<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:13px"><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr">I am using Suricata 3.2.</div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr">the Lua script:</div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr"><code></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9845">function init (args)</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9846"><br id="yui_3_16_0_ym19_1_1491208040965_9847"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9848"> local needs = {}</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9849"><br id="yui_3_16_0_ym19_1_1491208040965_9850"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9851"> needs["packet"] = tostring(true)</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9852"><br id="yui_3_16_0_ym19_1_1491208040965_9853"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9854"> needs["payload"] = tostring(true)</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9855"><br id="yui_3_16_0_ym19_1_1491208040965_9856"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9857"> return needs</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9858"><br id="yui_3_16_0_ym19_1_1491208040965_9859"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9860">end</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9861"><br id="yui_3_16_0_ym19_1_1491208040965_9862"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9863"><br id="yui_3_16_0_ym19_1_1491208040965_9864"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9865"><br id="yui_3_16_0_ym19_1_1491208040965_9866"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9867">function match(args)</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9936"><br id="yui_3_16_0_ym19_1_1491208040965_9937"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9938"> <span style="white-space:pre-wrap;" id="yui_3_16_0_ym19_1_1491208040965_9939"> </span>print("********************************")</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9952"><br id="yui_3_16_0_ym19_1_1491208040965_9953"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9954"> return 1</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9955"><br id="yui_3_16_0_ym19_1_1491208040965_9956"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9957">end</div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9958"><br id="yui_3_16_0_ym19_1_1491208040965_9959"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9960"><br id="yui_3_16_0_ym19_1_1491208040965_9961"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9962"><br id="yui_3_16_0_ym19_1_1491208040965_9963"></div><div dir="ltr" id="yui_3_16_0_ym19_1_1491208040965_9964">return 0</div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr"></code><br></div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr"><br></div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr">very simple one, and this is happening in every pcap I'm using, I just count the number of lines and see there is a difference.</div><div id="yui_3_16_0_ym19_1_1491208040965_4567" dir="ltr">By the way Suricata still telling at the end the right amount(as it says in wire-shark) but the number of lines are way off. </div></div></body></html>