Are Suricata Alerts reproducible on a per pcap basis


I am trying to test Suricata and have been getting a different number of alerts using the same pcap file even after restarting Suricata. I was wondering if this is expected behavior or not.


what version of Suricata are you running? How does the config look like and how do you run it?
You could try runs with --runmode=single to ensure parallelization is not the issue

Right now I am running Suricata-7.0.0-rc1. I am running using the default configuration in the suricata.yaml file for af-packet and am using the following to invoke Suricata:

sudo suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/ --af-packet --runmode=single -vvvv

I added the runmode=single as you stated but it seems the number of alerts is still varying. I am replaying the PCAP given here: - 2022-01-07 - Traffic analysis exercise - Spoonwatch

To replay the packets I am sending traffic to Suricata via Pktgen on another machine.

Ah never mind. It appears replaying the traffic from another machine was the problem.

I have a follow up question and thought I should ask it in the same thread.

The same command is used as above, with a single worker, but the result when capturing on an interface have a high variance.

For example, I am replaying the same pcap file as shown above but the number of alerts are changing seemingly every time. The types of alerts are also varying a bit. When comparing the alerts from running Suricata in pcap mode to the alerts from running Suricata on an interface and capturing the replayed pcap; I am seeing different alerts or an absence of alerts that are supposed to be there.

I was wondering if this is expected behavior.

How do you run the replay from the pcap towards the interface?

I have one machine, running Pktgen, which is directly connected to the interface I am monitoring with suricata on another machine. I set the “count” or number of packets to replay on Pktgen to the number of packets in the pcap file.

Curiously enough, using TCPReplay produces the expected behavior. I think Pktgen is reordering the pcap or replaying it incorrectly