Project

General

Profile

TBD

open

To be determined -- place holder for tickets that are not prioritized/scheduled yet

14%

1079 issues   (155 closed — 924 open)

Issues by
Bug

89/343
Feature

28/389
Support

2/2
Optimization

18/107
Task

4/135
Documentation

14/102
Security

0/1
Related issues
Bug #317: Invalid Rules Actions
Bug #376: Windows - Failure when trying to get MTU Actions
Bug #437: filemagic / libmagic inconsistent between releases Actions
Bug #500: duplicate values in host-os-policy not detected Actions
Bug #705: http.log missing lots of requests under high traffic load Actions
Bug #708: Flow vars issue in pcap file mode Actions
Bug #747: Reset async flag if stream is found to be non-async Actions
Bug #778: ipv6 addr with nat64 notation Actions
Bug #786: Windows - yaml directory paths Actions
Bug #849: Not alerting on invalid http request Content-Length Actions
Bug #868: Makefile[.in] doesn't use its own INSTALL variable definition Actions
Bug #924: missing space between variable and value in suricata.yaml Actions
Bug #992: Different alerts reported when reading from pcap file with runmode=single and runmode=autofp Actions
Bug #1083: pfring: valgrind: Syscall param socketcall.setsockopt(optval) points to uninitialised byte(s) Actions
Bug #1084: pfring: valgrind: memory leak at exit in bpf filter Actions
Bug #1152: Write to ipfw divert socket failed: Message too long Actions
Bug #1247: Using suppress in threshold.config does not prevent dropping Actions
Bug #1370: sctp fp on suricata engine Actions
Bug #1382: BPF not reflected in suricata.log when using pf-ring Actions
Bug #1390: suricatasc return empty iface-stat.pkts in IPS nfqueue mode Actions
Bug #1399: Flowbits rules not always evaluated in necessary order Actions
Bug #1412: byte_test checks before byte_extract happens in some cases Actions
Bug #1484: Remove BUG_ON(1) statements in the packet path Actions
Bug #1526: Malformed encoded base64 packet in json logs Actions
Bug #1549: flow keywords rule parsing Actions
Bug #1560: Newline in certificate subject name results in premature line break in TLS log Actions
Bug #1593: Negative within error - works in snort Actions
Bug #1722: ip rules don't trigger under the context of 'flow:stateless' Actions
Bug #1738: [ERRCODE: SC_ERR_MEM_ALLOC<1>] - Can not allocate fingerprint string - Suricata 2.0.11-1 Actions
Bug #1754: Inconsistent behavior with 'only_stream' flow keyword Actions
Bug #1770: Suricata takes very long time to start using hyperscan and large/custom detect settings Actions
Bug #1772: Inconsistent number of alerts while reading a pcap - runmode single/autofp,unix-socket Actions
Bug #1782: Unkown TLS's subject attributes Actions
Bug #1833: Transaction can be logged before stream reassembly and parsing are complete Actions
Bug #1838: suricata 3.0* and 3.1 hang after heavy traffic w/ pfring zc (reproducible) Actions
Bug #1881: pcap logging out of order Actions
Bug #1911: Commandline provided configuration values don't persist after initial startup Actions
Bug #1918: Incorrect packet stats in pcap and pf_ring capture modes Actions
Bug #1922: runmodes: memory leaks Actions
Bug #1976: ioctl warnings at startup and shutdown with dropped privileges Actions
Bug #1981: luajit states fail to run with valgrind Actions
Bug #2013: failure of TCP after DOS attack Actions
Bug #2042: Difference protocol of MD5 rule will restart Suricata automatically Actions
Bug #2056: missing warning on a rule using within with one content keyword Actions
Bug #2069: logging: payload may not represent traffic the generated alert (eve and unified2) Actions
Bug #2091: nonexistent/misspelled custom fields accepted during parsing of suricata.yaml Actions
Bug #2094: luajit: SCFlowvarGet always returns null Actions
Bug #2220: When running on a single-CPU machine, pcap processing takes a long time Actions
Bug #2221: Suricata batch processing slowed down by 0.2s intervals Actions
Bug #2249: rule with file keyword used with ip or tcp not seen as invalid Actions
Bug #2257: rate_filter doesn't honor "timeout" if it is longer than "seconds" parameter Actions
Bug #2289: af-packet bpf filtering failed to select multiple vlan Actions
Bug #2296: Unix Manager Should Not Use Conf Functions to Pass Information to source-pcap-file Actions
Bug #2305: unified2 alerts not including xff ips using extra-data mode Actions
Bug #2337: give warning if permissions won't allow log reopen after dropping privs Actions
Bug #2351: Suricata with alert-prelude option sending only one IDMEF message (not more). Actions
Bug #2358: Inconsistent DNS/flows extracted from pcap Actions
Bug #2373: unix domain socket owner stays root when priviledges dropped Actions
Bug #2378: log rotation 'flag' should be atomic Actions
Bug #2393: One way TLS traffic not properly identified Actions
Bug #2412: Suricatasc isn't showing or allowing pcap file continuous option Actions
Bug #2413: Pcap Interrupt Keeps Pcap File Processing Interrupted Actions
Bug #2423: Suricata 4.0.3 and Napatech crashing Actions
Bug #2424: suri->userid (SCInstance) does not reflect correct uid if suricata is started as non-root Actions
Bug #2429: TCP-session and wrong alert timestamp Actions
Bug #2434: memleak - possible/definite memleaks reported for libnss3 and pthread_create Actions
Bug #2462: memleak: gitmaster json dns logger - 4.1.0-dev (rev efdc592) Actions
Bug #2477: 802.1ah & Untagged Traffic Actions
Bug #2478: PCAP logging does not include 802.1q header when using af-packet Actions
Bug #2479: http_cookie negation fails if no cookie in traffic Actions
Bug #2494: Invalid Base64 payload for filemd5 alerts Actions
Bug #2500: stored will always equal false in fileinfo events Actions
Bug #2581: content match fails with on large streams Actions
Bug #2614: filemagic: pdf filemagic match Actions
Bug #2623: Missing http.status information in eve.log according to tcp packets. Actions
Bug #2627: lua: load script from same location as rule file if not in default rule location Actions
Bug #2656: Alerts not triggered under some conditions on traffic containing rule matches Actions
Bug #2680: eve output filetype:unix_dgram does not start a socket Actions
Bug #2712: long wait time on exit - pcap read - unable to get all packet threads to process their packets in time Actions
Bug #2718: pkts/drops counters discrepancy Actions
Bug #2739: Incorrect detection of the jit support of libpcre Actions
Bug #2763: different number of events on exact same runs with asan and no asan builds Actions
Bug #2807: DNS LUA Logging does not have any way to log NXDOMAIN Actions
Bug #2814: suricatasc: hangs indefinitely and uses too much processing for pcap-file-continuos command Actions
Bug #2815: race condition during file-magic initialization Actions
Bug #2858: app-layer-protocol:failed; doesn't match traffic with ALPROTO_UNKNOWN Actions
Bug #2861: Suricata rule sid:2224005 SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman) not works Actions
Bug #2891: Empty rrname in DNS answer for non-recurse NS answers Actions
Bug #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific Actions
Bug #2928: alerts on icmp signatures in 4.0.x and 4.1.x Actions
Bug #2933: Suricata 4.1.3 block flow Actions
Bug #2934: VLAN tags stripped when saving pcap log Actions
Bug #2954: Strange interaction with afpacket - high CPU usage and no packet processing Actions
Bug #2960: valgrind gives 'Conditional jump or move depends on uninitialised value(s)' Actions
Bug #2973: the flow after match the rules Actions
Bug #2978: IRC traffic parsed by FTP Actions
Bug #2988: redis fails sometimes to reload rules to suricata; restart of redis fixes Actions
Bug #3026: Windows MSI - add in service scripts Actions
Bug #3040: pcap: with -r <single file> pcap_open_offline failure does not lead to non-zero exit code Actions
Bug #3041: snmp parsing error message Actions
Bug #3049: thread hangs in pfring mode Actions
Bug #3065: tls_cert_XX keywords date format parsing error Actions
Bug #3066: No documentation for hostbits Actions
Bug #3071: coverity warning in tls wrt tainted scalars Actions
Bug #3075: RX thread hang in pcap-file mode Actions
Bug #3083: DROP rule with "noalert" Actions
Bug #3087: Prelude output IDMEF message issue Actions
Bug #3093: FTP logging needs suricata-verify tests Actions
Bug #3095: default log dir not always honored - git master Actions
Bug #3097: build for eBPF programs needs a way to specify Linux header location Actions
Bug #3117: multiple valgrind reported warnings - 5.0.0-dev (9e126b210 2019-08-07) Actions
Bug #3146: scan-build warning for asn1 parser Actions
Bug #3179: http_header_names not generating alerts Actions
Bug #3191: When run suricata with pf_ring zc mode suricata did not try to connect redis. Actions
Bug #3220: ssl_version keyword negation (!) not working Actions
Bug #3221: EBPFDeleteKey -- ERRCODE: SC_ERR_SYSCALL(50) Actions
Bug #3229: Abnormal traffic produces unexpected alerts for traffic that is opposite direction of rule Actions
Bug #3238: rust compile fail on ppc64el Actions
Bug #3257: Lua PANIC: unprotected error in call to Lua API (stack overflow) Actions
Bug #3258: VXLAN exceeds MTU maximum Actions
Bug #3309: xdp: some bypass stats/counters do not update properly Actions
Bug #3323: tracking: ipv6 evasions Actions
Bug #3336: Suricata compilation on windows / mingw Actions
Bug #3348: Possible detection issue with VXLAN parser Actions
Bug #3349: Suricata 5.0 crashes while rule reload Actions
Bug #3353: xdp_filter segmentation fault util-ebpf.c:728 Actions
Bug #3354: eve-log dns (possibly others) alerts miss metadata for all but first packet Actions
