Project

General

Profile

Download (21.8 KB)

Feature #8764 » eve_wkssvc_fixed.json

Egor Kotov, 07/24/2026 09:40 AM

 
{"timestamp":"2026-07-22T12:30:38.931790+0300","flow_id":1737240968427573,"pcap_cnt":6,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":0,"smb":{"id":1,"dialect":"2.??","command":"SMB1_COMMAND_NEGOTIATE_PROTOCOL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":0,"tree_id":0,"client_dialects":["NT LM 0.12","SMB 2.002","SMB 2.???"],"server_guid":"a7064ebe-83e3-4bee-dbba-110d8c54f7d0","max_read_size":8388608,"max_write_size":8388608},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.934150+0300","flow_id":1737240968427573,"pcap_cnt":8,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":1,"smb":{"id":2,"dialect":"3.11","command":"SMB2_COMMAND_NEGOTIATE_PROTOCOL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":0,"tree_id":0,"client_dialects":["2.02","2.10","3.00","3.02","3.11"],"client_guid":"61b2d730-8435-11f1-d59e-7eb8025fe3a7","server_guid":"a7064ebe-83e3-4bee-dbba-110d8c54f7d0","max_read_size":8388608,"max_write_size":8388608},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.937169+0300","flow_id":1737240968427573,"pcap_cnt":13,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":2,"smb":{"id":3,"dialect":"3.11","command":"SMB2_COMMAND_SESSION_SETUP","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":0,"kerberos":{"realm":"CORP.LOCAL","snames":["cifs","WIN-A761HG0941U.CORP.LOCAL"]}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.938234+0300","flow_id":1737240968427573,"pcap_cnt":15,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":3,"smb":{"id":4,"dialect":"3.11","command":"SMB2_COMMAND_TREE_CONNECT","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"named_pipe":"\\\\WIN-A761HG0941U.CORP.LOCAL\\IPC$","share_type":"PIPE"},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.939823+0300","flow_id":1737240968427573,"pcap_cnt":19,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":4,"smb":{"id":5,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"function":"FSCTL_QUERY_NETWORK_INTERFACE_INFO"},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.939823+0300","flow_id":1737240968427573,"pcap_cnt":19,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":5,"smb":{"id":6,"dialect":"3.11","command":"SMB2_COMMAND_CREATE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"filename":"wkssvc","disposition":"FILE_OPEN","access":"normal","created":0,"accessed":0,"modified":0,"changed":0,"size":0,"fuid":"00000271-0009-0000-0001-000000000009"},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.942766+0300","flow_id":1737240968427573,"pcap_cnt":26,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":6,"smb":{"id":7,"dialect":"3.11","command":"SMB2_COMMAND_WRITE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"BIND","response":"BINDACK","interfaces":[{"uuid":"6bffd098-a112-3610-9833-46c3f87e345a","version":"1.0","ack_result":2,"ack_reason":0},{"uuid":"6bffd098-a112-3610-9833-46c3f87e345a","version":"1.0","ack_result":0,"ack_reason":0},{"uuid":"6bffd098-a112-3610-9833-46c3f87e345a","version":"1.0","ack_result":3,"ack_reason":0}],"call_id":2}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.950801+0300","flow_id":1737240968427573,"pcap_cnt":32,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":9,"smb":{"id":10,"dialect":"3.11","command":"SMB2_COMMAND_CLOSE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.951832+0300","flow_id":1737240968427573,"pcap_cnt":34,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":10,"smb":{"id":11,"dialect":"3.11","command":"SMB2_COMMAND_CREATE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"filename":"winreg","disposition":"FILE_OPEN","access":"normal","created":0,"accessed":0,"modified":0,"changed":0,"size":0,"fuid":"00000272-0009-0000-0005-000000000009"},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.957162+0300","flow_id":1737240968427573,"pcap_cnt":42,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":7,"smb":{"id":8,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"BINDACK","opnum":2,"req":{"frag_cnt":1,"stub_data_size":148},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"call_id":2}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.959456+0300","flow_id":1737240968427573,"pcap_cnt":46,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":11,"smb":{"id":12,"dialect":"3.11","command":"SMB2_COMMAND_WRITE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"BIND","response":"ALTER_CONTEXT_RESP","interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0","ack_result":2,"ack_reason":0},{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0","ack_result":0,"ack_reason":0},{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0","ack_result":3,"ack_reason":0}],"call_id":2}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.961445+0300","flow_id":1737240968427573,"pcap_cnt":48,"event_type":"anomaly","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":13,"anomaly":{"app_proto":"smb","type":"applayer","event":"malformed_data","layer":"proto_parser"},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.962605+0300","flow_id":1737240968427573,"pcap_cnt":50,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":14,"smb":{"id":15,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":16,"req":{"frag_cnt":1,"stub_data_size":132},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":148},"call_id":3}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.963686+0300","flow_id":1737240968427573,"pcap_cnt":52,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":15,"smb":{"id":16,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":26,"req":{"frag_cnt":1,"stub_data_size":116},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":100},"call_id":4}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.964560+0300","flow_id":1737240968427573,"pcap_cnt":54,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":16,"smb":{"id":17,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":196},"call_id":5}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.965548+0300","flow_id":1737240968427573,"pcap_cnt":56,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":17,"smb":{"id":18,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":196},"call_id":6}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.966493+0300","flow_id":1737240968427573