<html><head><style>p{margin-top:0px;margin-bottom:0px;}</style></head><body><div style="font-size:10pt; font-family:Gulim,sans-serif;"><p>Hello all,</p><p> </p><p>Until now,</p><p>i know to the timestamp in alert log(fast.log or eve.json) is same to the packet timestamp.</p><p>But both timestamps are different.</p><p>To be precise, both timestamps are same in some alert message and are different in some alert message.</p><p>in my test, they were same in alert message "ET POLICY Dropbox Client Broadcasting..." </p><p> they were different in "ET POLICY PE EXE or DLL Windows file download HTTP..."</p><p> </p><p>Doesn't mean the timestamp in the packet for the timestamp in alert log file ?</p><p> </p><p>If you want to pcap file to test, you can download the pcap file.(<a href="https://drive.google.com/open?id=0B4Mdb8bpuRlnU0pkZ002WWVFdFk">https://drive.google.com/open?id=0B4Mdb8bpuRlnU0pkZ002WWVFdFk</a><strong>)</strong></p><p> </p><p>please explain to me..</p><p> </p><p>thanks in advance.</p><p> </p></div></body></html><table style='display:none'><tr><td><img src="https://mail.naver.com/readReceipt/notify/?img=1XndKokcpXgwM4iohAnXpxKlax30Fr3Ca63CMok4FotqKoFoKrU9aztmtzFXp6UmaLl5WLl51zlqDBFdp6d5MreRhoRT1BF47BkqpBiqtzwGbX3q74emp6lGW4pTbrkop4e9W43C%2Bz0TWSlTb4b%3D.gif" border="0"/></td></tr></table>