Hi all, I have encountered something strange and cannot pinpoint the issue. I hope you can help me in the right direction.
Suricata is running on a Debian VM on an ESXI host. The VM is connected to a SPAN port and receives data via VLAN 0 / untagged (response) and VLAN 1 (request) on 1 interface. When using Wireshark I see data on both VLANS. However, Suricata only logs data for VLAN 1.
For debugging purposes I created a pcap file via tshark for vlan 0. When I parse this pcap file with Suricata I am not getting any output (in eve.json). I noticed in the stats that the TCP flow count has a high number, however, the app layer flow counts stays 0 (for example for HTTP). While the PCAP file contains HTTP flows (verified in Wireshark).
Any ideas why Suricata does not detect (HTTP) flows? I also verified the suricate configuration by downloading a pcap example file from the Internet. Then I am getting output in the eve.json file.