Bug #3358: bypass_filter AFPBypassCallback Segmentation Fault Actions
Bug #3359: suricata.log ownership not being set to run-as user/group Actions
Bug #3370: Suricata 5.0.0 Crashes Intermittently Actions
Bug #3371: 'suricatasc -c conf-get ...' returns outdated values after reloading suricata Actions
Bug #3374: Windows: Suricata does not warn upon insufficient permissions Actions
Bug #3480: EVE JSON - Incorrect Packet Logged Actions
Bug #3493: installed libhiredis includes/libs not found by configure script Actions
Bug #3617: Missing icmp netflow Actions
Bug #3681: Rule reload causes segfault Actions
Bug #3692: delta calculations come up negative Actions
Bug #3698: Incorrect max length of windivert filter Actions
Bug #3702: windows: when using compile against latest npcap traffic not seen unless bpf is used Actions
Bug #3705: VarNameStoreLookupById: Assertion `!(current == ((void *)0))' Actions
Bug #3728: ftp file extraction failure Actions
Bug #3746: bsize needs to err upon non possible matching conditions (4.1.x) Actions
Bug #3771: Extreme performance degradation when doing IP-only rules with flow-keyword Actions
Bug #3800: Netronome XDP mode: Unable to find 'cpus_count' map" Actions
Bug #3801: Problem harware bypassing with Netronome Actions
Bug #3809: Thresholding file-store rule with flowbits saves empty file to disk Actions
Bug #3834: Suricata 'content' keyword does not match on IP *payload* when using IP keywords Actions
Bug #3873: NET_RAW capability dropped for NFQ mode when uid/gid is specified Actions
Bug #3889: Support interfaces with MTU > 1500 Actions
Bug #3900: After a completed rule reload, Suricata sometimes is stuck for 1h with `rs_nfs_state_get_tx` peak Actions
Bug #3986: suricata -r not working for sshfs-mounted folder but working for sshfs-mounted file Actions
Bug #3990: suricata -r not working for symbolic link linking to pcap in different folder but working for symbolic link linking to pcap within same folder Actions
Bug #4016: filesize with filestore store empty files Actions
Bug #4063: rdata field not included in DNS log for NS rrtype Actions
Bug #4081: ICMP IPv6 signature not matching when source contains ! condition with IPv4 addresses only Actions
Bug #4087: excessive CPU usage on Windows with --pcap-file-continuous option Actions
Bug #4107: Coredump with async-oneside: true enabled in suricata.yaml. Actions
Bug #4108: Rule reloading: Rules that change the action from alert to drop, or drop to alert don't have their action updated. Actions
Bug #4178: DNS Query triggers alert but no output in alert-debug.log Actions
Bug #4183: Timestamps sometimes off by 2 hours on Windows Actions
Bug #4186: error when cpu cores > 64 (use pf-ring ) Actions
Bug #4200: Flows not deleted in bpf ipv4_maps Actions
Bug #4214: Honor vlan: use-for-tracking in ebpf maps Actions
Bug #4223: rule loading takes too much time in certain cases Actions
Bug #4248: Suricata HTTP protocol resolves hostname exception Actions
Bug #4265: QA lab: add possibility to do repeatable replay tests Actions
Bug #4286: FN occurs when using negated isdataat with http_cookie keyword Actions
Bug #4330: file hash parameter in yaml accepts non valid values Actions
Bug #4356: Napatech memory leaks Actions
Bug #4357: Napatech memory corruption Actions
Bug #4370: the latest release of Suricata V6.0.1 for Windows use high CPU Actions
Bug #4391: Explicit path for datastes load/save in a rule is not honored if the default log path is different Actions
Bug #4426: XDP redirect cpu likely broken in 5.9 Actions
Bug #4499: Sudden and enormous memory leak Actions
Bug #4520: Suricata 6.0.2 segfault NFQ Actions
Bug #4553: Configuration test mode succeeds when reference.config file contains invalid content Actions
Bug #4583: xdp: libbpf xdp filter segfault with latest libbpf code Actions
Bug #4655: Dataset dumping to disk seems limited to 1000 Actions
Bug #4657: SSLv2 app-layer detection patterns incorrectly registered Actions
Bug #4669: threatexpert usage in reference.config Actions
Bug #4715: pcre keyword cause more alert! Actions
Bug #4736: ubsan: misaligned memory loads Actions
Bug #4740: libnet error with reject action on pfSense Actions
Bug #4755: eve: timestamp loses sub-second precision in some arm scenarios Actions
Bug #4843: IPv6 evasion : dos mld chiron Actions
Bug #4844: IPv6 evasion : redir6 Actions
Bug #4845: IPv6 evasion : parasite6 + dos new ipv6 + fake mldrouter6 advertise Actions
Bug #4846: IPv6 evasion : flood + ndpexhaust26 Actions
Bug #4874: FN when using stream_size with http proto and buffers Actions
Bug #4875: FN when using flowbits and ftp protocol. Actions
Bug #4880: hostbits/xbits: treat hostbits and xbits differently in the rule ordering stage Actions
Bug #4914: FLOW_DIR_REVERSED is not handled in multiple places Actions
Bug #4916: af-packet: Sending packet failed on socket 20: Message too long Actions
Bug #4940: ftp-data: protocol misclassification if the file begins with a protocol pattern Actions
Bug #5012: Remove duplicate definition of constants between C and Rust Actions
Bug #5013: fast pattern discrepancy when using engine-analysis Actions
Bug #5064: frames: duplicate alerts when no flow direction provided Actions
Bug #5071: Suricata RAM usage never decreasing Actions
Bug #5072: detect/ip_proto: inconsistent behavior when specifying protocol by string Actions
Bug #5087: smb: file.name sticky buffer doesn't match all smb files Actions
Bug #5133: DCERPC: master - logs not created Actions
Bug #5134: DCERPC: dcerpc.iface keyword not using fast pattern/mpm causes severe performance degradation Actions
Bug #5135: DCERPC: dcerpc.iface keyword alert results differ from 5 vs 6/master Actions
Bug #5140: nfs: NFS3/NFS2 procedure conflict Actions
Bug #5160: smb: Misguiding keyword smb.named_pipe Actions
Bug #5172: Napatech stream mismanagement following non-transient error Actions
Bug #5176: False positive when negated content is far ahead of matching content. Actions
Bug #5199: Setting flow memcap too low tries to allocate the whole system memory Actions
Bug #5204: Memory leak caused by ippair processing Actions
Bug #5255: Reported pcap_filename in alerts are not correct Actions
Bug #5263: Flow is stuck if there is no traffic Actions
Bug #5264: random value for ja3 and ja3s hashes during the next scan Actions
Bug #5290: pip install failure Actions
Bug #5292: cppcheck: "portability" warnings: using void pointers in calculations Actions
Bug #5293: cppcheck: "portability" warnings: non thread-safe functions Actions
Bug #5332: Smb2 can not store files! Actions
Bug #5363: Memory leak in rust SMB file tracker Actions
Bug #5406: HTTP Req and resp correlation incorrect Actions
Bug #5407: suricatasc runtime error Actions
Bug #5432: events: PACKET_RECYCLE does not reset event_last_logged (5.0.x backport) Actions
Bug #5451: Non-Deterministic Behavior with HTTPS Checksum Verification Actions
Bug #5462: IPS bridge mode -- warn/error if there's an IP address associated with any monitoring interface Actions
Bug #5480: Cannot compile Suricata 6.0.6 with PF_RING support Actions
Bug #5490: Applayer Detect protocol only one direction - NFS Actions
Bug #5492: Applayer Detect protocol only one direction - Kerberos Actions
Bug #5502: Suricata hangs and then exits when the first PCAP processed has 0 packets Actions
Bug #5520: If alert status code is 200, some fields are missing Actions
Bug #5562: rule_perf.log with multiple sort orders is invalid JSON Actions
Bug #5652: af-packet: remove emergency flush from yaml Actions
Bug #5656: rules: engine analysis gives false positive warning Actions
Bug #5713: TLSv1 not logged into tls events. Actions
Bug #5721: http2: logging settings do not match what is seen in the RFC Actions
Bug #5739: htp: handle alloc failure for user data Actions
Bug #5748: iprep/ipv6: memory leak on same input in different forms Actions
Bug #5750: Spurious "SURICATA DNP3 Length too small" error and failed reassembly Actions
Bug #5751: DNP3 preprocessor incorrectly parses READ requests Actions
Bug #5754: I use the file-extraction to store the files transferred by HTTP2, but fileinfo does not have the filename field. Actions
Bug #5756: datasets: ipv4.src/dst, ip.src/dst check rules match on pseudo packets Actions
Bug #5758: tls: iOS session with TCP fastopen and TLS 1.3 gives invalid record warning Actions
Bug #5766: Misparsing of DNP3 g70v1 objects and failed reassembly Actions
Bug #5767: Dangling pointer in SSL Parser Actions
Bug #5771: xdp: Flows with nested VLANs are not bypassed by XDP filter Actions
Bug #5778: ftp fileinfo and extraction seem not to trigger when it should Actions
Bug #5788: files: output modifies file state Actions
Bug #5864: radix tree do not support "0.0.0.0/0 ::/0" Actions
Bug #5871: ips/af-packet: doesn't work between 2 virtio devices Actions
Bug #5880: pcap recursive mode not working as expected Actions
Bug #5938: for syslog output, the setting identity is not properly set Actions
Bug #5941: DNS rules not matching when traffic is over tcp Actions
Bug #5954: redis: output crash on Mac Actions
Bug #6088: xdp/ebpf: updated shipped bpf files to be supported by libbpf v1.0 and higher Actions
Bug #6108: http: leading gap in request data leads to invalid next request Actions
Bug #6110: Bad Checksum 0xffff - ICMPv4 & ICMPv6 Actions
Bug #6154: Conditional pcap-log fails to log packets for some alerts when using “pcap-file-continuous” flag Actions
Bug #6161: file-store: missing hash on TRUNCATED files Actions
Bug #6173: http: loss of backward compatibility in HTTP logs from v6 to v7 Actions
