suricata/entrypoint.sh: add PCAP_FILE_CONTINUOUS env

ANSSI-FR · Jan 16, 2024 · cb60365 · cb60365
1 parent 6388238
commit cb60365
Showing 1 changed file with 6 additions and 3 deletions.
diff --git a/suricata/entrypoint.sh b/suricata/entrypoint.sh
@@ -5,9 +5,12 @@
 echo "Cleaning previous Suricata output"
 rm -f suricata/output/eve.json suricata/output/tcpstore.log suricata/output/udpstore.log
 
-echo "Starting Suricata with HOME_NET=$CTF_HOME_NET PCAP_FILE=$PCAP_FILE"
+SURICATA_PARAM="--runmode=single --no-random"
+if [ "${PCAP_FILE_CONTINUOUS:=true}" = true ]; then
+    SURICATA_PARAM="${SURICATA_PARAM} --pcap-file-continuous"
+fi
+echo "Starting Suricata with HOME_NET=$CTF_HOME_NET PCAP_FILE=$PCAP_FILE PCAP_FILE_CONTINUOUS=$PCAP_FILE_CONTINUOUS"
 suricata -c suricata/suricata.yaml -r input_pcaps -l suricata/output \
     --set vars.address-groups.HOME_NET="${CTF_HOME_NET}" \
     --set outputs.1.eve-log.pcap-file=${PCAP_FILE:=true} \
-    --runmode=single --no-random \
-    --pcap-file-continuous
+    ${SURICATA_PARAM}