Bug #5037: invalid timestamp in ending events - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #5037

open

invalid timestamp in ending events

Added by Eric Leblond almost 3 years ago. Updated 10 months ago.

Status:

New

Priority:

Normal

Assignee:

Eric Leblond

Target version:

8.0.0-beta1

Affected Versions:

5.0.5, 6.0.1, 5.0.6, 6.0.2, 5.0.7, 6.0.3, 5.0.8, 6.0.4, 5.0.9, 6.0.5, git master

Effort:

Difficulty:

Label:

Description

When an event logging is triggered by the flow cleaning function, the timestamp is invalid as it is often set to a time that is before the flow start.

Files

smb-2-sessions.pcap (28.7 KB) smb-2-sessions.pcap

Eric Leblond, 02/03/2022 10:54 AM

Subtasks 2 (0 open — 2 closed)

Actions

Copy link

Updated by Eric Leblond almost 3 years ago

File smb-2-sessions.pcap smb-2-sessions.pcap added

When replaying with -r the attached pcap that contains 2 smb sessions, we got a series of SMB records. If we take one of the session(where we have a logoff) and sort the event by time, we got the following

cat /tmp/smb-2/eve.json | jq 'select(.event_type=="smb" and .smb.session_id==4398180728949)|{"time": .timestamp, "command":.smb.command}' -c | sort
{"time":"2021-06-30T20:28:32.664884+0200","command":"SMB2_COMMAND_SESSION_LOGOFF"}
{"time":"2021-06-30T22:52:21.504749+0200","command":"SMB2_COMMAND_SESSION_SETUP"}
{"time":"2021-06-30T22:52:21.504964+0200","command":"SMB2_COMMAND_TREE_CONNECT"}
{"time":"2021-06-30T22:52:21.700998+0200","command":"SMB2_COMMAND_IOCTL"}
{"time":"2021-06-30T22:52:31.921537+0200","command":"SMB2_COMMAND_TREE_DISCONNECT"}

So the logoff of the session comes 24 seconds before the setup of the same session.

By using lastts as timestamp in pseudo packet as done in https://github.com/OISF/suricata/pull/6921 we got

{"time":"2021-06-30T22:52:21.504749+0200","command":"SMB2_COMMAND_SESSION_SETUP"}
{"time":"2021-06-30T22:52:21.504964+0200","command":"SMB2_COMMAND_TREE_CONNECT"}
{"time":"2021-06-30T22:52:21.700998+0200","command":"SMB2_COMMAND_IOCTL"}
{"time":"2021-06-30T22:52:31.921537+0200","command":"SMB2_COMMAND_TREE_DISCONNECT"}
{"time":"2021-06-30T22:52:31.921736+0200","command":"SMB2_COMMAND_SESSION_LOGOFF"}

Actions

Copy link