Bug #6175: eve/alert: deprecated fields can have unexpected side affects Actions
Bug #6176: Multi-tenancy: Tenant selector to tenant ID mapping is o(n) Actions
Bug #6177: detect-engine: stream match for rules is interdependent Actions
Bug #6178: dns: erroneous app_proto settings in rule analysis Actions
Bug #6197: stream: additional alerts being seen once sigs are added Actions
Bug #6204: pcre: "Conditional jump or move depends on uninitialised value(s)" in valgrind Actions
Bug #6218: xbits inconsistent behavior when running a pcap file. Actions
Bug #6238: AF-XDP crash when closing Suricata while receiving traffic Actions
Bug #6239: ASAN: double free when multi-tenancy enabled and configured Actions
Bug #6250: libbpf: elf: legacy map definitions in 'maps' section are not supported by libbpf v1.0+ Actions
Bug #6257: pcap: hang at shutdown for some interfaces Actions
Bug #6283: FTP parsing yields in some cases smtp and http event types Actions
Bug #6307: Packet loss or client connection drop causes delayed detection on HTTP rules Actions
Bug #6365: Suricata AF_XDP not using libxdp XDP dispatcher and can't co-exist with another XDP program Actions
Bug #6372: napatech: Can produce invalid microsecond values. Actions
Bug #6373: main/startup: support sentinel file signal for initial rule processing completion Actions
Bug #6385: NFQ: Dereference of pointer that potentially can be null Actions
Bug #6416: Suricata not using Myricom SNF driver in a performant way Actions
Bug #6440: TLS logging and maybe more not working on tagged traffic Actions
Bug #6458: eve/http: discrepancy in http events and http objects logged in alerts Actions
Bug #6559: Signatures starting with space have invalid diagnosis Actions
Bug #6560: Suricata can’t output response when meet a tcp retransmission after a response Actions
Bug #6565: coverity: new issues after updating to 2023.6.2 Actions
Bug #6567: anomaly and file info logs discrepancy results between versions Actions
Bug #6587: DPDK 'tap' mode doesn't alert on TCP protocol rules Actions
Bug #6588: DPDK 'ips' mode doesn't pass TCP traffic Actions
Bug #6591: protodetect: ftp parsed as smtp Actions
Bug #6611: Fake Tunnels In Fragmented IP Packets Actions
Bug #6623: Suricata BPF filter differs from tcpdump (tcpdump behaviour seems correct) Actions
Bug #6655: invalid distance/within does not produce an error Actions
Bug #6667: Compiler warning with --enable-dag Actions
Bug #6692: Have keywords export JSON dump function for engine analysis Actions
Bug #6713: Weak ciphers event in Kerberos protocol Actions
Bug #6716: fast.log enabled when running specifically without rules Actions
Bug #6722: dpdk: inconsistent stats reporting Actions
Bug #6731: eBPF XDP program is not attached when pinned-maps is true Actions
Bug #6735: setting variables with --set leads to segfault Actions
Bug #6754: libsuricata: restructure directory and files to allow for include files to be name spaced Actions
Bug #6779: http.header_names behavior when encountering duplicate header names Actions
Bug #6789: Dns remarks without showing dns name Actions
Bug #6793: Unit tests failed to build on Solaris Actions
Bug #6804: ci: add test for non-bundled htp Actions
Bug #6815: util/decode-mime: Possible derefernce of nullptr Actions
Bug #6825: af-packet: possible free of unallocated memory Actions
Bug #6826: app-layer/htp: Possible dereference of null in HTPCallbackRequestLine Actions
Bug #6860: eve/alert: multiple issues for ICMP Actions
Bug #6874: libhtp appears to stop parsing HTTP client requests mid-pcap - /libhtp::request_uri_not_seen Actions
Bug #6886: HTTP Chunk Length Value disappearing Actions
Bug #6894: bsize validation FP on content negation with hex encoded 0d 0a Actions
Bug #6915: How to write the filepath to the alert log when using default mode with pcap-log? Actions
Bug #6920: FR, FM and Global stats gone after 7.0.4 Actions
Bug #6933: dpdk: landlock support Actions
Bug #6934: UBSAN: null pointer passed as argument to memcpy in unit test Actions
Bug #6963: rule-reload: potential memory leak in multiple rule reloads Actions
Bug #6997: Socket mode hard fail with pcap logging mode and multiple link layer pcap file Actions
Bug #7005: Porting changes for running Suricata on Solaris Actions
Bug #7006: spm: boyermoore implementation appears to underperforming Actions
Bug #7008: Static build failure on Linux since Actions
Bug #7009: dpdk: compile warning ‘rte_eth_bond_members_get’ is deprecated Actions
Bug #7016: tls: hello retry request handling issues Actions
Bug #7024: unix-socket: inconsistent default behavior Actions
Bug #7091: Segfault on 7.0.5 with generated live traffic Actions
Bug #7133: Could the midstream policy support "drop-packet"? Actions
Bug #7137: "invalid cpu range" when trying to use CPU affinity Actions
Bug #7169: lua/output: vendored lua search for modules in /usr/local/ rather than /usr/ Actions
Bug #7179: Capture Kernel Drops happen when data transferring inside the intranet Actions
Bug #7184: failed to parse addresses Actions
Bug #7197: detect/flowvars: persist if the inspection happens on multiple packets Actions
Bug #7199: Suricata 7 no longer logging app-layer metadata in alerts Actions
Bug #7201: Thread 178 "W#21-84:00.0" received signal SIGSEGV, Segmentation fault. Actions
Bug #7212: strtoul: replace with ByteExtractString variant Actions
Bug #7250: tls version match can have incorrect behaviour Actions
Bug #7255: Cannot run suricata-update on a FIPS compliant server Actions
Bug #7259: Flaky behaviour of rules using Threshold keyword when running with --pcap-file-continuous Actions
Bug #7274: ssl_state:unknown not implemented Actions
Bug #7284: rules: pass/drop <app proto> rules actions no longer apply to flow Actions
Bug #7285: Websocket compression mishandling Actions
Bug #7318: flow: flow timeout pseudo packet triggers unexpected alert Actions
Bug #7331: Packet direction check incorrect for Lua TLS functions Actions
Bug #7343: SURICATA TLS invalid record type and SURICATA Applayer Detect protocol only one direction on TLS handshake Actions
Bug #7344: build: build can sometimes fail copying the lua headers into place Actions
Bug #7345: build fail when only --enable-profiling-rules is used Actions
Bug #7346: eve/fileinfo: sha256 should not be logged on incomplete file Actions
Bug #7347: eve/alert: log file_data Actions
Bug #7356: Unexpected effect of filestore keyword Actions
Bug #7357: filestore keyword option seems not to work Actions
Bug #7361: rules: unknown internal events not being detected as errors Actions
Feature #121: Alert on domain name look up, capture traffic for corresponding IP Actions
Feature #249: Configure host-os-policy from a file, like snorts host_attribute.xml Actions
Feature #266: log http raw request for network forensic Actions
Feature #273: IRC protocol detection support Actions
Feature #276: Libcap support for dropping privileges Actions
Feature #294: Limit inspection of a stream and/or rule... Actions
Feature #328: Traceability and QA with regards to rules loaded Actions
Feature #365: expose interface(unix socket command) to reset tcp connection Actions
Feature #385: Configuration option to log all known (pcap) data for a stream when an alert fires Actions
Feature #425: Inspect the effects of mixing threshold and detection filters etc.. Actions
Feature #432: PCAP-NG support Actions
Feature #448: dlp: md5sum based on part of files Actions
Feature #465: benchmark runmode Actions
Feature #473: pcap log: alert log with packet indexes Actions
Feature #511: Port indepedent protocol identification (nDPI) Actions
Feature #535: new keywords - time , day Actions
Feature #544: Live traffic decryption Actions
Feature #547: libinjection -- sqli library Actions
Feature #584: lua: expose file buffers Actions
Feature #596: rule profiling: multiple outputs per run Actions
Feature #609: Active Response in inline mode (like react in snort 2.9+) Actions
Feature #659: Update IP reputation from unix socket. Actions
Feature #682: Add DEP and ASLR to Windows Binary Actions
Feature #716: configurable packet_stats.csv and packet_stats.log Actions
Feature #728: Add support for OpenCL Actions
Feature #745: Tunnel configuration Actions
Feature #776: rules: Add smtp_envelope and smtp_header keywords Actions
Feature #783: LuaJIT be able to return various messages for a single script. Actions
Feature #816: TCP SACK: limits per stream Actions
Feature #821: conditional logging: output steering Actions
Feature #843: Custom http logging filter functionality Actions
Feature #870: luajit: global vars Actions
Feature #880: memcap http parser Actions
Feature #902: VLAN host table support Actions
Feature #933: add a IPv6 ( RFC2460 recommended order of EH )rule to decoder events rules Actions
Feature #936: support tzsp protocol Actions
Feature #960: persistent TCP resets Actions
Feature #1002: Possible to disabling/bypassing a rule by a specific source ip and a destination ip? Actions
Feature #1015: add chained content info to rule analysis Actions
Feature #1025: seperate #ifdef UNITTEST code into their own files Actions
Feature #1065: Introduce vlan id keyword Actions
Feature #1095: Integration of support for STIX-based indicators Actions
Feature #1132: set rpath for libs not in the default linker paths Actions
Feature #1140: IP-Address white list implementation for IPS mode (without disable a rule global) Actions
Feature #1191: EVE log does not support customformat Actions
Feature #1194: Implement http_args keyword to match http arguments - query string or body Actions
Feature #1215: journald logging support Actions
