[Oisf-users] about alerts and pcap-log

[fyshine at sina.cn]

I test some rules by the suricata, i find it's strange;My english is a little poor, please forgive me
rule       alert tcp any any -> any any ( msg:"test1", sid:100001; )should not alert every packet in this tcp flow, but the result is just two alerts   one is syn , other is syn ack, i am not find the reson
capture        i use nfq to capture packet;   suricata  runmode inline nfqueue;the packets counts and bytes in the two place is very different,  i understand tcp overlap, but why the bytes is different
pcap-log      i observe the flow use wireshark,there is no ethernet information ,just raw packet data, why is this 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190718/bf732ea5/attachment.html>