mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
565e138754
Reading a pcap from /dev/stdin or a named pipe currently fails with "failed to get first packet timestamp. pcap_next_ex(): -1" because InitPcapFile calls setvbuf on the FILE* underlying the pcap handle after libpcap has already consumed the pcap header. On a non-seekable fd glibc cannot recover from that and the next read returns -1. Detect non-regular files via fstat and skip setvbuf in that case so the read keeps working on pipes, fifos and stdin. Accept pcap-file.buffer-size values of 0, which disables setvbuf buffering as an explicit opt-out, or PCAP_FILE_BUFFER_SIZE_MIN (4 KiB) to PCAP_FILE_BUFFER_SIZE_MAX (64 MiB). Treat any non-zero setvbuf return value as an error, not just negative values. When pcap-file.buffer-size fails to parse, retain the default buffer size instead of falling through and setting it to 0. The branches are now mutually exclusive so only one of the parse-error, accepted, or out-of-range messages is logged. Update the user guide: --pcap-file-buffer-size now documents valid values of 0 (disables setvbuf buffering) or 4 KiB to 64 MiB, and pcap-file.rst notes that 0 is the opt-out for non-seekable sources such as stdin and named pipes. Bug: #8464. |
3 months ago | |
|---|---|---|
| .. | ||
| 3rd-party-integration | 8 years ago | |
| _static | 3 years ago | |
| appendix | 1 year ago | |
| capture-hardware | 3 months ago | |
| configuration | 3 months ago | |
| devguide | 3 months ago | |
| file-extraction | 11 months ago | |
| firewall | 3 months ago | |
| install | 9 months ago | |
| ips | 8 months ago | |
| licenses | 7 years ago | |
| lua | 3 months ago | |
| manpages | 4 months ago | |
| output | 3 months ago | |
| partials | 3 months ago | |
| performance | 3 months ago | |
| plugins | 1 year ago | |
| protocols | 12 months ago | |
| reputation | 3 years ago | |
| rule-management | 6 months ago | |
| rules | 3 months ago | |
| upgrade | 11 months ago | |
| .gitignore | 2 years ago | |
| Makefile.am | 7 months ago | |
| Makefile.sphinx | 10 years ago | |
| README.md | 5 years ago | |
| acknowledgements.rst | 1 year ago | |
| command-line-options.rst | 6 years ago | |
| conf.py | 4 months ago | |
| convert.py | 3 years ago | |
| docutils.conf | 3 years ago | |
| generate-evedoc.sh | 2 years ago | |
| index.rst | 12 months ago | |
| initscripts.rst | 6 years ago | |
| install.rst | 8 months ago | |
| make-sense-alerts.rst | 6 years ago | |
| public-data-sets.rst | 7 months ago | |
| quickstart.rst | 5 months ago | |
| requirements.txt | 3 years ago | |
| security.rst | 12 months ago | |
| support-status.rst | 3 years ago | |
| unix-socket.rst | 1 year ago | |
| upgrade.rst | 3 months ago | |
| verifying-source-files.rst | 8 months ago | |
| what-is-suricata.rst | 6 years ago | |
README.md
Suricata User Guide
This directory contains the Suricata Guide. The Suricata Developer's guide is included as a chapter of the Guide. The Sphinx Document Generator is used to build the documentation. For a primer os reStructuredText see the reStructuredText Primer.
Verifying Changes
There are a number of output formats to choose from when making the source documentation locally (e.g. html, pdf, man).
The documentation source can be built with make -f Makefile.sphinx html. Substitute the 'html' word for desired output format.
There are different application dependencies based on the output desired.