Open Information Security Foundation

11/27/2022

01:35 AM Suricata Bug #4200: Flows not deleted in bpf ipv4_maps

I did some more deep dive into this for Suricata 7.
1. I did setup a breakpoint on https://github.com/OISF/suricat... Odin Jenseg

11/22/2022

09:42 AM Suricata Feature #5705 (In Progress): Add Wireguard parser

Adding a parser for the Wireguard VPN protocol.
* Includes detection of the protocol using patterns.
* Protocol ... Odin Jenseg

07/01/2022

08:16 AM Suricata Support #5287: (Maybe) issues in FTP decoder, Suricata stop analyzing traffic

Hi,
Have anyone been able to look into this, or observed similar issue? Or if there are any changes related to the... Odin Jenseg

04/25/2022

01:28 PM Suricata Support #5287 (New): (Maybe) issues in FTP decoder, Suricata stop analyzing traffic

We have observed on several of our sensors that Suricata has stopped analyzing traffic, kernel packets goes to zero, ... Odin Jenseg

08/18/2021

02:03 PM Suricata Bug #4200: Flows not deleted in bpf ipv4_maps

A bit to fast writing, but summarized.
Downgrade:
In GDB we did hit the local bypass downgrade https://github.co... Odin Jenseg

08/17/2021

02:42 PM Suricata Bug #4200: Flows not deleted in bpf ipv4_maps

Did a quick test with GDB now, and it did not break on downgrade, but instead in the following line: https://github.c... Odin Jenseg

11:16 AM Suricata Bug #4200: Flows not deleted in bpf ipv4_maps

Did some testing today with Suricata 5.0.6, and observed similar issues that the ipv4_maps map did contain flows that... Odin Jenseg

07/01/2021

09:08 PM Suricata Bug #4502: TCP reassembly memuse approaching memcap value results in TCP detection being stopped

I think this issue is related to what I observed in https://redmine.openinfosecfoundation.org/issues/4200. We did obs... Odin Jenseg

06/05/2021

03:02 PM Suricata Feature #4515: Add DNS logging of Z flag

https://github.com/OISF/suricata/pull/6181 Odin Jenseg

01:52 PM Suricata Feature #4515 (Closed): Add DNS logging of Z flag

The this Z field is logged by Zeek: https://docs.zeek.org/en/master/logs/dns.html
And has shown good value to have i... Odin Jenseg