason Ish
a05436af8c
Configurable alert outputs for PF_RING modes.
16 years ago
Jason Ish
844c444af1
Use the configuration file to setup alert logging (and http logging).
...
Only setup for the live pcap modes at the moment.
16 years ago