<html><head></head><body><div style="font-family: Verdana;font-size: 12.0px;"><div>I've been having issues with detecting data in MIME base64 encoded packets. There seems to be an issue either with the depth in which Suricata can inspect using file_data or it doens't seem to be able to decode the base64 properly. Some traffic I can detect elements in the file_data buffer but to a certain limit and other times I can't even get anything from the first part of the buffer.</div>
<div> </div>
<div>I've enabled debugging but that only show me the base64 encoded packet int he logs. I an decode the part myself but that doesn't tell me if Suricata is seeing the same thing or not. Is there a way to dump file_data or any other buffer either to a file or to the screen?</div></div></body></html>