Allen Ma's Blog

Logger is the output part of Suricata, which outputs various valuable analysis results to the outside of Suricata. Firstly, let’s begin with the usage of it. 1.Usage OutputLoggerLog() in FlowWorker():...

1.FlowHandlePacketUpdate Assume the first packet is in to-server direction. 2.StreamTcpPseudoPacketCreateDetectLogFlush 3.StreamTcpPacketSwitchDir Change the direction of packet while receiving SYN/AC...

These days, I’m extending Mysql detecting & parser on Suricata. Everything works well while replaying the pcap file with the following command: bin/suricata -c etc/spiderflow.yaml -r $1 -k none Ho...