<html><head><style>p{margin-top:0px;margin-bottom:0px;}</style></head><body><div style="font-size:10pt; font-family:Gulim;"><p> </p><p>I try to use the suricata(version 3.2.0) to IDS mode to read and process multi-pcap files.</p><p>when i checked the alert messages in fast.log, same alert message were so many like below.</p><p>As i know, the suricata process the flow for the packets.</p><p>One message should be only alerted, in situation which it's transfered for packets with same tuple(source ip/port, destination ip/port, protocol) continuously.</p><p>But, it's different for testing result.</p><p>(test pcap : <a href="https://drive.google.com/file/d/0B4Mdb8bpuRlneS00bFoyWVZwMkk/view?usp=sharing">https://drive.google.com/file/d/0B4Mdb8bpuRlneS00bFoyWVZwMkk/view?usp=sharing</a> )</p><p>[suricata.yaml] for flow-timeout</p><p>tcp:</p><p style="margin-left: 20px;">new: 1800</p><p style="margin-left: 20px;">established: 15</p><p style="margin-left: 20px;">closed: 0</p><p style="margin-left: 20px;">bypassed: 100</p><p> </p><p>02/23/2017-15:22:53.000610 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:53.000635 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:53.000655 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:53.000755 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:54.000126 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:54.000496 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:54.000517 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:54.000553 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:54.000594 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:55.000443 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:55.000489 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:55.000999 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000054 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000393 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000563 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000627 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000658 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000684 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000702 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000731 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927<br>02/23/2017-15:22:56.000762 [**] [1:2101390:6] GPL SHELLCODE x86 inc ebx NOOP [**] [Classification: Executable code was detected] [Priority: 1] {TCP} 211.188.203.33:8012 -> 210.125.145.148:48927</p><p> </p><p> </p></div></body></html>
<table style="display:none"><tr><td><img src="https://mail.naver.com/readReceipt/notify/?img=1dbdKokcpXgqFAC4hAnXFxtZpok4pAM9M4kCpoi4Fxb%2FFqFopxC4Kri0MdIo%2BrkSKxu5W4d5W4C5bX0q%2BzkR74FTWx%2FsWr0qpS99brkZbdIn1BFdbZlTbzk516l4WXF0MrpT%2B6lvMB3GWr%2F5WXiN.gif" border="0"></td></tr></table>