Support #2768

Some HTTP events are not written to EVE file

Added by Michael Molho 5 months ago. Updated 5 months ago.

Target version:
Affected Versions:



On my Suricata, I don't get 100% of the HTTP events in the EVE file, only some HTTP events, but not all.

Here is my configuration with Suricata :

- Suricata is running on a box with a network interface getting all the traffic from several VLANs
- The traffic is sent to the Suricata box using a port mirroring on my switch
- The suricata configuration is very simple, pretty the same as the default configuration when you install suricata package on Ubuntu 18

What I observed is that if I start a tcpdump, I see all the HTTP traffic hitting the suricata network interface. But at the end, only few HTTP events are written to the EVE file, not all of them.
Moreover, I noticed that it depends on the network/VLAN from which the traffic is coming :

- All the HTTP events coming from my network are caught correctly
- All the HTTP events coming from my network are missed (no event written in the EVE file)

I've attached to this case a tcpdump started on the suricata box. You can see in this dump there are HTTP requests/responses coming from both and
But if I run my suricata (v4.0.5) on this pcap, there are only HTTP events from in the EVE file : (the HTTP events from are missed)

suricata -r http_issue.pcap -l logs

Could you help ?

Thank you



http_issue.pcap (23.8 KB) http_issue.pcap Michael Molho, 01/10/2019 06:07 PM



Updated by Victor Julien 5 months ago

  • Priority changed from Urgent to Normal

Not all packets contain the VLAN tags, so Suricata sees multiple flows. If possible, find out why the traffic is only partly tagged. A work around in Suricata is to disable vlan tracking:

  use-for-tracking: false

Or on the commandline: "--set vlan.use-for-tracking=false".


Updated by Michael Molho 5 months ago

Thank you very much Victor ! I've just tested the workaround and it works perfectly !


Updated by Victor Julien 5 months ago

  • Status changed from New to Closed

Great, thanks for reporting back.

Also available in: Atom PDF