# Developers **URL:** https://forum.suricata.io/c/developers/8.md [Latest](https://forum.suricata.io/latest.md) · [Categories](https://forum.suricata.io/categories.md) · [Tags](https://forum.suricata.io/tags.md) --- ## [Github CI status](https://forum.suricata.io/t/github-ci-status/1095)
**Author:** [@vjulien](https://forum.suricata.io/u/vjulien)\ **Replies:** 7\ **Last updated:** [August 24, 2021, 9:21am UTC](https://forum.suricata.io/t/github-ci-status/1095 "2021-08-24T09:21:25Z")
Topic to update everyone on the current CI status. --- ## [About the Developers category](https://forum.suricata.io/t/about-the-developers-category/22)
**Author:** [@vjulien](https://forum.suricata.io/u/vjulien)\ **Replies:** 1\ **Last updated:** [February 21, 2023, 3:07pm UTC](https://forum.suricata.io/t/about-the-developers-category/22 "2023-02-21T15:07:58Z")
Suricata Development related questions and discussion. If you’re looking to extend Suricata, or are interested in helping develop Suricata, join us here. --- ## [Suricata 8.0.7 Windows EVE Timestamp Reports Incorrect Timezone Offset](https://forum.suricata.io/t/suricata-8-0-7-windows-eve-timestamp-reports-incorrect-timezone-offset/6470)
**Author:** [@Morpheus](https://forum.suricata.io/u/Morpheus)\ **Replies:** 1\ **Last updated:** [September 22, 2026, 11:31pm UTC](https://forum.suricata.io/t/suricata-8-0-7-windows-eve-timestamp-reports-incorrect-timezone-offset/6470 "2026-09-22T23:31:03Z")
Hello, I am running Suricata 8.0.7 RELEASE (64-bit Windows build) on Windows 11 Pro and have encountered what appears to be an incorrect timezone offset in the EVE JSON timestamps. My Windows system is configured for E… --- ## [HTTP traffic detected by Zeek but missed by Suricata on incomplete TCP streams](https://forum.suricata.io/t/http-traffic-detected-by-zeek-but-missed-by-suricata-on-incomplete-tcp-streams/6441)
**Author:** [@monstertsl](https://forum.suricata.io/u/monstertsl)\ **Replies:** 1\ **Last updated:** [August 21, 2026, 12:51pm UTC](https://forum.suricata.io/t/http-traffic-detected-by-zeek-but-missed-by-suricata-on-incomplete-tcp-streams/6441 "2026-08-21T12:51:01Z")
In high-concurrency scanning scenarios, some TCP streams generated by scanners are half-open or otherwise incomplete, such as non-contiguous sequence numbers, incomplete handshakes, or an immediate RST after sending the … --- ## [DatasetAlloc seems to unnecessarily use \*name of the dataset to be created](https://forum.suricata.io/t/datasetalloc-seems-to-unnecessarily-use-name-of-the-dataset-to-be-created/6437)
**Author:** [@1bnBattuta](https://forum.suricata.io/u/1bnBattuta)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 3:12pm UTC](https://forum.suricata.io/t/datasetalloc-seems-to-unnecessarily-use-name-of-the-dataset-to-be-created/6437 "2026-08-18T15:12:49Z")
Hello there, I am writing internal docs for datasets.h and I noticed that while creating a new dataset, we start by Dataset \*DatasetAlloc(const char \*name); which only allocate memory via SCCalloc and then set the id of … --- ## [Update on ICAP integration proposal: Working implementation of SSLproxy (icap branch) & icapsuricata (libsuricata service)](https://forum.suricata.io/t/update-on-icap-integration-proposal-working-implementation-of-sslproxy-icap-branch-icapsuricata-libsuricata-service/6357)
