Feature #3316
open
Unix socket: support dumping flow table
Added by Victor Julien about 5 years ago.
Updated about 5 years ago.
Description
Idea is to use the unix socket interface dump the flow table. This could be used to analyse the internal state of flows.
The conntrack tool from Linux/Netfilter could be an example.
Related issues
3 (3 open — 0 closed)
- Related to Task #3288: Suricon 2019 brainstorm added
- Related to Feature #3295: Unix socket: support to receive flow shunting information added
Suggestions about use cases and things like syntax and such are welcome.
- Description updated (diff)
One thing as we were exploring saving flow state is that there is not currently a stable identifier for flows between suricata runs. If we plan to load the dumped flow table, flow hash_id will need to be stable (no seed), or support for community flow id will need to be added to flow as a way to marry dumped state and captured flows.
- Related to Task #3301: Research: Failover support within the current IPS implementation added
Also available in: Atom
PDF