<html><body><div id="edo-message"><div></div>Hi Frank</div><div id="edo-message">Its probably to do with your switch configuration. You will have to plug Suricata into a Span/mirror Port and make sure you Span all other traffic to that port. </div><div id="edo-message">Alternatively, if your network is small, you could find yourself an old hub!</div><div id="edo-message"><br></div><div id="edo-message">Amar Rathore</div><div id="edo-message">www.countersnipe.com </div><div id="edo-meta"></div><div id="edo-original"><div><br><br><blockquote type="cite" style="margin:1ex 0 0 0;border-left:1px #ccc solid;padding-left:0.5ex;"><div>On Sep 23, 2019 at 11:03 AM, <<a href="mailto:tranletuanngoc@gmail.com">Tuấn Ngọc Trần Lê</a>> wrote:<br><br></div><div><div dir="ltr">Hello,<div>I wrote a rule for Suricata to detect ICMP connection and have it loaded.</div><div>alert icmp $HOME_NET any -> $HOME_NET any (msg:"ICMP connection attempt"; sid:1000002; rev:1;)<br></div><div><br></div><div>It works fine when I try to ping from a computer in the network
(A)
to the one running Suricata (B).</div><div>However, when I ping from (A) to another computer (C), (B) doesn't detect and alert.</div><div>(A), (B) and (C) are being connected to a switch.</div><div><br></div><div>Please help me.</div><div><br></div><div>Thank you,</div><div>Ngoc Tran (Frank)</div></div>
</div></blockquote></div></div></body></html>