**Author:** [@Soner\_Tari](https://forum.suricata.io/u/Soner_Tari)\ **Replies:** 12\ **Last updated:** [August 17, 2026, 8:28pm UTC](https://forum.suricata.io/t/update-on-icap-integration-proposal-working-implementation-of-sslproxy-icap-branch-icapsuricata-libsuricata-service/6357 "2026-08-17T20:28:09Z")
Hi All, Following up on my ICAP integration proposal from earlier this year—specifically the architectural shift discussed in this topic on the Suricata forum—I wanted to share a major update regarding working software … --- ## [Suricata-update fails on Windows with \[Errno 13\] Permission denied due to temporary file handle locks](https://forum.suricata.io/t/suricata-update-fails-on-windows-with-errno-13-permission-denied-due-to-temporary-file-handle-locks/6427)
**Author:** [@Morpheus101](https://forum.suricata.io/u/Morpheus101)\ **Replies:** 3\ **Last updated:** [August 13, 2026, 2:14pm UTC](https://forum.suricata.io/t/suricata-update-fails-on-windows-with-errno-13-permission-denied-due-to-temporary-file-handle-locks/6427 "2026-08-13T14:14:37Z")
Hello Suricata Development Team, I’ve been deploying and maintaining Suricata on Windows environments, and I wanted to log an issue regarding cross-platform compatibility with suricata-update. While suricata-update is … --- ## [Ja4 Fingerprint match against the dataset when ssl proxy is involved ,whereing Ja4 FP is calculated by proxy](https://forum.suricata.io/t/ja4-fingerprint-match-against-the-dataset-when-ssl-proxy-is-involved-whereing-ja4-fp-is-calculated-by-proxy/6421)
**Author:** [@prathimak](https://forum.suricata.io/u/prathimak)\ **Replies:** 3\ **Last updated:** [August 5, 2026, 8:23am UTC](https://forum.suricata.io/t/ja4-fingerprint-match-against-the-dataset-when-ssl-proxy-is-involved-whereing-ja4-fp-is-calculated-by-proxy/6421 "2026-08-05T08:23:57Z")
Hi everyone, I am deploying Suricata (8.0.5) in a topology where an upstream SSL proxy handles TLS termination/decryption before passing the plaintext traffic to Suricata. Suricata Dataset would be used to support big … --- ## [Feature Request: Ability to use local fqdns (to get ipv4 and/or ipv6) in address-groups vars](https://forum.suricata.io/t/feature-request-ability-to-use-local-fqdns-to-get-ipv4-and-or-ipv6-in-address-groups-vars/5735)
**Author:** [@jonny5](https://forum.suricata.io/u/jonny5)\ **Replies:** 6\ **Last updated:** [July 20, 2026, 1:55pm UTC](https://forum.suricata.io/t/feature-request-ability-to-use-local-fqdns-to-get-ipv4-and-or-ipv6-in-address-groups-vars/5735 "2026-07-20T13:55:58Z")
TLDR; What if we add a dynamic feature to address-group vars via fqdn strings in the list? Have Suricata resolve and add/remove as ( static +/- ( dynamic +/- updates) ) or whatever works better. The long: There are se… --- ## [A question about the AF\_PACKET TPACKET\_V3 implementation](https://forum.suricata.io/t/a-question-about-the-af-packet-tpacket-v3-implementation/6415)
**Author:** [@Jal](https://forum.suricata.io/u/Jal)\ **Replies:** 2\ **Last updated:** [July 20, 2026, 2:21am UTC](https://forum.suricata.io/t/a-question-about-the-af-packet-tpacket-v3-implementation/6415 "2026-07-20T02:21:58Z")
Hi, While reading the AF\_PACKET TPACKET\_V3 implementation in Suricata,I have a question and hope to gain some insight In AFPReadFromRingV3(), the ownership of a block is returned to the kernel by writing: pbd-\>hdr.bh1… --- ## [DPDK pktmbuf cache can be 1](https://forum.suricata.io/t/dpdk-pktmbuf-cache-can-be-1/6377)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 0\ **Last updated:** [June 29, 2026, 9:18am UTC](https://forum.suricata.io/t/dpdk-pktmbuf-cache-can-be-1/6377 "2026-06-29T09:18:44Z")
As for func GreatestDivisorUpTo.There are odd numbers(for 8191) that does’t have a divisor, so may be we should call it with input arg “q\_mp\_sz + 1”? --- ## [TCP reset Optimization for REJECT\_DIR\_DST](https://forum.suricata.io/t/tcp-reset-optimization-for-reject-dir-dst/6376)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 0\ **Last updated:** [June 29, 2026, 8:44am UTC](https://forum.suricata.io/t/tcp-reset-optimization-for-reject-dir-dst/6376 "2026-06-29T08:44:55Z")
