<html><head><style>p{margin-top:0px;margin-bottom:0px;}</style></head><body><div style="font-size:10pt; font-family:Gulim;"><p>I did the test to use two smaller pcap files. one is 111MB and another is 66MB.</p><p>when i run the suricata twice with 111MB pcap file, the alert messages are different. </p><p>But when i run the suricata twice with 66MB pcap file, the alert messagte is same.</p><p>I merged the two pcap files(45MB, 66MB) to one pcap file(111MB) using wire-shark.</p><p> </p><p>Is the this issue computing resources?(specially ram memory issue?)</p><p> </p><p>Can you recommend me how much memory i need in the following situation?</p><p>when i check some pcap files which the size is more than 1GB with suricata, how much memory do i need? </p><p> </p><p>And,</p><p>If I add the memory in my computer, which parts are changed in configuration file(suricata.yaml)?</p><p> </p><p> </p><p style="padding: 0px 0px 0px 10pt; font-family: sans-serif; font-size: 10pt;"><span>-----Original Message-----</span><br><b>From:</b> "박경호"<pgh5247@naver.com> <br><b>To:</b> "Andreas Herz"<andi@geekosphere.org>; <oisf-users@lists.openinfosecfoundation.org>; <br><b>Cc:</b> <br><b>Sent:</b> 2017-01-16 (월) 16:17:33<br><b>Subject:</b> Re: [Oisf-users] [Question] suricata test with pcap-file(After upgrading the suricata version(2.0.11 --> 3.2))<br> </p><!-- --><div style="font-family: Gulim; font-size: 10pt;"><p> </p><p style="padding: 0px 0px 0px 10pt; font-family: sans-serif; font-size: 10pt;"><span>-----Original Message-----</span><br><b>From:</b> "Andreas Herz"<andi@geekosphere.org> <br><b>To:</b> <oisf-users@lists.openinfosecfoundation.org>; <br><b>Cc:</b> <br><b>Sent:</b> 2017-01-14 (토) 06:19:16<br><b>Subject:</b> Re: [Oisf-users] [Question] suricata test with pcap-file(After upgrading the suricata version(2.0.11 --> 3.2))<br> </p><p>On 12/01/17 at 10:48, 박경호 wrote:<br>> After upgrading the version from 2.0.11 to 3.2, I did the test again.<br>> Unfortunately, alert messages were different whenever the suricata was<br>> run with same a pcap-file.<br><br>Can you be more verbose about that?</p><p>==> i run the suricata like the following command : suricata -c suricata.yaml -r testpcap.pcap</p><p> ( i never changed the configure file(.yaml)).<br><br>> I didn't change the configure file(suricata.yaml) and pcap-file's size<br>> is 693MB. (pc memory is 8GB, cpu is intel i5-4460, os is Ubuntu<br>> 16.06)<br><br>Can you try to reproduce the issue with a smaller pcap file that you can<br>share with us?</p><p>==> After i try to reproduce with a smaller pcap file, i will share the result and pcap file.</p><p> <br>> please explain to me about this situation.<br><br>I still need more details about your suricata configuration, how do you<br>run suricata, what did you configure?<br><br>An easy way to reproduce that for us will help to find a solution (after<br>we found what's the real issue you have).<br><br>-- <br>Andreas Herz<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: <a href="http://suricata-ids.org" target="_blank">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/" target="_blank">http://suricata-ids.org/support/</a><br>List: <a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a> </p></div>
</div></body></html>
<table style="display:none"><tr><td><img src="https://mail.naver.com/readReceipt/notify/?img=1QndKokcpXISFo2%2FhAnXF6K%2FM4UrMx2wa6F4FovlpziCMoJSF4MqK4J0MdIo%2BrkSKot5W4d5W4C5bX0q%2BzkR74FTWx%2FsWr0qpS99brkZbdIn1BFdbZlTbzk516l4WXF0MrpT%2B6lvMB3GWr%2F5WXiN.gif" border="0"></td></tr></table>