Feature #1234: nfqueue: use mnl API Actions
Feature #1239: Best effort TCP stack Actions
Feature #1245: Add "drop-only" and "alert-only" option for pcap-log Actions
Feature #1250: protocol: Multipath TCP (mptcp) Actions
Feature #1290: handle SIGHUP signal Actions
Feature #1300: profiling: per flow recording of profiling data Actions
Feature #1323: automated eve.json rotation Actions
Feature #1348: OOBE -6- increasing max-pending-packets default value Actions
Feature #1380: JSON and Unified2 output "payload" does not contain full (or real in the case of Unified2) packets for session Actions
Feature #1389: suppress by host Actions
Feature #1469: Use ISO 8601 date/time formats Actions
Feature #1489: Log a message when memcap limit is reached Actions
Feature #1504: lua: better notification in verbose mode on script errors Actions
Feature #1505: lua: show lua scripts during rule (re)loading Actions
Feature #1541: multi-detect - vlan range mapping Actions
Feature #1566: ICMPv4 control channel detection Actions
Feature #1571: Socket permissions setting in suricata.yaml Actions
Feature #1590: lua: force file magic and md5 lookup from script Actions
Feature #1608: Add option to disable JSON escape slash Actions
Feature #1662: Disable action / rule ordering option Actions
Feature #1710: Unix socket: Send output to unix socket Actions
Feature #1712: multitenancy: 'lite' tenants Actions
Feature #1741: flow: use capture methods flow hash Actions
Feature #1750: Set Suricata to listen to all network interfaces when using AF_PACKET Actions
Feature #1752: Netmap for Windows Actions
Feature #1766: TLS keyword expansion Actions
Feature #1767: Support DTLS protocol Actions
Feature #1783: Create Suricata buffers to expose L2, L3, and L4 headers to Lua scripts Actions
Feature #1794: test suricata rules over unix-socket Actions
Feature #1799: netmap: capture drop stats Actions
Feature #1872: add --list-decoder-protos or similar Actions
Feature #1899: Detecting Malicious TCP Network Flows Based on Benford’s Law Actions
Feature #1939: Introduce packet/byte counter in stats.log/json for local bypass Actions
Feature #1950: allow configuration of file-store types Actions
Feature #1954: runtime option/flag to disable hardware timestamp support Actions
Feature #1956: Add option to re-initialise Lua output scripts Actions
Feature #1977: get the os info from TCP HTTP fingerprint Actions
Feature #1979: TCP/IP packets normalization/scrubbing Actions
Feature #1995: fast.log should show if packet has been dropped or rejected Actions
Feature #2021: doc: sha256 filesum extraction missing in documentation Actions
Feature #2055: Optionally logging on files.json - Not log every file, only certain files that are stored and extracted Actions
Feature #2092: Improved support for xbits/hostbits - workers runmode Actions
Feature #2107: eve: rotate log output based on size Actions
Feature #2115: Changing interfaces Actions
Feature #2145: Relate directly flowid with certificate file Actions
Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED Actions
Feature #2166: output: log only triggering buffers Actions
Feature #2174: Need a special keyword and functionality for ip address extraction from a content (html body for ex.) and comparing it to src,dst_ip/EXTERNAL,HOME_NET Actions
Feature #2198: Extend the DNS parser to accept dns_response keyword in signatures Actions
Feature #2213: file matching: allow generic file matching / store Actions
Feature #2227: more detailed output about number of threads created Actions
Feature #2232: Allow Large value in suricata.yaml file Actions
Feature #2233: Allow log for payload and packet only for defined sid Actions
Feature #2262: Unix Socket Output Configurable Retries and Blocking Actions
Feature #2269: TLS: tls.version: allow negation or comparison Actions
Feature #2273: engine analysis: enable analysis by default during startup Actions
Feature #2277: netinfo: structured information about the network. Output hierarchical network tree in events Actions
Feature #2280: http: rules that match both request and response Actions
Feature #2281: tcp stream: simpler IDS handling of overlap evasions Actions
Feature #2291: traffic-id: ruleset for traffic classification and bypass Actions
Feature #2301: netflow: dump records at interval Actions
Feature #2308: threshold/suppress by http_host Actions
Feature #2310: lua: expose xbits Actions
Feature #2316: global memcap Actions
Feature #2342: Write PCAP files directly to Unix Socket Actions
Feature #2343: Add "flush" command to unix socket Actions
Feature #2371: list all available /exposed fields to lua Actions
Feature #2380: [discussion] deprecate: 'alert syslog' output Actions
Feature #2409: Push signatures without reloading the entire set. Actions
Feature #2410: Create a reset counter and track maximum number of parallel flows Actions
Feature #2426: tls: extend logging Actions
Feature #2487: Buffers for field/value pairs in http_uri and http_client_body Actions
Feature #2488: HTML Parsing / Buffers Actions
Feature #2513: Suricata read the SSLProxy header Actions
Feature #2519: XFF iprep support Actions
Feature #2538: dsize keyword improvements Actions
Feature #2569: multi-tenancy: allow mapping to 'device pair' in IPS mode Actions
Feature #2613: stats: add xdp counters to stats Actions
Feature #2628: Specify the flow direction in metadata sent by Suricata. Actions
Feature #2648: store captured data into file Actions
Feature #2661: output the http-body-data to eve.json Actions
Feature #2672: Split out DHCP parser to be reusable Actions
Feature #2673: Split out DNS parser to be reusable Actions
Feature #2674: Split out NFS parser to be reusable Actions
Feature #2675: Split out SMB parser to be reusable Actions
Feature #2681: Reloading of categories file, IP reputation list during rule live reload Actions
Feature #2700: ja3/ja3s functionality for IKEv2 Actions
Feature #2701: flow: counter for allocations at runtime Actions
Feature #2713: protocol detection w/o protocol parsing Actions
Feature #2727: DCERPC UID to name mapping Actions
Feature #2746: Use Available Instruction Set Specialization (AVX2 and AVX512) in Hyperscan when available Actions
Feature #2755: vendor id / vid keyword to give rulesets unique sid ranges Actions
Feature #2756: rules: input in json format Actions
Feature #2759: iprep: more granularity Actions
Feature #2764: dns logging v1 vs v2 Actions
Feature #2767: Interception of network stack attacks Actions
Feature #2771: MPLS over Vlan support Actions
Feature #2772: Add MPLS labels to alert output Actions
Feature #2818: Napatech Bypass support Actions
Feature #2860: Suricata doesn't detect part of IKEv2 traffic Actions
Feature #2871: lua: Exposing byte extract to script Actions
Feature #2925: Support for SPB encapsulation Actions
Feature #2931: Perform privdrop without libcap-ng support Actions
Feature #2932: add batman-adv decode support Actions
Feature #2935: Support for multiple-logger for drop eve-log Actions
Feature #2939: Suricata enhancements - proposals Actions
Feature #2957: Suricata x Moloch - protocol detection. Proposals for TLS/SSL Actions
Feature #2962: eve: log more IKEv2 fields Actions
Feature #2987: Suggestions for new keywords (streambits) Actions
Feature #2996: Extend decode events and rules Actions
Feature #3042: stats: allow per second stats updates Actions
Feature #3105: Add kafka output Actions
Feature #3212: Prevent duplicate pcaps from being re-processed Actions
Feature #3243: POP3 Support Actions
Feature #3244: IMAP Support Actions
Feature #3245: Email extraction to separate folder Actions
Feature #3246: Logging of Email body Actions
Feature #3260: SMTP Base64 Decoding of Message Body Actions
Feature #3261: SMTP quoted-printable Decoding of Message Body Actions
Feature #3271: Add keyword to determine flow based speed/bw Actions
Feature #3290: use config vars everywhere Actions
Feature #3295: Unix socket: support to receive flow shunting information Actions
Feature #3296: Include in the fileinfo if it was a duplicate Actions
Feature #3298: Create a config flag in the DNS logger to limit events to only the ones in the custom field Actions
Feature #3310: ease suricata configuration with xdp Actions
Feature #3311: Add better default suricata configuration for different traffic sizes and cpu/system architectures Actions
Feature #3316: Unix socket: support dumping flow table Actions
Feature #3317: rules: use rust for tokenizing rules Actions
Feature #3319: on 'wrong thread' reinject packets to correct thread Actions
Feature #3321: Evaluate different encoders for eve-log Actions
Feature #3333: Research: Unwind panic's from Rust modules Actions
Feature #3338: vxlan: log vni in eve Actions
Feature #3373: add init service file example script for Debian/Ubuntu Actions
Feature #3383: nflog: use mnl api Actions
Feature #3439: bpf-filter does not accept path/file Actions
Feature #3454: Add support to communicate with other networking products Actions
Feature #3494: rules: Keyword for determining if the http_host is an ip address Actions
Feature #3503: decoders: handle trailing data Actions
Feature #3548: Support GTP(GPRS Tunnelling Protocol). Actions
Feature #3629: Publish the Suricata support Python libraries to PyPI (make pip installable) Actions
Feature #3663: DNS: Parse and extract DNS NULL records Actions
Feature #3675: Testimony support Actions
Feature #3688: Re-implement fast_pattern:only; in some way Actions
Feature #3845: Threshold Hit Counter (for SID/IP) Actions
Feature #3848: Keep a Reference to Matched Items in Suricata Datasets for Rule-Writing Actions
