Project

General

Profile

Actions

Bug #5276

closed

eve: payload field randomly missing even if the packet field is present

Added by Zane B-H over 2 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0, Needs backport to 6.0

Description

Originally came across this in 6.0.2, but 6.0.4 and tuning made this less present. Far less present in 6.0.5-dev, but still randomly happens, just less so.

For some reason the payload field does not get added to the Eve alert JSON, even though though packet field is populoaded.

The rule that resulted in it is as below.

"rule": "alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:\"MALWARE-CNC User-Agent known malicious user-agent string - Mirai\"; flow:to_server,established; content:\"User-Agent|3A| Hello, world\"; fast_pattern:only; http_header; metadata:impact_flag red, policy balanced-ips drop, policy max-detect-ips drop, policy security-ips drop, service http; reference:url,www.virustotal.com/en/file/3908cc1d8001f926031fbe55ce104448dbc20c9795b7c3cfbd9abe7b789f899d/analysis/; classtype:trojan-activity; sid:58992; rev:1;)",

I've attached a anonymized PCAP of it.

The build info is as below.


This is Suricata version 6.0.5-dev (22c47396f 2022-04-05)
Features: PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Atomic intrinsics: 1 2 4 8 16 byte(s)
64-bits, Little-endian architecture
GCC version 6.3.0 20170516, C version 201112
compiled with -fstack-protector
compiled with _FORTIFY_SOURCE=2
L1 cache line size (CLS)=64
thread local storage method: _Thread_local
compiled with LibHTP v0.5.39, linked against LibHTP v0.5.39

Suricata Configuration:
  AF_PACKET support:                       yes
  eBPF support:                            no
  XDP support:                             no
  PF_RING support:                         no
  NFQueue support:                         no
  NFLOG support:                           no
  IPFW support:                            no
  Netmap support:                          no
  DAG enabled:                             no
  Napatech enabled:                        no
  WinDivert enabled:                       no

  Unix socket enabled:                     yes
  Detection enabled:                       yes

  Libmagic support:                        yes
  libnss support:                          yes
  libnspr support:                         yes
  libjansson support:                      yes
  hiredis support:                         no
  hiredis async with libevent:             no
  Prelude support:                         no
  PCRE jit:                                yes
  LUA support:                             no
  libluajit:                               no
  GeoIP2 support:                          no
  Non-bundled htp:                         no
  Hyperscan support:                       yes
  Libnet support:                          yes
  liblz4 support:                          yes
  HTTP2 decompression:                     no

  Rust support:                            yes
  Rust strict mode:                        no
  Rust compiler path:                      /usr/local/bin/rustc
  Rust compiler version:                   rustc 1.56.1 (59eed8a2a 2021-11-01)
  Cargo path:                              /usr/local/bin/cargo
  Cargo version:                           cargo 1.56.0 (4ed5d137b 2021-10-04)
  Cargo vendor:                            yes

  Python support:                          yes
  Python path:                             /usr/bin/python3
  Python distutils                         yes
  Python yaml                              no
  Install suricatactl:                     yes
  Install suricatasc:                      yes
  Install suricata-update:                 not bundled

  Profiling enabled:                       no
  Profiling locks enabled:                 no

  Plugin support (experimental):           yes

Development settings:
  Coccinelle / spatch:                     no
  Unit tests enabled:                      no
  Debug output enabled:                    no
  Debug validation enabled:                no

Generic build parameters:
  Installation prefix:                     /usr
  Configuration directory:                 /etc/suricata/
  Log directory:                           /var/log/suricata/

  --prefix                                 /usr
  --sysconfdir                             /etc
  --localstatedir                          /var
  --datarootdir                            /usr/share

  Host:                                    x86_64-pc-linux-gnu
  Compiler:                                gcc (exec name) / g++ (real)
  GCC Protect enabled:                     yes
  GCC march native enabled:                yes
  GCC Profile enabled:                     yes
  Position Independent Executable enabled: no
  CFLAGS                                   -g -O2 -std=c11 -pg -march=native -I${srcdir}/../rust/gen -I${srcdir}/../rust/dist
  PCAP_CFLAGS                               -I/usr/include
  SECCFLAGS                                -fstack-protector -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security
_mcleanup: gmon.out: Permission denied


If there is anything else that would be handy, please let me know!

Files

new-nopayload.pcap (6.67 KB) new-nopayload.pcap Zane B-H, 04/19/2022 03:01 PM

Related issues 2 (0 open2 closed)

Copied to Suricata - Bug #5300: eve: payload field randomly missing even if the packet field is presentClosedVictor JulienActions
Copied to Suricata - Bug #5301: eve: payload field randomly missing even if the packet field is presentClosedVictor JulienActions
Actions #1

Updated by Zane B-H over 2 years ago

  • Subject changed from the payload field in the Eve alert JSON is randomly missing even if payload is present to the payload field in the Eve alert JSON is randomly missing even if the packet is present

Derp. Just realized I put payload twice in the title. It is payload will be missing at times even if the packet field is present.

Actions #2

Updated by Zane B-H over 2 years ago

  • Subject changed from the payload field in the Eve alert JSON is randomly missing even if the packet is present to the payload field in the Eve alert JSON is randomly missing even if the packet field is present
Actions #3

Updated by Victor Julien over 2 years ago

  • Subject changed from the payload field in the Eve alert JSON is randomly missing even if the packet field is present to eve: payload field randomly missing even if the packet field is present
  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Victor Julien
  • Target version changed from TBD to 7.0.0-beta1
Actions #4

Updated by Victor Julien over 2 years ago

  • Status changed from Assigned to In Review
Actions #5

Updated by Victor Julien over 2 years ago

  • Label Needs backport to 5.0, Needs backport to 6.0 added
Actions #6

Updated by Victor Julien over 2 years ago

  • Status changed from In Review to Closed
Actions #7

Updated by Jeff Lucovsky over 2 years ago

  • Copied to Bug #5300: eve: payload field randomly missing even if the packet field is present added
Actions #8

Updated by Jeff Lucovsky over 2 years ago

  • Copied to Bug #5301: eve: payload field randomly missing even if the packet field is present added
Actions

Also available in: Atom PDF