Project

General

Profile

Actions

Bug #1881

open

pcap logging out of order

Added by Peter Manev over 7 years ago. Updated over 4 years ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Using 3.1dev (rev 5db3220)
and the pcap attached (malicious test) I tried the following-

(1)

/usr/bin/suricata -c /etc/suricata/suricata.yaml -v -r httptunneled.pcap -S /dev/null

(2)

 /usr/bin/suricata -c /etc/suricata/suricata.yaml -v -r httptunneled.pcap -S /dev/null --runmode=single

while having pcap logging enabled in suricata.yaml.

In case (1) - we have a full pcap being written (all 72 packets) -
however they have been written unordered and wireshark shows a lot of
"TCP Spurious Retransmission/Previous Segment not captured". So the packets are there - just not in the right order.

In case (2) - we have a full pcap being written (all 72 packets) -
identical to the one being read.


Files

httptunneled.pcap (35.1 KB) httptunneled.pcap Peter Manev, 09/01/2016 06:30 PM
Actions

Also available in: Atom PDF