Are Suricata Alerts reproducible on a per pcap basis

Help
1

Hello,

I am trying to test Suricata and have been getting a different number of alerts using the same pcap file even after restarting Suricata. I was wondering if this is expected behavior or not.

2

Hi,

what version of Suricata are you running? How does the config look like and how do you run it?
You could try runs with --runmode=single to ensure parallelization is not the issue

3

Right now I am running Suricata-7.0.0-rc1. I am running using the default configuration in the suricata.yaml file for af-packet and am using the following to invoke Suricata:

sudo suricata -c /etc/suricata/suricata.yaml --pidfile /var/run/suricata.pid --af-packet --runmode=single -vvvv

I added the runmode=single as you stated but it seems the number of alerts is still varying. I am replaying the PCAP given here:

Malware-Traffic-Analysis.net - 2022-01-07 - Traffic analysis exercise - Spoonwatch

To replay the packets I am sending traffic to Suricata via Pktgen on another machine.

4

Ah never mind. It appears replaying the traffic from another machine was the problem.

5

I have a follow up question and thought I should ask it in the same thread.

The same command is used as above, with a single worker, but the result when capturing on an interface have a high variance.

For example, I am replaying the same pcap file as shown above but the number of alerts are changing seemingly every time. The types of alerts are also varying a bit. When comparing the alerts from running Suricata in pcap mode to the alerts from running Suricata on an interface and capturing the replayed pcap; I am seeing different alerts or an absence of alerts that are supposed to be there.

I was wondering if this is expected behavior.

6

How do you run the replay from the pcap towards the interface?

7

I have one machine, running Pktgen, which is directly connected to the interface I am monitoring with suricata on another machine. I set the “count” or number of packets to replay on Pktgen to the number of packets in the pcap file.

8

Curiously enough, using TCPReplay produces the expected behavior. I think Pktgen is reordering the pcap or replaying it incorrectly