<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>The tcp alerts will only alert once per flow. So it will alert
on the first two packets of the three-way handshake, but not the
third as the flow has then been established and already alerted
on.</p>
<p>Can't answer your second question. <br>
</p>
<p>Re: pcap-log, that is as expected as its the packets processed by
suricata. If you want the frames off the wire, use wireshark. <br>
</p>
<p>-Coop<br>
</p>
<div class="moz-cite-prefix">On 7/17/2019 7:32 PM, <a class="moz-txt-link-abbreviated" href="mailto:fyshine@sina.cn">fyshine@sina.cn</a>
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:20190718023218.52FC146400A7@webmail.sinamail.sina.com.cn">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<div>I test some rules by the suricata, i find it's strange;</div>
<div>My english is a little poor, please forgive me</div>
<div><br>
</div>
<div>rule alert tcp any any -> any any ( msg:"test1",
sid:100001; )</div>
<div>should not alert every packet in this tcp flow, but the
result is just two alerts one is syn , other is syn ack, i am
not find the reson</div>
<div><br>
</div>
<div>capture i use nfq to capture packet; suricata
runmode inline nfqueue;</div>
<div>the packets counts and bytes in the two place is very
different, i understand tcp overlap, but why the bytes is
different</div>
<div><br>
</div>
<div>pcap-log i observe the flow use wireshark,there is no
ethernet information ,just raw packet data, why is this </div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<pre class="moz-quote-pre" wrap="">_______________________________________________
Suricata IDS Users mailing list: <a class="moz-txt-link-abbreviated" href="mailto:oisf-users@openinfosecfoundation.org">oisf-users@openinfosecfoundation.org</a>
Site: <a class="moz-txt-link-freetext" href="http://suricata-ids.org">http://suricata-ids.org</a> | Support: <a class="moz-txt-link-freetext" href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
List: <a class="moz-txt-link-freetext" href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
Conference: <a class="moz-txt-link-freetext" href="https://suricon.net">https://suricon.net</a>
Trainings: <a class="moz-txt-link-freetext" href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a></pre>
</blockquote>
<pre class="moz-signature" cols="72">--
Cooper Nelson
Network Security Analyst
UCSD ITS Security Team
<a class="moz-txt-link-abbreviated" href="mailto:cnelson@ucsd.edu">cnelson@ucsd.edu</a> x41042</pre>
</body>
</html>