]> git.ipfire.org Git - thirdparty/suricata.git/commit
output-json: add MAC address output 5258/head
authorSascha Steinbiss <satta@debian.org>
Mon, 2 Mar 2020 18:10:30 +0000 (19:10 +0100)
committerVictor Julien <victor@inliniac.net>
Sun, 2 Aug 2020 18:36:44 +0000 (20:36 +0200)
commit4e1a41a17d644f7e74d914302f3228d12aa76fbf
treec6fcb5a344accb08d359b02a1d6d8cf34c1fb110
parentc42574169e0b3e4bca396493b21f0208ee1bc759
output-json: add MAC address output

This commit adds MAC address output to the EVE-JSON format. We follow the
remarks made in Redmine ticket #962: for packets, log MAC src/dst as a
scalar field in EVE; for flows, log MAC src/dst as lists in EVE. Field names
are different between flow and packet context to avoid type confusion
(src_mac vs. src_macs). Configuration approach and JSON representation is
taken from previous GitHub PR #2700.
16 files changed:
doc/userguide/output/eve/eve-json-output.rst
src/Makefile.am
src/decode.c
src/decode.h
src/flow-util.c
src/flow-util.h
src/flow-worker.c
src/flow.c
src/flow.h
src/output-json.c
src/output-json.h
src/runmode-unittests.c
src/suricata.c
src/util-macset.c [new file with mode: 0644]
src/util-macset.h [new file with mode: 0644]
suricata.yaml.in