Feature #3849: Extend Suricata Datasets to Datamaps with Keys and Values Actions
Feature #3875: Support multiple XFF Actions
Feature #3894: Option "ttl" exclusive range behavior is non-intuitive Actions
Feature #3950: Suricata bash completion Actions
Feature #3953: 8021BR E packet decoder Actions
Feature #3954: Optimize handling of encapsulation in cloud deployment Actions
Feature #3959: Python tool to take ip rules and convert into iprep rule(s) Actions
Feature #3960: Python tool to simulate GAP testing Actions
Feature #4070: capture plugins: receive notification when suricata is done with a packet Actions
Feature #4093: Extend stats log to print packet and byte rate on protocols Actions
Feature #4123: Research: handle different flow tuples in TLS decrypt Actions
Feature #4138: A stable flow ID for dump/restore of state as well as state synchronization Actions
Feature #4147: Map rules to MITRE ATT&CK Actions
Feature #4148: Research: SSH Support for additional protocol analysis Actions
Feature #4149: Research: Dynamic datasets Actions
Feature #4150: Profiling mode: Ticks used to generate an alert available? Actions
Feature #4159: Log flow age as fractional value Actions
Feature #4162: rules: entropy transform keyword Actions
Feature #4172: Split eve.json into multiple files based on alert severity Actions
Feature #4175: dcerpc: higher level logging Actions
Feature #4179: tunnel-Node for flow, netflow and dns-events in eve.json Actions
Feature #4213: smb: higher level logging Actions
Feature #4217: not complete cmd start line does not produce expliccit enough warning or msg Actions
Feature #4227: breakout components of tls.cert_subject and tls.cert_issuer into additional "sub" buffers Actions
Feature #4242: config: support predefined default configuration profiles Actions
Feature #4249: SS7 Protocol Support Actions
Feature #4250: Diameter Protocol Support Actions
Feature #4270: load rules from database Actions
Feature #4279: Optionally allow hashing truncated files, and a maximum length to hash Actions
Feature #4321: http2: Support link between packets in the same stream Actions
Feature #4325: xdp compile warnings on 5.4 kernels Actions
Feature #4333: Include the ‘short name’ from classification.config in the all-eve.log Actions
Feature #4381: flowbits: warn if flowbit dependencies don't follow suricata inspection order Actions
Feature #4398: support regex match and flowvars as keywords value Actions
Feature #4408: definitive log count mode for qa purposes Actions
Feature #4547: pcrexform not support tcp and other protocol Actions
Feature #4559: Tags for rules that enables mapping to Mitre Att&ck Actions
Feature #4573: add IPS drop total to eve log output Actions
Feature #4617: Add ThreatFox (by Abuse.ch) to suricata ruleset index Actions
Feature #4649: Autonomous System Number (ASN) support similar to GeoIP Actions
Feature #4758: dns: weird query should have app-layer-event? Actions
Feature #4770: eve: specialized output for ML on packet sizes and similar properties Actions
Feature #4774: rules: analysis output that shows rules per 'progress' value Actions
Feature #4775: lua: overhaul lua support Actions
Feature #4781: config: add command to dump built-in config defaults Actions
Feature #4782: config: add command to dump all active settings Actions
Feature #4840: stats: distinguish between observational stats and performance stats Actions
Feature #4951: decode: datalink type 276 not yet supported Actions
Feature #4965: Suricata should detect application layer protocol underneath SOCKS Actions
Feature #4976: frames: implement/complete profiling support Actions
Feature #4982: frames: selective frame logging Actions
Feature #4985: quic: support frames Actions
Feature #4988: frames: logging improvements Actions
Feature #4989: eve/alert: make frame logging configurable Actions
Feature #5014: Enable suricatasc to use configured command socket by default Actions
Feature #5044: rules: keyword for "count" of http_header_names Actions
Feature #5051: output/frames: allow tx logging to reference frames Actions
Feature #5067: smb/dcerpc: Match dcerpc (over smb) requests before bind_ack Actions
Feature #5069: smb: keyword for matching smb command Actions
Feature #5128: Light weight packet profiling Actions
Feature #5152: Anomaly: CredSSP support addition to Suricata anomaly parsing Actions
Feature #5206: Buffer Dump Utility Actions
Feature #5209: Add "status" mode to Suricata's socket command interface Actions
Feature #5245: allow fast_pattern on base64_data strings Actions
Feature #5247: Applayer Detect protocol only one direction : RTSP protocol Actions
Feature #5365: Limit rust 'filetracker' memory in configuration Actions
Feature #5372: Add support for encrypted traffic analysis Actions
Feature #5405: Make suricata point to where to report a bug Actions
Feature #5440: multiple stats EVE logs with different intervals Actions
Feature #5450: Rule keyword for non midstream flows Actions
Feature #5461: eve: Use threaded output by default Actions
Feature #5469: rules: expose per flow stream.midstream setting to the rule language Actions
Feature #5470: reject: allow reject dev to be specified in the yaml Actions
Feature #5499: PCAP-over-IP client Actions
Feature #5618: setup-app-layer: add option to choose TCP/UDP protocol Actions
Feature #5639: Allow dataset to match on extracted domain Actions
Feature #5641: dns: frame based keywords for "raw" fields in requests and responses Actions
Feature #5648: flowworker: heuristic to see how busy a thread is with elephant flows Actions
Feature #5649: eve.flow: add thread id(s) processing a flow to the record Actions
Feature #5650: unix socket: query threads about most recent elephant flows Actions
Feature #5655: host: make memuse and memcap reached counters for host table Actions
Feature #5657: byte_test: allow comparison with static value Actions
Feature #5668: eve: optionally add rule fast_pattern Actions
Feature #5670: Support wide strings somehow Actions
Feature #5673: capture: option to decapsulate everything first Actions
Feature #5674: Support layered protocols Actions
Feature #5675: protocol: MMS SCADA support Actions
Feature #5676: ASN1 Spec to Rust nom generator Actions
Feature #5677: protocol: BGP support Actions
Feature #5681: datasets: add more transform layers to match on domains Actions
Feature #5687: eve: "auth" and/or "auth_fail" log Actions
Feature #5705: Add Wireguard parser Actions
Feature #5716: rdp: add app-layer frame support Actions
Feature #5727: krb: add frame support Actions
Feature #5728: modbus: add frame support Actions
Feature #5729: bittorrent-dht: add frame support Actions
Feature #5730: dhcp: add frame support Actions
Feature #5732: ntp: add frame support Actions
Feature #5733: snmp: add frame support Actions
Feature #5737: smtp body extract Actions
Feature #5745: exceptions: allow setting via unix-socket Actions
Feature #5752: Proposed new DNP3 keywords and operators Actions
Feature #5764: logging: add a format string for a more standard log format Actions
Feature #5774: Addressing Mixed Case in HTTP Headers Names and HTTP2 Actions
Feature #5776: PCRE fast_patterns via hyperscan Actions
Feature #5798: New transformation: dropbytes Actions
Feature #5872: file structure awareness - precise identification of fields in file structs Actions
Feature #5894: file: file classification keyword Actions
Feature #5913: rfb: add more record types Actions
Feature #5956: Report traffic with missing VLAN tag Actions
Feature #6004: Add retry option to redis outputs using a socket instead of IP Actions
Feature #6012: dpdk: add support for segmented mbufs Actions
Feature #6051: app-layer: dhcpv6 support Actions
Feature #6067: Add field to track SID of Flowbit Matches Actions
Feature #6091: eve/alert: missing dhcp metadata Actions
Feature #6101: icap: app-layer protocol support Actions
Feature #6102: Translate NAT64 ranges (also custom ranges) Actions
Feature #6167: Stream retransmissions stats counters Actions
Feature #6198: Feature Request: Add "SMTP" keywords for use in rules Actions
Feature #6200: output: suricata.yaml dump-all-headers applied for alerts Actions
Feature #6206: Investigate a more intuitive use of the timestamp field in traffic/metadata events Actions
Feature #6214: mirror ruleset reload commands for tenants in suricata socket control Actions
Feature #6216: http: HHHash support Actions
Feature #6251: AF-XDP ability to bind custom program Actions
Feature #6268: Recognize related ICMP request/response pairs Actions
Feature #6295: output: add stream-size to flow output Actions
Feature #6296: smtp: BDAT chunking support incl MIME parsing Actions
Feature #6409: Lua support for HTTP/2 Actions
Feature #6410: Log packets/bytes per second in Suricata stats Actions
Feature #6453: Support DNS over TLS Actions
Feature #6456: output: binary logging Actions
Feature #6457: eve: configurable list of fields in output Actions
Feature #6461: ics protocol: bacnet Actions
Feature #6462: IEC104 Protocol Support Actions
Feature #6464: protocol: profibus Actions
Feature #6465: multi-tenant: support vxlan as a selector Actions
Feature #6466: multi-tenant: support mpls as a selector Actions
Feature #6467: flow tracking: add other parameters to flow tracking Actions
Feature #6468: flow-tracking: add geneve as a flow tracking parameter Actions
Feature #6469: flow-tracking: add erspan as a flow tracking parameter Actions
Feature #6470: flow-tracking: add vxlan as a flow tracking parameter Actions
Feature #6471: flow-tracking: add mpls as a tracking parameter Actions
