This is the bug: Upon connection closed, if an attack was detect we do not remove the pcap and attack logs... so it is possible to get collisions in the future.
The fix: Upon connection closed we must move the pcap files AND attack logs out of the "incoming" logs directory.
david415
commented
9 years ago
This is the bug: Upon connection closed, if an attack was detect we do not remove the pcap and attack logs... so it is possible to get collisions in the future.
The fix: Upon connection closed we must move the pcap files AND attack logs out of the "incoming" logs directory.