<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><br>On Feb 15, 2012, at 10:07 AM, Victor Julien wrote:<br><br><blockquote type="cite">On 02/15/2012 06:42 AM, Nikolay Denev wrote:<br><blockquote type="cite">Hi,<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I'm wondering how suricata decides which packet to capture and dump in the unified2 log file and which not to.<br></blockquote><blockquote type="cite"><br></blockquote><blockquote type="cite">I'm running Snorby to collect the alerts, and I've noticed that sometimes for a single rule, some of the alerts have<br></blockquote><blockquote type="cite">the packet dump present and some not.<br></blockquote><br>That is odd. There should always be a packet. Is this happening with<br>specific rules and / or traffic?<br><br>-- <br>---------------------------------------------<br>Victor Julien<br><a href="http://www.inliniac.net/">http://www.inliniac.net/</a><br>PGP: http://www.inliniac.net/victorjulien.asc<br>---------------------------------------------<br><br>_______________________________________________<br>Oisf-users mailing list<br>Oisf-users@openinfosecfoundation.org<br>http://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br></blockquote><br>I've checked now. Some of the alerts without packet dump are packets with only headers and no payload, <br>for example syn packets from RBN listed IPs. Which should be normal. But I have also alert from this rule:<br><br>alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ETPRO TROJAN Win32/Chir.B@mm User-Agent (KPeerUpdater)"; flow:to_server,established; content:"User-Agent|3a| KPeerUpdater|0d 0a|"; http_header; reference:url,<a href="http://www.threatexpert.com/report.aspx?md5=5ca614132b183b2812cb69112879237f">www.threatexpert.com/report.aspx?md5=5ca614132b183b2812cb69112879237f</a>; reference:url,<a href="http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3AWin32%2FChir.B%40mm">www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3AWin32%2FChir.B%40mm</a>; classtype:trojan-activity; sid:2803871; rev:2;)<br><br>And in snorby I see no packet dump, and packet len is 40?<div><br></div><div><img id="586661a9-a20a-4096-9188-ce629e7426bb" height="546" width="989" apple-width="yes" apple-height="yes" src="cid:623B4B9A-C80E-4396-BCD0-33E3839417C3@moneybookers.net"><br><br>I can also look in the unified2.alert file to make sure it's not snorby problem. (if I can find some tool to check it :) )<br><br></div></body></html>