IP in /var/log/suricata/fast.log does not change target

Help
1

Hello all, I have a problem with the /var/log/suricata/fast.log file, when I attack towards ip 192.168.9.10, namely the server, and in /var/log/suricata/fast.log the traffic is running but towards ip suricata 192.168.9.20 in the log, help me solve this so that the target ip is as intended.

thanks

image
image803×175 4 KB

2

Please provide more details about your setup, like suricata version, suricata.yaml, run command, which runmode you use and how you forward the traffic.

3

berikut terlampir file suricata.yaml, for traffic I use nat destination from ip server to ip suricata
suricata.yaml (83.9 KB)

4

You are still lacking details:

  1. Suricata version
  2. run command
  3. runmode being used
  4. add suricata.log
  5. Explain in more detail the traffic forwarding to suricata

Without a proper and verbose description, we won’t be able to help you

5

Suricata version 7.06
run command
image
suricata.log
image
I configured on the proxy, namely destinating packets heading to the server to suricata using nat, the packet can be detected by suricata, but the ip in the suricata log only shows the suricata ip, even though the ip attacked is the server ip.

6

So you do NAT before you forward the packets to the Suricata machine?
If you change the destination IP it would be obvious why the IP is different.
Ideally do a tcpdump run there as well and look into the content there to compare it and maybe provide the pcap.