# Some MAC addresses are missing in the HTTP logs

**URL:** https://forum.suricata.io/t/some-mac-addresses-are-missing-in-the-http-logs/5389
**Category:** Help
**Tags:** suricata
**Created:** [February 19, 2025, 12:32am UTC](https://forum.suricata.io/t/some-mac-addresses-are-missing-in-the-http-logs/5389 "2025-02-19T00:32:55Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Naishuang](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/naishuang/32/2901_2.png) [@Naishuang](https://forum.suricata.io/u/Naishuang)
#### Post date: [February 19, 2025, 12:32am UTC](https://forum.suricata.io/t/some-mac-addresses-are-missing-in-the-http-logs/5389/1 "2025-02-19T00:32:55Z")

</div>

Suricata version：7.0.2  
Operating system and/or Linux distribution：centos7

I played back the http packets with “suricata - r” and found that some of the logs were missing mac addresses.

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/f/f97b2e86f7658dd81b6f45e25f1a240a185cd358.png)  
I found during debugging that the code entered this section.Does anyone know what conditions will cause x not to be NULL? 😭

pcap：[http.pcap](https://forum.suricata.io/uploads/short-url/vafoyT3rLGO4UvklZf5TamLqyMx.pcap) (2.7 KB)

---

<div class="post-metadata">

### Author: ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)
#### Post date: [February 25, 2025, 7:51am UTC](https://forum.suricata.io/t/some-mac-addresses-are-missing-in-the-http-logs/5389/2 "2025-02-25T07:51:14Z")

</div>

Thanks for this report.

It looks like the feature (Mac address logging) is incomplete indeed

In your pcap, it looks like this code is reached at 2 places : when doing the upgrade from HTTP1 to HTTP2, and at timeout

`jq 'select(.ether == null)' log/eve.json`

---

<div class="post-metadata">

### Author: ![Philippe\_Antoine](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/philippe_antoine/32/799_2.png) [@Philippe\_Antoine](https://forum.suricata.io/u/Philippe_Antoine)
#### Post date: [February 25, 2025, 7:53am UTC](https://forum.suricata.io/t/some-mac-addresses-are-missing-in-the-http-logs/5389/3 "2025-02-25T07:53:26Z")

</div>

> **[Bug #7569: logging: Mac addresses are not logged for pkt\_src detect/log or...](https://redmine.openinfosecfoundation.org/issues/7569)**
>
> Redmine