# Conditional pcap-log fails to log packets for some alerts when using "pcap-file-continuous" flag **URL:** \ **Category:** Help\ **Tags:** suricata\ **Created:** [April 29, 2023, 6:09pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459 "2023-04-29T18:09:05Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Jackojack7](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jackojack7](https://forum.suricata.io/u/Jackojack7)\ **Post date:** [April 29, 2023, 6:09pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/1 "2023-04-29T18:09:05Z")
Hello, I am using the new feature “Conditional PCAP” on Suricata v.7.rc1 to log alert packets. I run Suricata with `pcap-log` enabled and `conditional` set to `alerts`. My Suricata instance is used only to process PCAPs with `pcap-file-continuous` enabled. After a few months of testing this feature, I encountered a disturbing problem. It seems that when I play PCAPs to Suricata with the `pcap-file-continuous` configuration enabled, Suricata fails to log the packets for some alerts. Scenarios I tested: - Run Suricata with the flag `-r ` → Play PCAPS → extract the packets from `pcap-log` based on `eve.json` (using [GopherCap](https://www.youtube.com/watch?v=f06SW5yaGLY)) → **Works fine!** - Run Suricata with the flag `-r ` and `--pcap-file-continuous` → Play the same PCAPS → extract the packets from `pcap-log` based on `eve.json` (using [GopherCap](https://www.youtube.com/watch?v=f06SW5yaGLY)) → **Failed** to extract the packets for some of the alerts. - Run Suricata with the flag `-r ` and `--pcap-file-continuous` → Play the same PCAPS → **stopped** Suricata → extract the packets from `pcap-log` based on `eve.json` (using [GopherCap](https://www.youtube.com/watch?v=f06SW5yaGLY)) → **Works fine!** Here are my `pcap-log` settings: > enabled: yes > filename: pcap.%n.%t > limit: 20mb > max-files: 5 > compression: none > mode: multi > dir: /var/log/suricata/pcap > use-stream-depth: no > honor-pass-rules: no > conditional: alerts and my `stream` configuration: > memcap: 64mb > checksum-validation: yes > inline: auto > reassembly: > memcap: 256mb > depth: 1mb # reassemble 1mb into a stream > toserver-chunk-size: 2560 > toclient-chunk-size: 2560 > randomize-chunk-size: yes Here is an example of signatures that Suricata usually fails to log packets for (given the PCAPs I played): > alert dns any any → $HOME\_NET any (msg:“ET DNS Reply Sinkhole - sinkhole.cert.pl 148.81.111.111”; content:“|00 01 00 01|”; content:“|00 04 94 51 6f 6f|”; distance:4; within:6; classtype:trojan-activity; sid:2016413; rev:5; metadata:created\_at 2013\_02\_15, former\_category DNS, updated\_at 2022\_07\_13;) > alert tls $EXTERNAL\_NET any → $HOME\_NET any (msg:“ET WEB\_CLIENT Possible eDellRoot Rogue Root CA”; flow:established,to\_client; tls.cert\_issuer; content:“CN=eDellRoot”; fast\_pattern; reference:url,[Dell does a Superfish, ships PCs with easily cloneable root certificates | Ars Technica](http://arstechnica.com/security/2015/11/dell-does-superfish-ships-pcs-with-self-signed-root-certificates/); classtype:trojan-activity; sid:2022134; rev:4; metadata:affected\_product Web\_Browsers, affected\_product Web\_Browser\_Plugins, attack\_target Client\_Endpoint, created\_at 2015\_11\_24, deployment Perimeter, signature\_severity Major, tag Web\_Client\_Attacks, updated\_at 2022\_03\_24;) Please, Can anyone help me figure out whether this is a bug or this is just a configuration issue? Thank you in advance! ---
**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\ **Post date:** [May 16, 2023, 2:09pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/2 "2023-05-16T14:09:49Z")
@Regit would you know ? ---
**Author:** ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)\ **Post date:** [May 16, 2023, 2:15pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/3 "2023-05-16T14:15:58Z")
Disclaimer, I do not know this `pcap-file-continuous` option and what it should do ---
**Author:** ![Eric\_Leblond](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/eric_leblond/32/2005_2.png) [@Eric\_Leblond](https://forum.suricata.io/u/Eric_Leblond)\ **Post date:** [May 17, 2023, 12:22pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/4 "2023-05-17T12:22:16Z")
This is really really strange. How many alerts are you missing ? Could you share an missed alert json (don’t need the IP information there) ? ---
