<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;">Hi, Herz. </p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;">Thank you for the reply. </p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;">As shown in the picture blow, there are ports.</p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><img src="cid:20190909_095637320_43009.jpeg" style="width: 1200px; height: 611px;"></p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </span></p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;">Where did you find the ports are missing?</span></p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;">Thank you very much</span></p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><br></span></p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;">Chi Kang</p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><span style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"><br></span></p><!-- $+[SIGN]+$ --><blockquote style="border-left: #000 2px solid;padding:0 0 0 5px;margin-left:5px;"><div style="line-height: 18px; font-size: 9pt; font-family: 돋움; margin-top: 0px; margin-bottom: 0px;">-----------------------원본 메세지-----------------------<br>보낸사람: "Andreas Herz "<aherz@oisf.net><br>받는사람: oisf-users@lists.openinfosecfoundation.org<br>보낸시간: 2019-09-07 04:51:46 GMT +0900 (ROK)<br>제목: Re: [Oisf-users] Question about src_port and dest_port in eve log</div><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>
On 06/09/19 at 15:15, "강지환" wrote:
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>> I have faced a very strange thing which is that both src_port and dest_port are 0.
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>Well if you look into the pcap in wireshark you see that the port
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>information is missing. The IP part says Proto UDP but the UDP ports are
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>not included.
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>--
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>Andreas Herz
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>_______________________________________________
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>Site:
<a href="http://suricata-ids.org">http://suricata-ids.org</a> | Support:
<a href="http://suricata-ids.org/support/">http://suricata-ids.org/support/</a>
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>List:
<a href="https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users">https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users</a>
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>Conference:
<a href="https://suricon.net">https://suricon.net</a>
<p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>Trainings:
<a href="https://suricata-ids.org/training/">https://suricata-ids.org/training/</a>
</blockquote><p style="font-family: 돋움; font-size: 10pt; line-height: 20px; margin-top: 0px; margin-bottom: 0px;"> </p>
<img id='mailexp' width=0 heigh=0 border=0 src='https://ezwebmail.bizmeka.com/receipt/notification.do?ukey=5d75a5ce3feef41e44abb00b&userid=kangjh0101&mhost=pizzlysoft.com'>