inliniac/suricata — pull request #1263 by inliniac (2014-12-16 13:35:42+00:00)
Title: [preview, feedback] hostbits v1

Initial stab at doing hostbits. Hostbits are like flowbits, except the "bits" are stored per host instead of per flow.

Syntax is the same, with an addition:

hostbits:set,bitname;
hostbits:isset,bitname,dst;

The last field is src or dst, which means the src or dst ip (host) is used for the bit operation. If omitted the src is used.

TODO:
- time outs: default and per 'set' timeout to control the lifetime of a bit
- performance testing
- testing
- 'both' setting for flagging both src and dst
- anything else?

Prscript:
- PR build: https://buildbot.openinfosecfoundation.org/builders/inliniac/builds/93
- PR pcaps: https://buildbot.openinfosecfoundation.org/builders/inliniac-pcap/builds/93