**Author:** ![Jackojack7](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jackojack7](https://forum.suricata.io/u/Jackojack7)\ **Post date:** [May 29, 2023, 7:55am UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/5 "2023-05-29T07:55:36Z")
How many alerts? It depends. but a lot. for example, for a file which raises 72 alerts, 12 are missing PCAP log. Examples of missed alerts: > { > “timestamp”: “2023-03-21T14:35:36.996508+0000”, > “flow\_id”: 22837624374537, > “pcap\_cnt”: 12459, > “event\_type”: “alert”, > “src\_ip”: SRC\_IP, > “src\_port”: 33072, > “dest\_ip”: DST\_IP, > “dest\_port”: 80, > “proto”: “TCP”, > “pkt\_src”: “wire/pcap”, > “tx\_id”: 0, > “alert”: { > “action”: “allowed”, > “gid”: 1, > “signature\_id”: 900000, > “rev”: 1, > “signature”: “Detected Nmap’s User-Agent within an HTTP request”, > “category”: “29”, > “severity”: 2, > “rule”: “alert http any any → $HOME\_NET any (msg:"Detected Nmap’s User-Agent within an HTTP request"; flow:to\_server,established; http.user\_agent; content:"Nmap"; classtype:exploit-kit; sid:900000; rev:1;)” > }, > “app\_proto”: “http”, > “direction”: “to\_server”, > “flow”: { > “pkts\_toserver”: 4, > “pkts\_toclient”: 3, > “bytes\_toserver”: 483, > “bytes\_toclient”: 598, > “start”: “2023-03-21T14:35:36.922821+0000”, > “src\_ip”: SRC\_IP, > “dest\_ip”: DST\_IP, > “src\_port”: 33072, > “dest\_port”: 80 > }, > “capture\_file”: “/suricata\_log\_output//pcap.2.1679408622”, > “pcap\_filename”: “pcaps/attacks\_1.pcap” > }, another example: > { > “timestamp”: “2023-03-21T14:50:57.311032+0000”, > “flow\_id”: 491447565889281, > “pcap\_cnt”: 54618, > “event\_type”: “alert”, > “src\_ip”: SRC\_IP, > “src\_port”: 47426, > “dest\_ip”: DST\_IP, > “dest\_port”: 53, > “proto”: “UDP”, > “pkt\_src”: “wire/pcap”, > “tx\_id”: 0, > “alert”: { > “action”: “allowed”, > “gid”: 1, > “signature\_id”: 2022048, > “rev”: 3, > “signature”: “ET MALWARE Cryptowall .onion Proxy Domain”, > “category”: “36”, > “severity”: 1, > “metadata”: { > “created\_at”: [ > “2015\_11\_09” > ], > “updated\_at”: [ > “2020\_08\_18” > ] > }, > “rule”: “alert dns $HOME\_NET any → any any (msg:"ET MALWARE Cryptowall .onion Proxy Domain"; dns.query; content:"3wzn5p2yiumh7akj"; depth:16; nocase; reference:url,[CryptoWall 4.0 released with new Features such as Encrypted File Names](http://www.bleepingcomputer.com/news/security/cryptowall-4-0-released-with-new-features-such-as-encrypted-file-names); classtype:trojan-activity; sid:2022048; rev:3; metadata:created\_at 2015\_11\_09, updated\_at 2020\_08\_18;)” > }, > “app\_proto”: “dns”, > “direction”: “to\_server”, > “flow”: { > “pkts\_toserver”: 1, > “pkts\_toclient”: 0, > “bytes\_toserver”: 105, > “bytes\_toclient”: 0, > “start”: “2023-03-21T14:50:57.311032+0000”, > “src\_ip”: SRC\_IP, > “dest\_ip”: DST\_IP, > “src\_port”: 47426, > “dest\_port”: 53 > }, > “capture\_file”: “/suricata\_log\_output//pcap.2.1679408622”, > “pcap\_filename”: “pcaps/attacks\_1.pcap” > }, ---
**Author:** ![Jackojack7](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jackojack7](https://forum.suricata.io/u/Jackojack7)\ **Post date:** [June 11, 2023, 7:50am UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/6 "2023-06-11T07:50:03Z")
@Eric_Leblond you need more examples of the missed alerts? ---
**Author:** ![Jackojack7](https://avatars.discourse-cdn.com/v4/letter/j/e0b2c6/32.png) [@Jackojack7](https://forum.suricata.io/u/Jackojack7)\ **Post date:** [June 18, 2023, 1:54pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/7 "2023-06-18T13:54:26Z")
@Eric_Leblond Actually I can reproduce the bug by loading the following simple rule to Suricata: `alert tcp any any -> any any (msg:"tcp"; classtype:policy-violation; sid:1; rev:1;)` When I feed Suricata with a PCAP file containing a single TCP packet, I get an alert, but the packet is not written to the pcap log. ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [July 31, 2023, 8:35pm UTC](https://forum.suricata.io/t/conditional-pcap-log-fails-to-log-packets-for-some-alerts-when-using-pcap-file-continuous-flag/3459/8 "2023-07-31T20:35:06Z")
Can you provide that pcap as well?