WIP: Move to suricata
This merge request moves pakon-dev-detect to suricata. Pakon-dev-detect receives from (DGRAM) socket and expects flow_start
(our own) events from suricata.
Examples of flow_start
report can be seen in test.py.
As suricata doesn't provide notion whether src
is local/remote (but provides info about in_dev
), we consider 'local' only input devices passed as argv.
Non-local input interfaces are then ignored (no notification is created for them).
Devices are taken from suricata configuration and passed from init script.
This is related to merge request turris/turris-os-packages!40, which changes package dependency and adds output configuration file for suricata.