Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Disclose known limitations of embedded pcap analyzers #337

Open
philrz opened this issue Feb 12, 2024 · 0 comments
Open

Disclose known limitations of embedded pcap analyzers #337

philrz opened this issue Feb 12, 2024 · 0 comments
Assignees

Comments

@philrz
Copy link
Contributor

philrz commented Feb 12, 2024

Using #19 as an example, as of the moment of its closure, both Zeek and Brimcap have support for this cooked/SLL link layer protocol but Suricata still doesn't. We can't be responsible for every downstream limitation of the pcap analyzers we embed with Brimcap, but to the degree that we're aware of ones that have impacted our users in the past and hence are likely to come up again in the future, I could start to list them in the Troubleshooting article. I'd probably want to link to the article from places like the build-zeek README.

Also worthy of note:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant