<!doctype html>
<html>
<head>
<meta charset="UTF-8">
</head>
<body>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
Hi There
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
You can actually use Suricata to create a pcap file,
<a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Suricatayaml</a>
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
May I ask as to what the aim of your exercise is?
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
Amar
<br>
</div>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;">
<br>
</div>
<blockquote type="cite">
On August 9, 2019 at 7:10 AM Duonas Kepals <duonas.kepals@inbox.lv> wrote:
<br>
<br>Hello everyone!
<br> This is my first message in this mailing list, I hope it's an OK question.
<br>
<br> I am trying to use suricata, and as I understand, I can pass a .pcap file to it, and some rules, and suricata then will tell if there are any packets matching any rules.
<br> For testing purposes, I would like to generate some packets from rules, and then feed those packets and rules to suricata. I expect that this would make every packet to match against some rules.
<br>
<br> I tried using sniffles tool to generate packets from rules, but sometimes it crashes, I suppose it is not updated and does not recognize some newer rule syntax, e.g. when there is "... http_header; ..." inside content it crashes; and many other cases. But there are also some rules that don't crash sniffles. But this is not ideal.
<br>
<br> I would like to know if there is any tool, maybe developed by suricata developers, or third party, which would generate packets in .pcap file, for further testing purposes.
<br>
<br> Sincerely,
<br> Duonas Kepals
<div class="ox-8607b7dbf5-eml-cke__signature" id="ox-8607b7dbf5-eml-cke__signature_top-wrap">
</div> _______________________________________________ Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/ List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users Conference: https://suricon.net Trainings: https://suricata-ids.org/training/
</blockquote>
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;" class="default-style">
<br>
</div>
<div class="io-ox-signature">
<div style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: #000080;" class="default-style">
<div>
Kind regards
<br>
<br>
</div>
<div>
Amar Rathore
<br>
</div>
<div>
Tel: +1 617 765 0633 -
<span style="color: #ff0000;">PLEASE NOTE CHANGED TELEPHONE NUMBER</span>
<br>Mobile: +91 8800 596506
</div>
<div>
<br>
</div>
</div>
</div>
</body>
</html>