Skip to content

Disclose known limitations of embedded pcap analyzers #337

@philrz

Description

@philrz

Using #19 as an example, as of the moment of its closure, both Zeek and Brimcap have support for this cooked/SLL link layer protocol but Suricata still doesn't. We can't be responsible for every downstream limitation of the pcap analyzers we embed with Brimcap, but to the degree that we're aware of ones that have impacted our users in the past and hence are likely to come up again in the future, I could start to list them in the Troubleshooting article. I'd probably want to link to the article from places like the build-zeek README.

Also worthy of note:

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions