inliniac/suricata — pull request #74 by regit (2012-09-18 10:36:56+00:00)
Title: Json socket file v2.2

Hello,

Here's a big pull request for the unix socket mode. This brings two new features to suricata:
* Suricata can now listen to a unix socket and respond to command sent on this socket
* A new running mode 'unix-socket' where user can tell to Suricata which pcap files to parse
All the exchanges are made using JSON format.The protocol is described in the commit 1a58eec318a842834a9252fbf4961a392cbad8a8.

The 'unix-socket' mode implementation is really tricky. This is a mode where only a unix socket manager thread is started. When a new file has to be parsed, the mode starts a pcap file running mode where the exit at end of file has been modified not to kill suricata. By doing this, we do a clean init for each file and are able to change things like output directory.