Some questions about mqtt

Suricata.yaml file has been configured: start mqtt protocol parsing and mqtt protocol log.



Find a pcap package of mqtt, write a test rule, hit it and generate an alarm.

However, when checking eve.json, I find that there are no mqtt events. Why? Obviously, the mqtt configuration has been configured and an alarm has been generated. We also found some rule fields about mqtt, such as mqtt.protocol_version, mqtt.type and other fields can not make the written rules hit. Please refer to the instructions on the official website. After many tests, no alarm can be generated. If these fields are used.
mqtt1.pcap (1.8 KB)

Hi, first of all please don’t post ET Pro rules publicly, they’re not for free. I removed the picture from your post. You can repost your dedicated rule again.

1 Like

Hi,
Your pcap file is missing the connection setup so add

stream:
  midstream: true

You’ll see the mqtt event types in the log once you enable this config option.

2 Likes