For module RespondReject, TCP reset can do a better way for REJECT\_DIR\_DST, as you annotates。 //befor my modification static inline void SetupTCP(Packet \*p, Libnet11Packet \*lpacket, enum RejectDirection dir) { switch… --- ## [MLNX\_OFED has transitioned into DOCA-Host, and now is available as DOCA-OFED profile…](https://forum.suricata.io/t/mlnx-ofed-has-transitioned-into-doca-host-and-now-is-available-as-doca-ofed-profile/6130)
**Author:** [@florinsfetea](https://forum.suricata.io/u/florinsfetea)\ **Replies:** 12\ **Last updated:** [March 25, 2026, 5:10pm UTC](https://forum.suricata.io/t/mlnx-ofed-has-transitioned-into-doca-host-and-now-is-available-as-doca-ofed-profile/6130 "2026-03-25T17:10:00Z")
Dear community, as it seems the new driver supported will / has already move from MLNX\_OFED to DOCA-OFED for the newer OSs and Connect-X 6 and “smart” (BF2,3,etc.)\* ”Note: MLNX\_OFED has transitioned into DOCA-Host, a… --- ## [How to map and interrelate the severity level code?](https://forum.suricata.io/t/how-to-map-and-interrelate-the-severity-level-code/6197)
**Author:** [@Wilker\_Luiz\_Gadelha](https://forum.suricata.io/u/Wilker_Luiz_Gadelha)\ **Replies:** 4\ **Last updated:** [February 25, 2026, 7:18pm UTC](https://forum.suricata.io/t/how-to-map-and-interrelate-the-severity-level-code/6197 "2026-02-25T19:18:40Z")
How does the meerkat define the severity level of the alert? 1, 2, 3, 4… What are the most relevant combined features that can be considered to have greater weight for this action? Would the signature IDs have a differen… --- ## [Support for Opentelemetry](https://forum.suricata.io/t/support-for-opentelemetry/6202)
**Author:** [@M4ST3R0RG](https://forum.suricata.io/u/M4ST3R0RG)\ **Replies:** 1\ **Last updated:** [February 18, 2026, 1:49pm UTC](https://forum.suricata.io/t/support-for-opentelemetry/6202 "2026-02-18T13:49:48Z")
I would like to propose adding native support for the OpenTelemetry Protocol (OTLP) for direct export of logs and alerts in Suricata. There is already a clear demand from the community: vendors such as Coralogix publish … --- ## [Rethinking the SSLproxy/Suricata integration: Divert Mode is a dead end for H2/H3](https://forum.suricata.io/t/rethinking-the-sslproxy-suricata-integration-divert-mode-is-a-dead-end-for-h2-h3/6195)
**Author:** [@Soner\_Tari](https://forum.suricata.io/u/Soner_Tari)\ **Replies:** 14\ **Last updated:** [February 17, 2026, 5:48pm UTC](https://forum.suricata.io/t/rethinking-the-sslproxy-suricata-integration-divert-mode-is-a-dead-end-for-h2-h3/6195 "2026-02-17T17:48:02Z")
Hi All, I’ve just published a new piece that I think is relevant to the current work on the SSLproxy support PR (#13960): I Tried to Add HTTP/2 to SSLproxy. Here is Why I Stopped. (We Need ICAP.). To be blunt: The curr… --- ## [Observing POP3 recognized as FTP - Suricata 7.0.9](https://forum.suricata.io/t/observing-pop3-recognized-as-ftp-suricata-7-0-9/5756)
**Author:** [@Cherish\_George](https://forum.suricata.io/u/Cherish_George)\ **Replies:** 4\ **Last updated:** [February 13, 2026, 9:11am UTC](https://forum.suricata.io/t/observing-pop3-recognized-as-ftp-suricata-7-0-9/5756 "2026-02-13T09:11:41Z")
hi Suricata Team, I am testing suricata 7.0.9 and seeing that pop3 is recognized as FTP by suricata 7.0.9. I found the below threads online, which is related to suricata 7.0.1, is this issue still relavant for suricata… --- ## [VPP-Suricata Integration: Library Mode Packet Injection](https://forum.suricata.io/t/vpp-suricata-integration-library-mode-packet-injection/6078)
