inliniac/suricata — pull request #585 by ken-tilera (2013-10-09 17:20:37+00:00)
Title: Add testing controls in yaml file to disable detection engine features.

To make it easier to compare the alerts generated when reading a pcap file
and processing the same file as live traffic (replayed over a network), Anoop
suggested disabling detect-tag, detect-detection-filter and detect-thresholds.
I also added app-layer-events. This removes any time dependency and should
results in the same alerts being generated no matter what rate the packets are
processed. More alerts are generated than with these enabled.

To disable the features, add the following to the suricata.yaml file:

testing:
detect:
tag: disable
app-layer-event: disable
threshold: disable
detection-filter: disable

https://buildbot.suricata-ids.org/builders/ken-tilera/builds/25