mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
d727271202
Add a note to the pcre extraction section stating that a flow: capture
is dropped when the packet is inspected without a flow, and that such a
packet still alerts.
ICMPv4 error messages are one way to get such a packet: FlowCreateCheck
returns false for them, while DecodeICMPV4 has already set p->payload,
so they reach the detection engine with something to inspect and nowhere
to store a flow variable. A packet the flow engine could not give a flow
to once the memcap was reached and no used flow could be reclaimed is
the other.
The pkt: and alert: scopes described in the same section are unaffected,
because a packet variable is stored on the packet and an alert variable
on the alert.
Issue: 8862
(cherry picked from commit
|
2 months ago | |
|---|---|---|
| .. | ||
| 3rd-party-integration | ||
| _static | ||
| appendix | 1 year ago | |
| capture-hardware | 4 months ago | |
| configuration | 2 months ago | |
| devguide | 9 months ago | |
| file-extraction | 2 years ago | |
| firewall | 2 months ago | |
| install | 1 year ago | |
| ips | 1 year ago | |
| licenses | ||
| lua | 5 months ago | |
| manpages | 4 months ago | |
| output | 6 months ago | |
| partials | 4 months ago | |
| performance | 8 months ago | |
| plugins | 2 years ago | |
| reputation | ||
| rule-management | 1 year ago | |
| rules | 2 months ago | |
| upgrade | 1 year ago | |
| .gitignore | 2 years ago | |
| Makefile.am | 9 months ago | |
| Makefile.sphinx | ||
| README.md | ||
| acknowledgements.rst | 1 year ago | |
| command-line-options.rst | ||
| conf.py | 1 year ago | |
| convert.py | ||
| docutils.conf | ||
| generate-evedoc.sh | 2 years ago | |
| index.rst | 1 year ago | |
| initscripts.rst | ||
| install.rst | 2 months ago | |
| known-issues.rst | 1 year ago | |
| make-sense-alerts.rst | ||
| public-data-sets.rst | 8 months ago | |
| quickstart.rst | 2 years ago | |
| requirements.txt | ||
| security.rst | 1 year ago | |
| support-status.rst | ||
| unix-socket.rst | 1 year ago | |
| upgrade.rst | 4 months ago | |
| verifying-source-files.rst | 9 months ago | |
| what-is-suricata.rst | ||
README.md
Suricata User Guide
This directory contains the Suricata Guide. The Suricata Developer's guide is included as a chapter of the Guide. The Sphinx Document Generator is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.
Verifying Changes
There are a number of output formats to choose from when making the source documentation locally (e.g. html, pdf, man).
The documentation source can be built with make -f Makefile.sphinx html. Substitute the 'html' word for desired output format.
There are different application dependencies based on the output desired.