[Oisf-devel] Suricata's Limitation?

[Peter Manev]

On 30 jul 2013, at 15:47, Prabhakaran Kasinathan <prabhakaran1989 at gmail.com> wrote:

> Hi everyone, 
> 
> Let's consider that we have a pcap file with 50 matches of ICMP_SEQ: $number$ using wireshark. 
> 
> When we use suricata using the same pcap to match ICMP_SEQ:$number$ ( in a rule), it produces sometimes different, but little less than or equal to the actual 50 matches. 
> 
> I mean for the first time it triggers 45 alerts, and different next time. It misses some matches! This pattern can be reproduced in different cases such as threshold rule, etc. Each time with the same rule and same pcap, I get different match or sometime same number of match. 

What if you try to lower the inspection chunk size in suricata.yaml(also disable chksum checking and use "--runmode=single") ?



> 
> Is this a limitation of all NIDSs? 
> --
> Best Regards,
> Prabhakaran Kasinathan
> _______________________________________________
> Suricata IDS Devel mailing list: oisf-devel at openinfosecfoundation.org
> Site: http://suricata-ids.org | Participate: http://suricata-ids.org/participate/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
> Redmine: https://redmine.openinfosecfoundation.org/