Can be useful in case of non standard network interfaces when like
tunnels or SPAN ports, when IP of interface does not match with IP of
packet.
Can be used to read traffic from multiple ports and interfaces at once
as well.
Can filter output_http by percentage of requests, constistent with a specific header value (FNV32-a hash-based)
Can filter output_http to those with header matching a specific regexp
Can filter output_http to those whose URL matches a specfic regexp
Add a new CLI flag to specify which HTTP methods should be replayed by
HTTPOutput. If specified, any requests not matching will be dropped.
This can be useful for replaying requests against stateful environments.
e.g. You may not want to reproduce POST requests against an application if
it results in additional calls to the outside world.
Some variations I considered:
- Filtering on input instead of output. However we don't currently do any
request parsing on input, and doing so would likely have an impact on
performance.
- A request filtering plugin. We might want to revisit this if we add
anymore options to HTTPOutput. It could also be used to modify requests in
an existing file capture. Although because all plugins expect byte slices
we'd potentially have to parse requests more than once.
I don't think this warrants a separate test for HTTPOutput yet. But, again,
if we add anymore then we should split them out, and DRY up if possible.
Because we don't want to overload the scenarios covered by that one test.
Leonid Bugaev