Project

General

Profile

Support #2768

Some HTTP events are not written to EVE file

Added by Michael Molho 10 days ago. Updated 6 days ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:

Description

Hi,

On my Suricata, I don't get 100% of the HTTP events in the EVE file, only some HTTP events, but not all.

Here is my configuration with Suricata :

- Suricata is running on a box with a network interface getting all the traffic from several VLANs
- The traffic is sent to the Suricata box using a port mirroring on my switch
- The suricata configuration is very simple, pretty the same as the default configuration when you install suricata package on Ubuntu 18

What I observed is that if I start a tcpdump, I see all the HTTP traffic hitting the suricata network interface. But at the end, only few HTTP events are written to the EVE file, not all of them.
Moreover, I noticed that it depends on the network/VLAN from which the traffic is coming :

- All the HTTP events coming from my network 172.20.20.0/24 are caught correctly
- All the HTTP events coming from my network 172.20.1.0/24 are missed (no event written in the EVE file)

I've attached to this case a tcpdump started on the suricata box. You can see in this dump there are HTTP requests/responses coming from both 172.20.20.167 and 172.20.1.206
But if I run my suricata (v4.0.5) on this pcap, there are only HTTP events from 172.20.20.167 in the EVE file : (the HTTP events from 172.20.1.206 are missed)

suricata -r http_issue.pcap -l logs

Could you help ?

Thank you

/Michael

http_issue.pcap (23.8 KB) http_issue.pcap Michael Molho, 01/10/2019 06:07 PM

History

#1 Updated by Victor Julien 6 days ago

  • Priority changed from Urgent to Normal

Not all packets contain the VLAN tags, so Suricata sees multiple flows. If possible, find out why the traffic is only partly tagged. A work around in Suricata is to disable vlan tracking:

vlan:
  use-for-tracking: false

Or on the commandline: "--set vlan.use-for-tracking=false".

#2 Updated by Michael Molho 6 days ago

Thank you very much Victor ! I've just tested the workaround and it works perfectly !

#3 Updated by Victor Julien 6 days ago

  • Status changed from New to Closed

Great, thanks for reporting back.

Also available in: Atom PDF