Skip to content

WIP: Move to suricata

Martin Petráček requested to merge suricata into master

This merge request moves pakon-dev-detect to suricata. Pakon-dev-detect receives from (DGRAM) socket and expects flow_start (our own) events from suricata.

Examples of flow_start report can be seen in test.py.

As suricata doesn't provide notion whether src is local/remote (but provides info about in_dev), we consider 'local' only input devices passed as argv. Non-local input interfaces are then ignored (no notification is created for them). Devices are taken from suricata configuration and passed from init script.

This is related to merge request turris/turris-os-packages!40, which changes package dependency and adds output configuration file for suricata.

Edited by Martin Petráček

Merge request reports