Surcata5.0.2 When rules match，log file have no information

Help
1

I test a rule ：alert tcp any any -> any any (msg:“Test”;content:“123456789”;sid:85304356;rev:8;)
I use scapy send a packet：sport=48000，dport=48017，data=“123456789”
but I have not find a alert in eve-log.json
I only find :{“timestamp”:“2020-04-23T15:25:55.000993+0800”,“flow_id”:1902632979721996,“in_iface”:“ens33”,“event_type”:“flow”,“src_ip”:“192.168.0.27”,“src_port”:48000,“dest_ip”:“192.168.0.120”,“dest_port”:48017,“proto”:“UDP”,“app_proto”:“failed”,“flow”:{“pkts_toserver”:1,“pkts_toclient”:0,“bytes_toserver”:60,“bytes_toclient”:0,“start”:“2020-04-23T15:25:24.716556+0800”,“end”:“2020-04-23T15:25:24.716556+0800”,“age”:0,“state”:“new”,“reason”:“timeout”,“alerted”:false}}

alerted:false reason:timeout ?
why have not alert event_type ?could you help ?

2

Hi @liqingjia!
Could the proto: UDP in the logs be an indicator of something? You’re telling Suricata to alert on TCP packets. Are you defining protocol as TCP for the packet that you are sending using Scapy?

3

I forget this.
I change UDP to TCP and I find an alert event_type.
Thank you. :smiley:

1 Like