Feature #6482: Deployment: detect if capture is good enough Actions
Feature #6625: Apply netflow per network Actions
Feature #6649: Add a keyword to match on raw data within headers especially for protocols without a dedicated parser Actions
Feature #6650: dns: support extended response/error codes Actions
Feature #6651: quic: detect on non-standard ports Actions
Feature #6683: stats: add packet time elapsed indicator Actions
Feature #6693: byte_jump - add support for bitmask option Actions
Feature #6695: tls: log extensions Actions
Feature #6701: Auto-bypass optimization Actions
Feature #6794: Tie signature to live device in IPS mode Actions
Feature #6802: Support Domain rollup using existing dataset library Actions
Feature #6803: Add Support for Dataset Metadata Actions
Feature #6807: Support the use of variables within transforms Actions
Feature #6808: Quantify how a Suricata rule matches against a PCAP Actions
Feature #6823: SC_WARN_POOR_RULE on to_lowercase/to_uppercase transformation with non-possible matching content Actions
Feature #6831: support extraction of bytes of non-numeric values Actions
Feature #6853: Support of variables from byte_math / byte_extract in bsize / dsize comparisons Actions
Feature #6885: references: new "wayback" reference and update others Actions
Feature #6914: support inspecting http.uri or http.request_body Actions
Feature #6916: decoding : add support of IEEE 802.2, 802.3 frames Actions
Feature #6922: Have a way to manually request decompression/inflate if headers are not present Actions
Feature #6925: multi-buffer support for HTTP cookies Actions
Feature #6926: new buffer that includes HTTP headers and the start of HTTP body Actions
Feature #6993: rule macros for commonly used logic in rules Actions
Feature #6995: raw option for http.request/response_header Actions
Feature #7012: Add dns.response sticky buffer Actions
Feature #7052: Add facility to move data from code into data files Actions
Feature #7056: version info not reported in stats json Actions
Feature #7057: monitored interface information in stats json Actions
Feature #7062: redis: support authenticating against a redis server Actions
Feature #7082: redis: support EVE output to a Redis stream Actions
Feature #7095: rdp: keywords additions Actions
Feature #7096: detect/flow: additions to time detection Actions
Feature #7097: Additions to flow detection - size Actions
Feature #7099: Addition of total bytes to the flow logs Actions
Feature #7100: smb: additional keywords Actions
Feature #7101: eve: add number of flowbits in protocol records and alerts Actions
Feature #7103: ssh: extra fields and keywords Actions
Feature #7114: from_base64: allow matching on decode error Actions
Feature #7127: extended http.referer buffers/keywords Actions
Feature #7129: decode: Create a decode event for unknown ethertypes Actions
Feature #7132: threshold: add thresholding options for all decode events Actions
Feature #7146: decode: Create a decode event for unknown IP types Actions
Feature #7175: Response module API Actions
Feature #7177: http1: add frame support Actions
Feature #7211: detect/integers: support a count argument for array of integers Actions
Feature #7221: Sanity checking on IP network prefix base addresses Actions
Feature #7231: ndpi: augment flows/alerts with ndpi metadata and extend signature keywords Actions
Feature #7245: Add SIMD support for arm64 Actions
Feature #7283: installing suricatasc functionality without installing suricata entirely Actions
Feature #7313: transforms: have option on how to handle failure Actions
Feature #7321: cross buffer byte_* keyword support Actions
Feature #7322: ability to negate the existence of fields via buffer negation Actions
Feature #7328: detect: use hyper scan streaming mode Actions
Feature #7354: detect: reimplement ip-only as a per group prefilter Actions
Support #2998: Rules Reload doesn't work properly Actions
Support #3037: The rules detect order Actions
Optimization #536: share ctx for filemd5 keyword if identical files are used Actions
Optimization #548: Use bloomfilter for filemd5 Actions
Optimization #551: Replace SCLogError by a counter for memory issue and other memcap Actions
Optimization #569: display syntax requirement on keyword parsing error Actions
Optimization #573: reduce allocs in signature parsing Actions
Optimization #614: Rate limiting messages Actions
Optimization #721: full nfq zero copy mode Actions
Optimization #795: stream: use pool instead of direct SACK record allocs Actions
Optimization #808: Support the new GSO-avoidance NFQ feature Actions
Optimization #923: memcap value in suricata.yaml : erroring if config value is bigger than what is available Actions
Optimization #945: remove useless includes Actions
Optimization #1046: replace pcre_get_substring with pcre_copy_substring Actions
Optimization #1094: Special check for first character of buffer Actions
Optimization #1188: Don't use iface name in GetIfaceMaxHWHeaderLength Actions
Optimization #1222: Boyer Moore content not shared between same content Actions
Optimization #1313: All Free functions should correctly handle NULL pointers Actions
Optimization #1595: Suricata starts in known conditions of no data Actions
Optimization #1718: Time stamp in Log files should be ISO 8601 format Actions
Optimization #1749: Log PACKET_DROP in inline mode for invalid states as well Actions
Optimization #2317: rcu Actions
Optimization #2321: yaml: clean up usage of lists Actions
Optimization #2460: Reduce timeout in unix-socket when multiple pcaps are enqueued Actions
Optimization #2582: document flags keyword Actions
Optimization #2584: document tag keyword Actions
Optimization #2586: document flowvar keyword Actions
Optimization #2587: document pktvar keyword Actions
Optimization #2590: document nfq_set_mark keyword Actions
Optimization #2593: document pkt_data keyword Actions
Optimization #2594: document dce keywords Actions
Optimization #2595: document asn1 keyword Actions
Optimization #2596: document engine-event keyword Actions
Optimization #2597: document stream-event keyword Actions
Optimization #2598: document l3_proto keyword Actions
Optimization #2599: document base64 keywords Actions
Optimization #2687: current suricata.yaml is missing rotate-interval "example" Actions
Optimization #2725: stream/packet on wrong thread Actions
Optimization #2750: document nfs-keywords Actions
Optimization #2780: Convert DNP3 from C to Rust Actions
Optimization #2781: Convert ENIP from C to Rust Actions
Optimization #2979: replace mime decoder with rust based implementation Actions
Optimization #3127: Unable to set XDP on 'ens2f0': Invalid argument (-22) - Mellanox cards and Intel cards with jumbo frames Actions
Optimization #3206: improve int handling Actions
Optimization #3213: improve rule parsing warnings Actions
Optimization #3304: generic way to register buffers for logging and detection Actions
Optimization #3305: Tracking ticket: which parts of the engine should be dynamic Actions
Optimization #3314: rust: integrate log crate with suricata logging Actions
Optimization #3322: Use standard CRC32 for hash-like functions Actions
Optimization #3337: Python is assumed to be installed in the same --prefix as suricata Actions
Optimization #3544: Have small signature match context without allocation Actions
Optimization #3734: af-packet: better support for csum offload Actions
Optimization #3797: Filestore Setup Excess Directory Slash Actions
Optimization #3829: pcap source: Counters, counters and... counters Actions
Optimization #3830: pcap source: PcapThreadVars and cache lines Actions
Optimization #4234: Filemagic logging puts big pressure on performance Actions
Optimization #4318: app-layer: "close" all txs if protocol reaches error state Actions
Optimization #4651: malloc / memory handling improvement Actions
Optimization #4798: af-packet: default to tpacket-v3 in IDS mode Actions
Optimization #4802: af-packet: remove IPS support for tpacket-v3 Actions
Optimization #4806: af-packet: remove autofp support Actions
Optimization #4809: stats: human readable sizes in the stats.log Actions
Optimization #4813: stream: reset stream-depth if parser reaches error state Actions
Optimization #5083: Proposal: new and compact rule parser for Suricata in Rust Actions
Optimization #5089: unifiy address range parsing Actions
Optimization #5434: app-layer: fix AppLayerParserGetTx (and friends) param confusion posibilities Actions
Optimization #5453: af-packet ips: floods packets that should be learned Actions
Optimization #5522: decode: optional optimized tunnel packet handling Actions
Optimization #5545: prefilter keyword: increase code coverage Actions
Optimization #5583: output: iface shortening more compact Actions
Optimization #5643: pcap: rule based conditional pcap logging Actions
Optimization #5671: Better way to decide on flows memcap and timeouts Actions
Optimization #5679: tracking: useful log output Actions
Optimization #5680: eve-log: reduce duplication of info Actions
Optimization #5755: datasets: ipv4.src/dst, ip.src/dst check rules should be ip-only Actions
Optimization #5785: smb: use u32.to_be_bytes to replace function u32_as_bytes Actions
Optimization #5801: filemagic keywords: increase code coverage and update documentation (if need be) Actions
Optimization #5865: Remove dual tracking mechanisms in output loggers Actions
Optimization #5902: detect: "alert dcerpc" sig sets up smb inspect engines Actions
Optimization #6011: Research potential performance penalty with filestore feature Actions
