Some MAC addresses are missing in the HTTP logs

Help
1

Suricata version：7.0.2
Operating system and/or Linux distribution：centos7

I played back the http packets with “suricata - r” and found that some of the logs were missing mac addresses.

image
image1238×600 134 KB

I found during debugging that the code entered this section.Does anyone know what conditions will cause x not to be NULL? :sob:

pcap：http.pcap (2.7 KB)

2

Thanks for this report.

It looks like the feature (Mac address logging) is incomplete indeed

In your pcap, it looks like this code is reached at 2 places : when doing the upgrade from HTTP1 to HTTP2, and at timeout

jq 'select(.ether == null)' log/eve.json

3