Is there any way to tell from a flow event that a packet came from a GRE tunnel if there is no alert log?

Help
1

Hi,

I am looking into Suricata EVE logs and trying to understand whether it is possible to determine that a packet/flow originated from a GRE tunnel when there is no corresponding alert event.

In my case, alert events include fields such as pkt_src: "gre tunnel" and the tunnel object, so from the alert it is clear that the inner packet was carried inside GRE.

However, the related flow event only shows the inner 5-tuple and protocol, for example UDP source/destination IPs and ports, but it does not appear to contain pkt_src or tunnel metadata.

So my question is:

Is there any built-in way in Suricata to identify from a flow event alone that the traffic was decapsulated from GRE, if no alert was generated for that flow?

More specifically:

  • Can pkt_src or tunnel-related metadata be included in flow events?

  • Is there any EVE setting that exposes this information for flows?

  • Or is correlation with another event type the only option?

Thanks.

2

It’s not tracked in the flow, so we can’t output it. It could be added, feel free to open a feature ticket for it.

3

OK. Thanks for quick reply.