**Author:** [@Indira](https://forum.suricata.io/u/Indira)\ **Replies:** 11\ **Last updated:** [January 29, 2026, 5:55am UTC](https://forum.suricata.io/t/vpp-suricata-integration-library-mode-packet-injection/6078 "2026-01-29T05:55:33Z")
We’re integrating VPP (Vector Packet Processing) with Suricata 8.0.0 library mode for real-time IDPS functionality. The goal is to inject packets from VPP plugin thread into Suricata for detection with ProofPoint rules, … --- ## [About CPU/Core requirements by Suricata when DPDK is enabled](https://forum.suricata.io/t/about-cpu-core-requirements-by-suricata-when-dpdk-is-enabled/6157)
**Author:** [@Muttanna\_Hosur](https://forum.suricata.io/u/Muttanna_Hosur)\ **Replies:** 2\ **Last updated:** [January 8, 2026, 9:40am UTC](https://forum.suricata.io/t/about-cpu-core-requirements-by-suricata-when-dpdk-is-enabled/6157 "2026-01-08T09:40:12Z")
Hello, I have recently enabled DPDK in Suricata, and using vhost-virtio interfaces to exchange packets between suricata and my datapath. When I pass less number of core in worker-cpu-set as compared to the total number… --- ## [Question about nDPI 5.0](https://forum.suricata.io/t/question-about-ndpi-5-0/6151)
**Author:** [@Anthony\_Frnog](https://forum.suricata.io/u/Anthony_Frnog)\ **Replies:** 1\ **Last updated:** [January 5, 2026, 11:44am UTC](https://forum.suricata.io/t/question-about-ndpi-5-0/6151 "2026-01-05T11:44:16Z")
HI, I use Suricata 8.0.2 with nDPI 4.14 and it works fine. In the next relase 8.0.x, is it possible to have a possibility to compile Suricata with nDPI release 5.0. Currently it’s not possible. Thank you Anthony --- ## [Why do we a limit of 60 for ip reputations in Suricata?](https://forum.suricata.io/t/why-do-we-a-limit-of-60-for-ip-reputations-in-suricata/6137)
**Author:** [@tarun](https://forum.suricata.io/u/tarun)\ **Replies:** 1\ **Last updated:** [December 13, 2025, 9:36am UTC](https://forum.suricata.io/t/why-do-we-a-limit-of-60-for-ip-reputations-in-suricata/6137 "2025-12-13T09:36:58Z")
The maximum value for the category ID is hard coded at 60 currently. Curious, how did we come up with this number, and what are the potential consequences of increasing this number in our setup? Any suggestions on the te… --- ## [SIP TCP Midstream alproto detect failed due to nop data](https://forum.suricata.io/t/sip-tcp-midstream-alproto-detect-failed-due-to-nop-data/6132)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 0\ **Last updated:** [December 9, 2025, 7:12am UTC](https://forum.suricata.io/t/sip-tcp-midstream-alproto-detect-failed-due-to-nop-data/6132 "2025-12-09T07:12:25Z")
For a midstream TCP, when the first seen payload is nop data, the alproto will never be detected although many more subsequence payload data match alproto patterns. 1.I have two physical machines, an IPC and a NVR for S… --- ## [Is mempool-cache-size effective in DPDK mode in Suricata?](https://forum.suricata.io/t/is-mempool-cache-size-effective-in-dpdk-mode-in-suricata/6101)
**Author:** [@gongziw](https://forum.suricata.io/u/gongziw)\ **Replies:** 1\ **Last updated:** [November 6, 2025, 11:43am UTC](https://forum.suricata.io/t/is-mempool-cache-size-effective-in-dpdk-mode-in-suricata/6101 "2025-11-06T11:43:15Z")
Suricata: 8.0.1 DPDK: 24.11.3 DPDK mempool per-lcore local cache uses rte\_lcore\_id() to get the index. This value is set in EAL worker threads, but is invalid in Suricata worker threads. Suricata add log: static TmEc… --- ## [Eve-log filetype redis do not support password configuration](https://forum.suricata.io/t/eve-log-filetype-redis-do-not-support-password-configuration/6096)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 2\ **Last updated:** [November 5, 2025, 1:18am UTC](https://forum.suricata.io/t/eve-log-filetype-redis-do-not-support-password-configuration/6096 "2025-11-05T01:18:39Z")
