Hi
I am using this pcap
https://www.malware-traffic-analysis.net/2021/07/14/
I am downloading GitHub - scottfgjordan/suricata at pcap-conditional-v2.2.13
as zip . because git clone not works it downloads suricata 6.0.4
I configure and make suricata
In suricata.yaml , I am setting -pcap-log : enabled to yes and conditional : alerts
it generate a pcap
But see difference
origincal pcap http in wire shark (attached pic)
Now see in log.pcap formed
There more packets than original and Info section doesn’t contain information which was present in original
also in previous version of pcap-conditional v2.2 , packet number were same as original but this Info section of wireshark was truncated.
I want it to be same as original pcap for all alert packets
This function is from Suricata 7.0.0-dev
Thanks