Simone Mainardi
88693f5f6a
Adds flow tcp seq issues (ooo, retx, lost) over ZMQ
2020-03-04 15:01:24 +01:00
Alfredo Cardigliano
ef16436576
Support for EXPORTER_IPV6_ADDRESS parsing and disaggregation
2020-02-28 18:47:46 +01:00
emanuele-f
15898e8dad
Flow dissection code cleanup.
...
The Flow API is now composed of the following methods:
- Flow::setDetectedProtocol to manually set a protocol on the flow
and terminate the dissection
- Flow::processPacket to run the nDPI dissection on the raw packets
- Flow::endProtocolDissection to terminate or give up the dissection
Also fixes the flow sampling rate preference, which was never used.
2020-02-17 17:36:06 +01:00
Luca Deri
3fcd016ace
ZMQ debug code
2020-02-04 22:58:06 +01:00
Simone Mainardi
b9a4534af6
Implements randomization of ips
2020-01-09 17:44:11 +01:00
Simone Mainardi
0ef0c27f66
Refines scan detection by not checking ECE or CWR
2020-01-09 14:55:57 +01:00
Simone Mainardi
8cb1db967a
Improvements to the probing traffic detection algorithm
2020-01-08 10:46:53 +01:00
Luca Deri
57e6a93065
Improved scheduling algorithm to guarantee minimum service time when number of entries allow
...
Updated (C)
2020-01-06 23:36:36 +01:00
Simone Mainardi
c17a962424
Avoids re-init of var
2020-01-02 19:25:37 +01:00
Simone Mainardi
417c4a3146
Reworks handling of TCP flags for both ZMQ and packet interfaces
...
This commit allows simplifies the code and also allows flags-based alerts
to be triggered for packet and non-packet interfaces
Fixes #3167
2020-01-02 19:21:44 +01:00
Simone Mainardi
b44de6e18d
Implements discarded probing traffic counters and timeseries
2019-12-31 16:01:24 +01:00
Simone Mainardi
750a1dd36d
Adds logic to detect udp probing flows
2019-12-31 12:16:48 +01:00
Simone Mainardi
1789543037
Improves logic to detect tcp probing flows
2019-12-31 11:12:19 +01:00
Simone Mainardi
b2c89117df
Implements logic to discard ZMQ probing flows
2019-12-31 10:44:59 +01:00
Simone Mainardi
fcbdd58a52
Implements custom protocols for ZMQ interfaces
2019-12-19 19:58:11 +01:00
Simone Mainardi
562ac1d0f8
Fixes custom categories detection and concurrency issues
2019-12-19 18:38:14 +01:00
Simone Mainardi
e0c247bfca
Implements tcp stats for view interfaces
2019-12-13 15:28:02 +01:00
Simone Mainardi
993fcc2fc3
Fixes interfaces TCP timeseries
...
Fixes #3077
2019-11-25 15:53:30 +01:00
Alfredo Cardigliano
e38835a603
Rename SSL to TLS ( fix #3013 )
2019-11-15 12:40:01 +01:00
Alfredo Cardigliano
d05777df1e
External alerts API update and cleanup
2019-10-22 15:08:06 +02:00
Alfredo Cardigliano
87ac1b0bb6
New Duplicate Disaggregated Traffic option to show disaggregated traffic in the master interface
2019-10-16 04:50:47 +02:00
Alfredo Cardigliano
3290bd803b
Propagating additional fields to companion interface
2019-10-15 16:41:42 +02:00
Simone Mainardi
167c40582a
Avoids multiple setDetectedProtocol calls for ZMQ flows
2019-10-11 11:25:57 +02:00
Luca
9870eee2e7
Revisited state hangling
2019-10-10 20:09:42 +02:00
Alfredo Cardigliano
a2e74e16a3
New Lua interface.processFlow API, moved processFlow from NetworkInterface to ParserInterface, code cleanup
2019-10-10 12:49:32 +02:00
Alfredo Cardigliano
f8af84df2d
SyslogParserInterface now supports the companion interface for delivering Suricata alerts to a packet interface ( #1928 )
2019-08-27 17:53:34 +02:00
Alfredo Cardigliano
dc9978c68d
Moved companion interface to ParserInterface to be used by any *ParserInterface
2019-08-27 16:24:46 +02:00
Simone Mainardi
ab92ee7926
Converts ZMQ PODs to classes
2019-05-10 19:32:34 +02:00
Simone Mainardi
2309e6df5e
Initial work to parse nProbe mini eBPF fields via ZMQ
2019-04-23 20:18:01 +02:00
Simone Mainardi
4ed935547e
Fixes memsets on Parsed_Flow members of type class
...
Fixes #2521
2019-04-09 16:17:07 +02:00
Alfredo Cardigliano
61a8ce9a76
Implemented SyslogCollectorInterface/SyslogParserInterface
...
Implemented TCP-based syslog collector (multi producer)
Initial Suricata EVE events parsing (basic flows)
Reworked ZMQ CollectorInterface/Parser interface hierarchy
2019-04-02 18:32:52 +02:00
Simone Mainardi
3fcb15cda2
Handles TCP flags via nProbe
2019-03-25 20:31:13 +01:00
Simone Mainardi
34b36422ad
Parses nProbe application latency
2019-03-25 17:34:54 +01:00
Simone Mainardi
d9d21462cd
Parses nProbe client/server network latencies
2019-03-25 16:55:14 +01:00
Simone Mainardi
1975d68e91
Handles backward ZMQ compat with new <PEN.FIELD> format
2019-02-18 12:01:37 +01:00
Simone Mainardi
c4fda59b0c
Adds INPUT_SNMP and OUTPUT_SNMP as default ZMQ fields
2019-02-12 15:17:10 +01:00
Simone Mainardi
b32368afd6
Overrides NPROBE_IPV4_ADDRESS with EXPORTER_IPV4_ADDRESS (when both are present)
2019-02-12 14:46:22 +01:00
Simone Mainardi
01bad09a88
Implements handling of PEN fields from nProbe
2019-02-11 18:14:13 +01:00
Simone Mainardi
19a4b03478
ParserInterface sprobe cleanup
2019-02-11 15:15:48 +01:00
Simone Mainardi
e5eff5b30f
Initial sprobe code cleanup
2019-02-11 14:22:36 +01:00
Simone Mainardi
7a1b2dc887
Parses nProbe options topic and handles custom applications
2019-02-07 16:11:11 +01:00
Simone Mainardi
300e6c4672
Parses new template ZMQ topic
2019-02-06 19:10:00 +01:00
Simone Mainardi
5317d23fc2
Disables ZMQ flow collection drop alerts (waiting to make them engaged)
...
Revert "Implements ZMQ flow collection drops alerts"
This reverts commit d21e8d6f3e
2019-01-24 15:02:22 +01:00
Simone Mainardi
d21e8d6f3e
Implements ZMQ flow collection drops alerts
2019-01-23 19:42:18 +01:00
Simone Mainardi
a11257482b
Removes a debug trace
2019-01-23 16:19:08 +01:00
Simone Mainardi
fa3d346f58
Adds historical charts of flow collection drops
2019-01-23 16:16:55 +01:00
Simone Mainardi
16cd644f4f
Adds flow collection drops to the GUI when present
2019-01-23 15:40:31 +01:00
Simone Mainardi
3819af0037
Honours --ignore-vlans in collector mode
2019-01-18 10:29:03 +01:00
Luca Deri
bedff2c8e2
Updated (C)
2019-01-07 19:28:49 +01:00
Simone Mainardi
d69237c0cd
Initial work to add support to custom fields via ZMQ
2018-12-31 18:11:18 +01:00
