Open Information Security Foundation

05/24/2019

06:24 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Does anybody have any suggestions? Georgy Varlamov

05/17/2019

01:57 PM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> Suricata will declare a 'gap' when it sees that the receiving host has ACK'd data Suricata it... Georgy Varlamov

11:55 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> Yes, you need all bytes to calculate the md5sum, so loosing even a single byte puts it off. W... Georgy Varlamov

05/16/2019

09:33 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> So Suricata runs in IDS mode. This means that even if Suricata has packet loss, the original ... Georgy Varlamov

09:23 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> How are you running Suricata?
sudo /usr/local/bin/suricata -c /usr/local/etc/suricata/suri... Georgy Varlamov

07:37 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> This files includes multiple runs, but many of them report some packet loss. So it seems like... Georgy Varlamov

05/15/2019

11:39 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> Did you also preserve the suricata stats.log from the live run that captured the pcap? If so,... Georgy Varlamov

10:52 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> How did you capture the pcap? The pcap suggests packet loss on that flow.
It was done by *... Georgy Varlamov

06:57 AM Suricata Support #2981: "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Victor Julien wrote:
> The pcap shows that while a 50mb file is requested from the server, only about 1mb is receive... Georgy Varlamov

05/14/2019

02:53 PM Suricata Support #2981 (Closed): "state": “TRUNCATED” for large files (may be caused by CheckGap function)

Me and my team work on integrating threat intelligence hash feeds with Suricata 4.1.3 using rules “filemd5” option.
... Georgy Varlamov