Bug #8247
openSuricata 8.x does not show GRE tunnel source/destination in flow/alert logs
Description
If you play this pcap that utilizes GRE encapsulated traffic (attached), you can see we get the following log:
```
{
"timestamp": "2023-10-03T13:44:01.870735+0000",
"flow_id": 362080176641266,
"event_type": "flow",
"src_ip": "10.0.0.1",
"dest_ip": "10.0.0.2",
"ip_v": 4,
"proto": "ICMP",
"icmp_type": 8,
"icmp_code": 0,
"response_icmp_type": 0,
"response_icmp_code": 0,
"flow": {
"pkts_toserver": 5,
"pkts_toclient": 5,
"bytes_toserver": 420,
"bytes_toclient": 420,
"start": "2023-10-03T13:44:01.870735+0000",
"end": "2023-10-03T13:44:05.878563+0000",
"age": 4,
"state": "established",
"reason": "shutdown",
"alerted": false
}
}
```
We can see that the inner packet details are shown, but there is no details about the outer layer.
It seems that this was supposed to be fixed per this redmine long ago - https://redmine.openinfosecfoundation.org/issues/2011, but the test we just did on a suricata 8.0.3 fresh build shows that it is still not showing the outer layer.
Files
PA Updated by Philippe Antoine 16 days ago
- Status changed from New to Triaged
- Assignee set to OISF Dev
- Target version changed from TBD to 9.0.0-beta1
OT Updated by OISF Ticketbot 16 days ago
- Subtask #8771 added
OT Updated by OISF Ticketbot 16 days ago
- Label deleted (
Needs backport to 8.0)