Project

General

Profile

Actions
Copy link

Support #5370

closed
KS OD

The problem of Suricata reading Wireshark's pcap package

Support #5370: The problem of Suricata reading Wireshark's pcap package

Added by kk4l sc over 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
OISF Dev
Affected Versions:
6.0.6
Label:
Beginner

Description

Hello, I'm learning IDs. I wrote a Suricata rule. I used Wireshark and tcpdump to export two pcap packages and read them with the - R parameter. The result is that only the pcap package of tcpdump can be matched.

https://s1.ax1x.com/2022/05/21/OjmOF1.png

Files

OjmOF1.png (224 KB) OjmOF1.png kk4l sc, 05/21/2022 05:55 AM
Actions
Copy link

Also available in: PDF Atom