@Jeff_Lucovsky - if we ping from source instance to target instance, and then running tcpdump -i interface on the target, then it is showing the icmp pings from source to target instance
If we try to ping source instance from command prompt, it is not capturing that traffic. we have configured the traffic mirror session from source to target, the source logs alone is not getting captured
@Jeff_Lucovsky - yaml file includes 18k lines. we don’t have access to download and share the yaml file. But we followed below command to install Suricata as mentioned in below url. We didn’t make any update to yaml file after installation
Become sudo
sudo -s
Install epel-release
amazon-linux-extras install -y epel
Install suricata
yum install -y suricata
Create the default suricata rules directory
mkdir /var/lib/suricata/rules
Add a rule to match all UDP traffic
echo ‘alert udp any any → any any (msg:“UDP traffic detected”; sid:200001; rev:1;)’ > /var/lib/suricata/rules/suricata.rules
we created 2 EC2 instances. 1 is source instance and 2 is target instance. we created traffic mirroring session between these two instances. Now we installed Suricata in the target instance. we tried pinging target instance ip address from command prompt (opened command prompt and given the command “ping target_ipaddress”. we can able to see those logs in fast.log. In the log it is hsowing the command prompt ip as the source ip, target instance ip as the destination ip. when we tried the same for checking source instance logs, ie., when we pinged source ip address from command prompt, those logs are not capturing in the fast.log, eventhough we configured the traffic mirror session correctly. we want assistance for what are the configuration changes that has to be done to capture the source instance logs also