Project

General

Profile

Actions
Copy link

Support #5370

closed
KS OD

The problem of Suricata reading Wireshark's pcap package

Support #5370: The problem of Suricata reading Wireshark's pcap package

Added by kk4l sc over 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
OISF Dev
Affected Versions:
6.0.6
Label:
Beginner

Description

Hello, I'm learning IDs. I wrote a Suricata rule. I used Wireshark and tcpdump to export two pcap packages and read them with the - R parameter. The result is that only the pcap package of tcpdump can be matched.

https://s1.ax1x.com/2022/05/21/OjmOF1.png

Files

OjmOF1.png (224 KB) OjmOF1.png kk4l sc, 05/21/2022 05:55 AM

VJ Updated by Victor Julien about 4 years ago Actions
Copy link
 #1

Are you able to share the pcaps?

PA Updated by Philippe Antoine over 3 years ago Actions
Copy link
 #2

  • Status changed from New to Closed

I guess Suricata relies on your libpcap to read the pcap files, so you should use pcap files that are supported by your libpcap library (and Wireshark may use different formats such as pcap-ng that are not supported by libpcap/tcpdump)

Actions
Copy link

Also available in: PDF Atom