<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Message: 4<br>
Date: Tue, 30 Jul 2013 16:26:03 +0100<br>
From: Peter Manev <<a href="mailto:petermanev@gmail.com">petermanev@gmail.com</a>><br>
To: Prabhakaran Kasinathan <<a href="mailto:prabhakaran1989@gmail.com">prabhakaran1989@gmail.com</a>><br>
Cc: suricata Mail List <<a href="mailto:oisf-devel@openinfosecfoundation.org">oisf-devel@openinfosecfoundation.org</a>><br>
Subject: Re: [Oisf-devel] Suricata's Limitation?<br>
Message-ID: <<a href="mailto:C89727F7-CA05-42CC-AD59-E8AB2313D316@gmail.com">C89727F7-CA05-42CC-AD59-E8AB2313D316@gmail.com</a>><br>
Content-Type: text/plain; charset=us-ascii<br>
<br>
<br>
<br>
On 30 jul 2013, at 15:47, Prabhakaran Kasinathan <<a href="mailto:prabhakaran1989@gmail.com">prabhakaran1989@gmail.com</a>> wrote:<br>
<br>
> Hi everyone,<br>
><br>
> Let's consider that we have a pcap file with 50 matches of ICMP_SEQ: $number$ using wireshark.<br>
><br>
> When we use suricata using the same pcap to match ICMP_SEQ:$number$ ( in a rule), it produces sometimes different, but little less than or equal to the actual 50 matches.<br>
><br>
> I mean for the first time it triggers 45 alerts, and different next time. It misses some matches! This pattern can be reproduced in different cases such as threshold rule, etc. Each time with the same rule and same pcap, I get different match or sometime same number of match.<br>
<br>
What if you try to lower the inspection chunk size in suricata.yaml(also disable chksum checking and use "--runmode=single") ?<br>
<br>
<br></blockquote><div> </div><div>It worked! "--runmode single", I tried to run the matching several times and presented the results below</div><div><br></div><div>Conditions: </div><div>Runmode = Normal </div>
<div><br></div><div><div>Wireshark: 46 Displayed ( matched)</div><div>Suricata attempts : matches</div><div><ol><li>43</li><li>44</li><li>43</li><li>45</li><li>43</li></ol></div></div><div>Runmode= single</div><div>$$# sudo ./src/.libs/suricata -c suricata.yaml -r test00.pcapng --runmode single<br>
</div><div>Wireshark: 46 Displayed ( matched)<br></div><div><div><ol><li>46</li><li>46</li><li>46 </li><li>...working!!</li></ol></div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
><br>
> Is this a limitation of all NIDSs?<br>
> --<br>
> Best Regards,<br>
> Prabhakaran Kasinathan<br></blockquote><div> </div>On Wed, Jul 31, 2013 at 3:12 PM, Anoop Saldanha <span dir="ltr"><<a href="mailto:anoopsaldanha@gmail.com" target="_blank">anoopsaldanha@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div>On Wed, Jul 31, 2013 at 6:26 PM, Prabhakaran Kasinathan<br>
<<a href="mailto:prabhakaran1989@gmail.com" target="_blank">prabhakaran1989@gmail.com</a>> wrote:<br>> On 07/30/2013 04:47 PM, Prabhakaran Kasinathan wrote:<br>>><br>>> > Hi everyone,<br>>> ><br>
>> > Let's consider that we have a pcap file with 50 matches of ICMP_SEQ:<br>>> > $number$ using wireshark.<br>>> ><br>>> > When we use suricata using the same pcap to match ICMP_SEQ:$number$ ( in<br>
>> > a rule), it produces sometimes different, but little less than or equal<br>>> > to the actual 50 matches.<br>>> ><br>>> > I mean for the first time it triggers 45 alerts, and different next<br>
>> > time. It misses some matches! This pattern can be reproduced in<br>>> > different cases such as threshold rule, etc. Each time with the same<br>>> > rule and same pcap, I get different match or sometime same number of<br>
>> > match.<br>>><br>>> How are you starting Suricata? I get predicable results every time.<br>>><br>> I found that, when the pcap size is less, Suricata predicts the exact<br>> numbers.But, if the pcap is little larger, it has an impact in the accuracy.<br>
><br>> After make, I start suricata like this..<br>> sudo ./src/.libs/suricata -c suricata.yaml -r test00.pcapng<br>><br><br></div>My reply from the other mail -<br><br>"Do you see it with non threshold/event rules as well? If it is with<br>
threshold/event rules it is possible to get different alerts based on<br>timing."<br><div><br></div></blockquote><div>yes! for Non-Threshold/events also it gives different number of alerts! But as described above, if I run suricata in "single" runmode, i.e. Single threaded! It gives predictable results. </div>
<div><br></div><div>Thank you!. What could be the fix for this problem ?? </div><div>--</div><div>Best Regards,</div><div>Prabha.</div></div></div></div>