<html><head><style>p{margin-top:0px;margin-bottom:0px;}</style></head><body><div style="font-size:10pt; font-family:Gulim;"><p> </p><p style="padding: 0px 0px 0px 10pt; font-family: sans-serif; font-size: 10pt;"><span>-----Original Message-----</span><br><b>From:</b> "Andreas Herz"<andi@geekosphere.org> <br><b>To:</b> <oisf-users@lists.openinfosecfoundation.org>; <br><b>Cc:</b> <br><b>Sent:</b> 2017-01-14 (토) 06:19:16<br><b>Subject:</b> Re: [Oisf-users] [Question] suricata test with pcap-file(After upgrading the suricata version(2.0.11 --> 3.2))<br> </p><p>On 12/01/17 at 10:48, 박경호 wrote:<br>> After upgrading the version from 2.0.11 to 3.2, I did the test again.<br>> Unfortunately, alert messages were different whenever the suricata was<br>> run with same a pcap-file.<br><br>Can you be more verbose about that?</p><p>==> i run the suricata like the following command : suricata -c suricata.yaml -r testpcap.pcap</p><p> ( i never changed the configure file(.yaml)).<br><br>> I didn't change the configure file(suricata.yaml) and pcap-file's size<br>> is 693MB. (pc memory is 8GB, cpu is intel i5-4460, os is Ubuntu<br>> 16.06)<br><br>Can you try to reproduce the issue with a smaller pcap file that you can<br>share with us?</p><p>==> After i try to reproduce with a smaller pcap file, i will share the result and pcap file.</p><p> <br>> please explain to me about this situation.<br><br>I still need more details about your suricata configuration, how do you<br>run suricata, what did you configure?<br><br>An easy way to reproduce that for us will help to find a solution (after<br>we found what's the real issue you have).<br><br>-- <br>Andreas Herz<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: <a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a><br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users </p></div></body></html>
<table style="display:none"><tr><td><img src="https://mail.naver.com/readReceipt/notify/?img=1PbdKokcpXglFrUXhAnXpxKwFA%2BCKqUlKxUlF4JSMquqKr3SM6urKrJotzFXp6UwKVl5WLl51zlqDBFdp6d5MreRhoRT1BF47BkqpBiqtzwGbX3q74emp6lGW4pTbrkop4e9W43C%2Bz0TWSlTb4b%3D.gif" border="0"></td></tr></table>