When redis is select as eve-log filetype, we can not configure a password for redis client. Maybe we can add password configuration for redis filetype. --- ## [AppLayer: NFSv4 Parser bug, OpenRequestContent should add EXCLUSIVE4\_1](https://forum.suricata.io/t/applayer-nfsv4-parser-bug-openrequestcontent-should-add-exclusive4-1/6068)
**Author:** [@QianKaiLin](https://forum.suricata.io/u/QianKaiLin)\ **Replies:** 2\ **Last updated:** [October 28, 2025, 6:44pm UTC](https://forum.suricata.io/t/applayer-nfsv4-parser-bug-openrequestcontent-should-add-exclusive4-1/6068 "2025-10-28T18:44:44Z")
Please refer to the rfc --- ## [Tcp stream: Tcp slide window may be incorrectly used](https://forum.suricata.io/t/tcp-stream-tcp-slide-window-may-be-incorrectly-used/6067)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 0\ **Last updated:** [October 16, 2025, 6:20am UTC](https://forum.suricata.io/t/tcp-stream-tcp-slide-window-may-be-incorrectly-used/6067 "2025-10-16T06:20:50Z")
Problem: In function StreamTcpPacketStateNone SYN/ACK branch, ssn-\>server.window is assigned by Server announced TCP window. But according to my reviewing of relevent codes, server.window is used to record Client announ… --- ## [Output-json-http lead to segfault](https://forum.suricata.io/t/output-json-http-lead-to-segfault/6062)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 2\ **Last updated:** [October 16, 2025, 1:59am UTC](https://forum.suricata.io/t/output-json-http-lead-to-segfault/6062 "2025-10-16T01:59:24Z")
Problem: When transfer a large file(larger than normal linux thread stack size 8192KB) by http, function “BodyPrintableBuffer” may lead to segfault dule to dynamically allocated array “printable\_buf“ on stack. Solution… --- ## [Some functions in sip/parser.rs do redundant computing](https://forum.suricata.io/t/some-functions-in-sip-parser-rs-do-redundant-computing/6063)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 2\ **Last updated:** [October 16, 2025, 1:21am UTC](https://forum.suricata.io/t/some-functions-in-sip-parser-rs-do-redundant-computing/6063 "2025-10-16T01:21:53Z")
Problem: func is\_alphanumeric is a part of func is\_token\_char, but the two functions are all called by is\_request\_uri\_char. fn is\_token\_char(b: u8) → bool { is\_alphanumeric(b) || b"!%'\*±.\_\`~".contains(&b) } fn is\_re… --- ## [Suricata 8.0 dynamic alproto can not be disabled](https://forum.suricata.io/t/suricata-8-0-dynamic-alproto-can-not-be-disabled/6059)
**Author:** [@liheng562653799](https://forum.suricata.io/u/liheng562653799)\ **Replies:** 4\ **Last updated:** [October 15, 2025, 8:25am UTC](https://forum.suricata.io/t/suricata-8-0-dynamic-alproto-can-not-be-disabled/6059 "2025-10-15T08:25:29Z")
Outputing: \[35686\] Notice: suricata: This is znsm version 8.0.0 RELEASE running in SYSTEM mode \[35686\] Info: cpu: CPUs/cores online: 16 \[35686\] Info: dpdk: Setting IPS mode \[35686\] Warning: runmodes: disabling livede… --- ## [Some error Suricata 8 installation](https://forum.suricata.io/t/some-error-suricata-8-installation/5882)
**Author:** [@Rick\_Gutierrez](https://forum.suricata.io/u/Rick_Gutierrez)\ **Replies:** 9\ **Last updated:** [October 8, 2025, 7:04am UTC](https://forum.suricata.io/t/some-error-suricata-8-installation/5882 "2025-10-08T07:04:30Z")
Hi guys! , I’m doing a clean install of Suricata 8 on Ubuntu 22.04 and when I look at the logs, it shows me that there are directories that were not created. Starting Suricata IDS/IPS/NSM/FW daemon… Jul 18 15:12:57 se… [Next page](https://forum.suricata.io/c/developers/8.md?page=1)