Optimization #6065: warning _FORTIFY_SOURCE requires compiling with optimization Actions
Optimization #6126: compiling with outdated cbindgen does not have a corresponding err msg Actions
Optimization #6160: filestore: decide on the impact of eve output over the global filestore settings Actions
Optimization #6190: flow_spare_pool_block_size is a constant defined as a variable Actions
Optimization #6221: build: check for compiler warnings/messages Actions
Optimization #6246: initialization: do config validation before runtime Actions
Optimization #6264: mpm/ac-ks: reduce stack usage Actions
Optimization #6277: Attach XDP filter with libxdp Actions
Optimization #6375: detect: merge urilen and bsize implementations Actions
Optimization #6583: rust: get rid of unused final zeroes in protocol detection patterns Actions
Optimization #6632: Do not have any warning with -Wsign-conversion Actions
Optimization #6720: flow: explore how red black trees compare to linked list in hash buckets Actions
Optimization #6721: hash tables: explore how red black trees compare to linked list in hash buckets Actions
Optimization #6730: threading: warn if cpu affinity assigns more than one thread to a core Actions
Optimization #6747: dpdk: synchronized CPU stalls on Suricata workers Actions
Optimization #6786: util-rohash.c : make code cleaner to make CodeQL happier Actions
Optimization #6855: src: var code cleanups Actions
Optimization #6928: source-netmap: improve netmap receive loop packet processing performance Actions
Optimization #7083: detect/dataset: skip adding localstatedir if fullpath is provided Actions
Optimization #7089: rust transaction iterator runs a useless iteration of the loop Actions
Optimization #7163: unix-socket: refuse to startup if compiled w/o --enable-unixsocket Actions
Optimization #7189: http/conf: warn or error on invalid value in custom headers logging Actions
Optimization #7205: detect: prefilter for app-layer events Actions
Optimization #7278: Merge detect-template.c and detect-template2.c to have a unique template with all features Actions
Optimization #7304: Better support multi-protocol keywords Actions
Optimization #7317: HTTP2 push Actions
Optimization #7342: applayer/htp: convert complex unittests to SV ones Actions
Optimization #7352: Remove disable-hashing command line option Actions
Optimization #7358: CI: only run CodeQL python if the PR contains changed files that are python Actions
Task #570: tracking: memory fragmentation Actions
Task #2167: tracking: eve enhancements Actions
Task #2278: tracking: failing better Actions
Task #2313: tracking: save & restore state when suricata restarts Actions
Task #2685: SuriCon 2018 brainstorm Actions
Task #2757: improve protocol detection Actions
Task #2778: tracking: port app-layer parsers to Rust Actions
Task #2975: convert unittests to new FAIL/PASS API Actions
Task #3016: No documentation for "endswith" keyword Actions
Task #3195: tracking: rustify all input Actions
Task #3288: Suricon 2019 brainstorm Actions
Task #3291: collect common mistakes rulewriters might run into Actions
Task #3294: Test the maximum size for messages passed to the unix socket Actions
Task #3299: tracking: Add support for industrial protocol Actions
Task #3300: tracking: Add support for medical protocols Actions
Task #3301: Research: Failover support within the current IPS implementation Actions
Task #3302: Research: ruleset optimizations Actions
Task #3307: Research: evaluate future of lua support in Suricata Actions
Task #3318: Research: NUMA awareness Actions
Task #3329: Research: WASM as a Lua alternative and for dynamically loadable modules Actions
Task #3392: Tracking: protocol detection evasions Actions
Task #3553: Tracking: enable GAP recovery for all TCP app-layer protocols Actions
Task #3554: modbus: support GAP recovery Actions
Task #3555: DNP3: support GAP recovery Actions
Task #3556: dns: improve GAP recovery Actions
Task #3557: ftp: support GAP recovery Actions
Task #3558: smtp: support GAP recovery Actions
Task #3560: ssl/tls: support GAP recovery Actions
Task #3561: krb5: support GAP recovery Actions
Task #3562: rdp: support GAP recovery Actions
Task #3563: rfb: support GAP recovery Actions
Task #3768: research: investigate branch prediction vs likely/unlikely macros Actions
Task #3803: Research: use nom-derive Actions
Task #3828: pfring support: remove in favor of (externally maintained) plugin Actions
Task #3837: Investigate clang-tidy usage to enforce coding standards Actions
Task #3852: Ability to build with sanitizers Actions
Task #4022: Convert unittests to new FAIL/PASS API - detect-engine-address-ipv4.c Actions
Task #4023: Convert unittests to new FAIL/PASS API: detect-engine-address-ipv6.c Actions
Task #4095: tracking: unify rule keyword value parsing Actions
Task #4097: Suricon 2020 brainstorm Actions
Task #4101: tracking: plugins Actions
Task #4146: Research: Hand off packet streams on alerts Actions
Task #4151: Research: New protocol support Actions
Task #4251: protocol: SCTP support Actions
Task #4252: SCTP: session tracking Actions
Task #4380: tracking: improvements to bits, ints, vars Actions
Task #4431: libsuricata: Example showing libsuricata as a replacement for libnids (network grep) Actions
Task #4432: libsuricata: Wireshark plugin as an example Actions
Task #4589: threading: debug validate mutexes with PTHREAD_MUTEX_ERRORCHECK Actions
Task #4682: tracking: clean up globals and thread locals Actions
Task #4684: libsuricata: define global context types for instance and per thread storage Actions
Task #4714: Improve unittests coverage for Suricata's application layers rust nom parsers Actions
Task #4735: tracking: ubsan clean Actions
Task #4762: Suricon 2021 brainstorm Actions
Task #4763: tracking: Suricon brainstorms Actions
Task #4772: tracking: parity between fields logged and fields available for detection Actions
Task #4780: tracking config: configuration usability improvements Actions
Task #4841: tracking: research evasions wrt malformed IP and TCP options Actions
Task #4865: rust/smb/*: add unit tests Actions
Task #4867: rust/src/ike/*: add unit tests Actions
Task #4868: rust/src/krb/*: add unit tests Actions
Task #4869: rust/src/snmp/*: add unit tests Actions
Task #4871: tracking: implement frames for all parsers Actions
Task #4911: tracking: detect: cleanup tests Actions
Task #5052: unittest: create test for checking all app_proto registrations Actions
Task #5074: rules: structured rule input Actions
Task #5195: tracking: give more insight into detection pipeline Actions
Task #5256: rust: see if we can reduce number of crate deps Actions
Task #5257: ci: cargo audit job Actions
Task #5433: tracking: reduce number of public data structures Actions
Task #5460: eol: include EOL dates in a per branch file in the repo Actions
Task #5488: Suricon 2022 brainstorm Actions
Task #5593: tunnel: review locking logic Actions
Task #5611: tracking: counters: improve efficiency of stats tracking Actions
Task #5613: counters: reduce size of data structure Actions
Task #5614: counters: compress id space in a thread Actions
Task #5615: counters: avoid duplicate work Actions
Task #5645: tracking: elephant flow detection Actions
Task #5666: rules: help to visualize how a Suricata rule matches (different contents/offsets) Actions
Task #5678: tracking: Parse protocols that are not over TCP/UDP Actions
Task #5685: tracking: active directory protocols support Actions
Task #5892: config: remove requirement for suricata.yaml to start with %YAML 1.1 Actions
Task #5893: tracking: deep file awareness and inspection Actions
Task #6287: suricatasc: rewrite in rust Actions
Task #6310: detect/analyzer: add more details for the ttl keyword Actions
Task #6311: detect/analyzer: add more details for the flowint keyword Actions
Task #6314: Convert unittests to new FAIL/PASS API - tests/detect-http-client-body.c Actions
Task #6315: Convert unittests to new FAIL/PASS API - ippair-storage.c Actions
Task #6316: Convert unittests to new FAIL/PASS API - app-layer-detect-proto.c Actions
Task #6317: Convert unittests to new FAIL/PASS API - detect-filestore.c Actions
Task #6319: Convert unittests to new FAIL/PASS API - util-bloomfilter.c Actions
Task #6320: Convert unittests to new FAIL/PASS API - detect-base64-data.c Actions
Task #6321: Convert unittests to new FAIL/PASS API - decode-raw.c Actions
Task #6322: Convert unittests to new FAIL/PASS API - util-pool.c Actions
Task #6323: Convert unittests to new FAIL/PASS API - ippair-bit.c Actions
Task #6324: Convert unittests to new FAIL/PASS API - stream-tcp-reassemble.c Actions
Task #6325: Convert unittests to new FAIL/PASS API - detect-urilen.c Actions
Task #6326: Convert unittests to new FAIL/PASS API - detect-ssh-software-version.c Actions
Task #6327: Convert unittests to new FAIL/PASS API - threads.c Actions
Task #6330: Convert unittests to new FAIL/PASS API - tests/stream-tcp-list.c Actions
Task #6331: Convert unittests to new FAIL/PASS API - util-bloomfilter-counting.c Actions
Task #6333: Convert unittests to new FAIL/PASS API - util-rule-vars.c Actions
Task #6334: Convert unittests to new FAIL/PASS API - util-spm.c Actions
Task #6335: Convert unittests to new FAIL/PASS API - decode-tcp.c Actions
Task #6336: Convert unittests to new FAIL/PASS API - tests/detect-http-stat-code.c Actions
Task #6338: Convert unittests to new FAIL/PASS API - tests/detect-http-stat-msg.c Actions
Task #6340: Convert unittests to new FAIL/PASS API - tests/detect-http-method.c Actions
Task #6341: Convert unittests to new FAIL/PASS API - decode-ethernet.c Actions
