How to create ICMP alerts per packet

Rules
1

Hi,
I am trying to use simple test rule:
alert ip any any → any any (msg:”ICMP Ping”, ip_proto: icmp; sid: 1000001;)
for logging icmp packets

But suricata create only 2 alerts such as
ICMP Ping 192.168.0.117 → 192.168.0.114
ICMP Ping 192.168.0.114 → 192.168.0.117

I need more alerts if ping will continue or restart, but suricata don’t create them for several minutes

How to fix it?
Thanks for help

2

The rule is considered an “ip only” rule which is matched only once per flow, and the icmp echo/echo reply is tracked as a flow.

You can add a condition to the rule to make it a per packet rule (e.g. dsize:>0; or icode:8;), then it should alert per packet.