Netflow "event.original" is different


I enabled netflow logging in me eve.json file. What i noticed is that some of the logs do not include the vlan and app_proto information. For example:



Despite being both http events (destination port is 80) only one of the entries indicates the app_proto and vlan information. Why is this happening?

Vlan information is included in the netflow record when the frame arrives with vlan tags.

The vlan decoder (src/decode-vlan.c) maintains statistics for vlan and for vlan-in-vlan.

Can you correlate those values with the logging that you’re observing?

Are you able to construct a small pcap that demonstrates the issue?

If you have the source code handy, you’ll see The vlan handling code inside CreateEveHeaderFromNetFlow

/* vlan */
if (f->vlan_idx > 0) {

Thanks for your reply.

And what about the app_proto information?

What Suricata version are you using?

The suricata version is 6.0.4

What worries me the most is that without the app_proto information i cant identify the type of protocol of a given event

Do you have other examples? The one you listed shows the 3-way handshake at the beginning of the TCP setup has not yet completed. Thus, there’s no app proto