search

t3chn0m4g3 / myNSM

myNSM
3 stars 0 forks source link

Finetune suricata.yaml #7

Open t3chn0m4g3 opened 10 years ago

t3chn0m4g3 commented 10 years ago

Guarantee a better ootb experience by finetuning suricata.yaml.

  1. Packet / byte counting (http://www.gamelinux.org/?p=403)
  2. Record whole packets on event (http://www.openfpc.org/)
  3. Enable file extraction (https://redmine.openinfosecfoundation.org/projects/suricata/wiki/File_Extraction)
  4. Plot tcp window at start and map to os (http://2014.hackitoergosum.org/slides/day3_suricata_netfilter_prc_eric_leblond.pdf)