Alert Payload Questions

Is there a way to control where the payload/payload_printable begins for an alert in eve.json?

Is the payload/payload_printable supposed to begin at the start of the TCP stream?

I thought that was the case but I recently ran into a situation where the payload_printable in eve.json began at packet 83 of a 166 packet session and DID NOT include the content that triggered the alert.

More generally, I’m asking because I want the payload to include the content that triggers an alert. This has proven difficult for large SMTP sessions like the one mentioned above (131k in this case).

Note that you can include the packet that triggered the alert or the payload. I don’t think there’s a way to indicate what range of the payload is printed. The packet may be what you’re after?

Yes packet may be what I’m after. I’m running some tests with it now. Based on my reading I had convinced myself that packet only includes headers and no payload. I see now that is not the case. Thank you for the response.