Task #6343: Convert unittests to new FAIL/PASS API - tests/stream-tcp.c Actions
Task #6344: Convert unittests to new FAIL/PASS API - detect-pcre.c Actions
Task #6346: Convert unittests to new FAIL/PASS API - detect-engine-dcepayload.c Actions
Task #6350: detect/analyzer: add more details for the tcp.flags keyword Actions
Task #6351: detect/analyzer: add more details for the xbits keyword Actions
Task #6356: detect/analyzer: add more details for the tcp.hdr keyword Actions
Task #6357: detect/analyzer: add more details for the dsize keyword Actions
Task #6358: detect/analyzer: add more details for the ICMP itype keyword Actions
Task #6359: detect/analyzer: add more details for the ICMP icode keyword Actions
Task #6443: Suricon 2023 brainstorm Actions
Task #6447: readthedocs: CI integration Actions
Task #6463: eve/output: investigate how to track coverage / parity Actions
Task #6473: detect: smtp keyword coverage Actions
Task #6475: detect: smtp.subject keyword Actions
Task #6491: multi-tenant: add selectors Actions
Task #6644: tracking: detect: integer as first-class support Actions
Task #6705: build-info: remove obsolete "rust support" line Actions
Task #6752: libsuricata: don't include autoconf.h from other includes Actions
Task #6851: eve/syslog: stats message too long for many default configurations Actions
Task #6858: libsuricata: hook for flow expectation creation Actions
Task #7080: rust/core: rename and unify namestyling for internal fns Actions
Task #7118: tracking: add support for new protocols Actions
Task #7123: tracking: improve detection capabilities Actions
Task #7161: detect prefilter: decide to enable it by default for a subset of keywords Actions
Task #7336: Suricon 2024 brainstorm Actions
Task #7341: rust: use bindgen to generate Rust bindings to C functions Actions
Task #7350: firewall usecase: log app-layer metadata for for catch-all drop rules Actions
Documentation #595: document csum keywords Actions
Documentation #1233: Documentation for each keyword in stats.log file. Actions
Documentation #1691: Docs: Convert windows docs Actions
Documentation #1892: rule docs should include example rules Actions
Documentation #1974: DNP3: document lua support Actions
Documentation #2016: doc: improve keywords self documentation Actions
Documentation #2266: no documentation for file-store-waldo Actions
Documentation #2404: Windows Installation Guide for Suricata bug Actions
Documentation #2470: document content inspection in chunks Actions
Documentation #2585: document replace keyword Actions
Documentation #2588: document hostbits keyword Actions
Documentation #2589: document decode-event Actions
Documentation #2699: document all eve record types and fields Actions
Documentation #2976: review userguide from beginners point of view Actions
Documentation #3018: No documentation for "flowvar" keyword Actions
Documentation #3019: No documentation for "pktvar" keyword Actions
Documentation #3022: No documentation for "nfq_set_mark" keyword Actions
Documentation #3023: No documentation for "bsize" keyword Actions
Documentation #3025: Missing docs for "http." keywords Actions
Documentation #3027: No documentation for "nfs" keywords Actions
Documentation #3028: No documentation for "pkt_data" keyword Actions
Documentation #3031: No documentation for "asn1" keyword Actions
Documentation #3032: No documentation for "engine-event" keyword Actions
Documentation #3033: No documentation for "stream-event" keyword Actions
Documentation #3034: No documentation for "l3_proto" keyword Actions
Documentation #3035: No docs for "base64_" keywords Actions
Documentation #3036: No documentation for "template2" keyword Actions
Documentation #3046: Document each default value from the config file Actions
Documentation #3180: tracking: document all decoder and app-layer events Actions
Documentation #3181: document http engine events Actions
Documentation #3222: Configuring ipv6 Actions
Documentation #3268: Add links to additional information at the wiki to the userguide Actions
Documentation #3274: doc: some inconsistency between http docs keywords description Actions
Documentation #3303: Add a documentation about the used sid and gid ranges Actions
Documentation #3313: Document 40Gbps IPS set up Actions
Documentation #3748: Add documentation for flags keyword Actions
Documentation #3751: Alert metadata JSON configs in suricata.yaml.in should match the RTD documentation Actions
Documentation #3762: update documentation for user modes Actions
Documentation #4662: Add documentation section covering Suricata rule grammar Actions
Documentation #4706: Guide for rulewriting Actions
Documentation #4743: Improve Suricata code documentation (C files) Actions
Documentation #4768: DNS v2 EVE does not longer contain `dns.rdata` but it is still listed in the documentation Actions
Documentation #5030: Documentation bugs for endswith, distance, within Actions
Documentation #5068: nfs: document rule keyword Actions
Documentation #5182: userguide: better document rule keywords Actions
Documentation #5225: testing/fuzz: improve documentation on how to fuzz suricata Actions
Documentation #5267: Meaning of insert_list_fail counter Actions
Documentation #5359: userguide: improve documentation on (main) EVE fields Actions
Documentation #5367: byte_test: all examples in doc missing a required argument Actions
Documentation #5484: userguide: explain content modifiers usage with regards to position usage in the rule Actions
Documentation #5487: userguide: add explanation on how depth of inspection affects rules Actions
Documentation #5514: userguide: document exception policy from an extreme profiling and tuning perspective Actions
Documentation #5523: userguide: document the tcp-stream keyword Actions
Documentation #5537: devguide: add section/chapter about how [capture] bypassing works for Suricata Actions
Documentation #5591: devguide: bring section about OpenBSD Installation from git into devguide Actions
Documentation #5620: doc: add vectorscan instructions Actions
Documentation #5660: userguide: add (more) documentation for the GRE protocol Actions
Documentation #5662: Review/Update Hyperscan Documentation Actions
Documentation #5669: Better link together the bits keywords Actions
Documentation #5724: Why does reject-dev option work only in Sniff Mode Actions
Documentation #5772: docs: A wrong rule matching example provided by the official doc Actions
Documentation #5837: Unify documentation of command-line parameters Actions
Documentation #5841: tracker: bring documentation from old wiki on redmine to readthedocs guides Actions
Documentation #5842: userguide: bring session about Suricata installation from Ubuntu PPA Actions
Documentation #5995: userguide: ips upgrade guide Actions
Documentation #6059: docs: fix build failure - urllib3 issue Actions
Documentation #6071: eve/schema: add descriptions to the schema Actions
Documentation #6072: eve/schema: document smb Actions
Documentation #6073: eve/schema: document dns Actions
Documentation #6074: eve/schema: document nfs Actions
Documentation #6075: eve/schema: document http Actions
Documentation #6077: eve/schema: document sip Actions
Documentation #6096: eve/app-layer: generate example eve-log for each protocol Actions
Documentation #6097: eve/dhcp: generate example dhcp output Actions
Documentation #6098: eve/dns: generate example dns output Actions
Documentation #6133: tracking: security deployment documentation Actions
Documentation #6150: doc: improve the file-store documentation for the eve output and the dedicated section Actions
Documentation #6288: eve/schema: generate tables of data for app-layer protocols Actions
Documentation #6361: userguide: add note about severity<-> priority on alert section Actions
Documentation #6386: Add tls.cert_chain_len Documentation Actions
Documentation #6404: flow.reason value is misleading? Actions
Documentation #6406: userguide: remove ambiguous "we" usages Actions
Documentation #6478: schema: add missing fields Actions
Documentation #6548: http.stat_msg - note about HTTP/2 behavior Actions
Documentation #6694: placement of bitmask note about right shift behavior Actions
Documentation #6824: doc: Document every parameter of the configure script Actions
Documentation #6924: replicate http.cookie behavior from "Differences From Snort" to http.cookie Actions
Documentation #6982: offset: no documentation that offset can be a name Actions
Documentation #6991: add note about case sensitivity to flowbits docs Actions
Documentation #6992: Document normalization of header name/value separator Actions
Documentation #7143: Legacy keyword used in example for 'bypass' keyword Actions
Documentation #7145: userguide: update legacy keyword mentions to new ones Actions
Documentation #7190: detect/integers: document usage of units Actions
Documentation #7217: userguide: add config section on reading pcap-files Actions
Documentation #7220: guides: add a post on using 'ip' and 'tcpdump' to Suricata forum's Guides Actions
Documentation #7222: userguide: document decoder events Actions
Documentation #7223: document 'stream-event' keyword Actions
Documentation #7237: userguide: default's to latest development branch instead of latest release tag Actions
Documentation #7244: userguide: explain multi-tenant default config Actions
Documentation #7298: schema/netflow: add missing field Actions
Documentation #7299: eve/schema: document tls Actions
Documentation #7355: Non working signatures in filestore explanation Actions
Security #5851: rust: handle allocation failures Actions

Also available in: TXT