Bug #5189
closedSuricata alerts pcap issue
Description
Hi , I wanted to test suricata alert pcap , So I found 2 requests in github and tested them
Both of them generates pcap .
But issue is that when we open pcap , header of packets is truncated . It is some random unrecognizable text
Info filed should contain something like GET /url , etc but it contain only src_port -> dest_port ACK ,etc
https://github.com/OISF/suricata/pull/5345/
https://github.com/OISF/suricata/pull/6766/
These requests are closed
Any other versions which I can try.
Updated by Chatak Kumar over 2 years ago
- Assignee changed from Scott Jordan to Victor Julien
Hi , I wanted to test suricata alert pcap , So I found 2 requests in github and tested them
Both of them generates pcap . I tested by running suricata with a pcap to compare.
But issue is that when we open pcap , header of packets is truncated . It is some random unrecognizable text
Info filed should contain something like GET /url, etc but it contain only src_port -> dest_port , ACK ,etc
Packets Info is different from original pcap as compared with Alerts pcap
https://github.com/OISF/suricata/pull/5345/
https://github.com/OISF/suricata/pull/6766/
These requests are closed
Any other versions which I can try.
Updated by Jason Ish over 2 years ago
- Related to Feature #120: Capture full session on alert added
Updated by Jason Ish over 2 years ago
The latest version of this features is in this pull request: https://github.com/OISF/suricata/pull/6941
As this is a feature under development I'd recommend commenting on the ticket for that feature: #120.
Updated by Chatak Kumar over 2 years ago
I have tried this v2.2.13 also It has same issue.
will be adding this comment under #120 also
Updated by Victor Julien over 2 years ago
- Status changed from New to Feedback
- Assignee changed from Victor Julien to Chatak Kumar
- Target version deleted (
7.0.0-beta1)
#120 is now closed as conditional pcap logging is now implemented in master. Please give that a try to see if it works for you. Thanks!
Updated by Philippe Antoine over 1 year ago
- Status changed from Feedback to Closed
Closing as a feature was implement with #120, feel free to reopen if there is still a problem