Suricata can not detect sA scan

Help
1

This is the detailed content of the PCAP package

微信截图_20240313131347
微信截图_202403131313471300×346 178 KB

this is my rule
3
3885×100 39.2 KB

Why Suricata unable to detect sA scan

2

Please provide more details about your Suricata version, config and how you run it.
But I guess it’s related to the fact that the connection is from 192.168.161.129 and 192.168.161.130 so both IPs might be in your HOME_NET and thus excluded in your EXTERNAL_NET so that will never match at all.

3

thanks for your help

4

I still have a question
I ran Suricata with no rules,but the flow type data in eve.json shows that tcp_flags is 0.Is there any way to display the TCP flag.

微信截图_20240313131622
微信截图_20240313131622873×670 129 KB

here is my suricata.yaml
suricata.yaml (83.1 KB)

5

Can you provide a pcap with the example traffic?