,"pcap_cnt":58,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":18,"smb":{"id":19,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":196},"call_id":7}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.967477+0300","flow_id":1737240968427573,"pcap_cnt":60,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":19,"smb":{"id":20,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":260},"call_id":8}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.968531+0300","flow_id":1737240968427573,"pcap_cnt":62,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":20,"smb":{"id":21,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":276},"call_id":9}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.969452+0300","flow_id":1737240968427573,"pcap_cnt":64,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":21,"smb":{"id":22,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":292},"call_id":10}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.970435+0300","flow_id":1737240968427573,"pcap_cnt":66,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":22,"smb":{"id":23,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":308},"call_id":11}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.971235+0300","flow_id":1737240968427573,"pcap_cnt":68,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":23,"smb":{"id":24,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":292},"call_id":12}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.972176+0300","flow_id":1737240968427573,"pcap_cnt":70,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":24,"smb":{"id":25,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":308},"call_id":13}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.990960+0300","flow_id":1737240968427573,"pcap_cnt":72,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":25,"smb":{"id":26,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":9,"req":{"frag_cnt":1,"stub_data_size":180},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":196},"call_id":14}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.992079+0300","flow_id":1737240968427573,"pcap_cnt":74,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":26,"smb":{"id":27,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"RESPONSE","opnum":5,"req":{"frag_cnt":1,"stub_data_size":116},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"res":{"frag_cnt":1,"stub_data_size":116},"call_id":15}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:39.034156+0300","flow_id":1737240968427573,"pcap_cnt":76,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":27,"smb":{"id":28,"dialect":"3.11","command":"SMB2_COMMAND_CLOSE","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:49.660721+0300","flow_id":1737240968427573,"pcap_cnt":79,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":28,"smb":{"id":29,"dialect":"3.11","command":"SMB2_COMMAND_TREE_DISCONNECT","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.928770+0300","flow_id":1737240968427573,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"stream (flow timeout)","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":8,"smb":{"id":9,"dialect":"3.11","command":"SMB2_COMMAND_READ","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST_LOST","response":"REQUEST","call_id":0}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.928770+0300","flow_id":1737240968427573,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"stream (flow timeout)","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":12,"smb":{"id":13,"dialect":"3.11","command":"SMB2_COMMAND_WRITE","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"ALTER_CONTEXT","response":"UNREPLIED","call_id":2}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.928770+0300","flow_id":1737240968427573,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"stream (flow timeout)","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":13,"smb":{"id":14,"dialect":"3.11","command":"SMB2_COMMAND_IOCTL","session_id":39583223906365,"tree_id":1,"dcerpc":{"request":"REQUEST","response":"UNREPLIED","opnum":4,"req":{"frag_cnt":1,"stub_data_size":164},"interfaces":[{"uuid":"338cd001-2244-31f1-aaaa-900038001003","version":"1.0"}],"call_id":2}},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.928770+0300","flow_id":1737240968427573,"event_type":"smb","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"proto":"TCP","ip_v":4,"pkt_src":"stream (flow timeout)","community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tx_id":29,"smb":{"id":30,"dialect":"3.11","command":"SMB2_COMMAND_SESSION_LOGOFF","status":"STATUS_SUCCESS","status_code":"0x0","session_id":39583223906365,"tree_id":0},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-22T12:30:38.928770+0300","flow_id":1737240968427573,"event_type":"flow","src_ip":"192.168.57.131","src_port":50587,"dest_ip":"192.168.57.129","dest_port":445,"ip_v":4,"proto":"TCP","app_proto":"smb","flow":{"pkts_toserver":43,"pkts_toclient":38,"bytes_toserver":15325,"bytes_toclient":12621,"start":"2026-07-22T12:30:38.928770+0300","end":"2026-07-22T12:30:49.662271+0300","age":11,"state":"closed","reason":"shutdown","alerted":false,"tx_cnt":30},"community_id":"1:5mBt6wT+tNVGJinuAepA9S0Xjfg=","tcp":{"tcp_flags":"1e","tcp_flags_ts":"1e","tcp_flags_tc":"1a","syn":true,"rst":true,"psh":true,"ack":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1},"pcap_filename":"/root/suricata_traffic/wkssvc.pcap"}
{"timestamp":"2026-07-24T12:04:01.095029+0300","event_type":"stats","stats":{"uptime":0,"decoder":{"pkts":81,"bytes":27946,"ipv4":81,"ethernet":81,"tcp":81,"avg_pkt_size":345,"max_pkt_size":1514},"tcp":{"syn":1,"synack":1,"rst":1,"sessions":1,"ssn_from_pool":1,"segment_from_cache":68,"segment_from_pool":5,"memuse":3735552,"reassembly_memuse":688128},"flow":{"total":1,"tcp":1,"wrk":{"spare_sync_avg":100,"spare_sync":1,"flows_evicted_needs_work":1,"flows_evicted_pkt_inject":2,"flows_injected":1},"end":{"state":{"closed":1},"tcp_state":{"closed":1}},"mgr":{"rows_per_sec":6553},"spare":9900,"memuse":7154304},"app_layer":{"flow":{"smb":1},"tx":{"smb":30}},"memcap":{"pressure":1,"pressure_max":1},"defrag":{"memuse":33554432},"http":{"byterange":{"memuse":168384,"memcap":104857600}},"ippair":{"memuse":398144,"memcap":16777216},"host":{"memuse":382144,"memcap":33554432}},"pcap_filename":"\/root\/suricata_traffic\/wkssvc.pcap"}
(4-4/6)