Suricate Flow event doesn't display ongoing ssh session

Help
1

ssh client ip : 173.246.103.108, src port : 40289 / dest ip : 192.168.100.108
I can see the ssh event to reflect the ssh connection

image
image1224×640 112 KB

But I searched the event flow in the same time frame, but there’s NO flow event to show this connection.

image
image2964×700 242 KB 

root@ips:/var/log/suricata# suricata -V
This is Suricata version 5.0.1 RELEASE

suricate.yaml :
flow:
memcap: 2gb
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
#managers: 1 # default to one flow manager
#recyclers: 1 # default to one flow recycler thread

2

Hi @gent79reid!
Are you not seeing any flow events at all? Could you please check the “flow” setting under “outputs -> eve-log -> types” in your suricata.yaml if flow is listed just to be sure? It should have:

outputs:
  - eve-log:
    enabled: yes
    # other things
    types:
      - flow
3

Yes, I can see other flows and “-flow” option is enabled in my config. What I want to get is to display the current active(new, established) flows and their app_proto, then I can put them in a time chart to present the trend of the application activity in my network. Any suggestion of how to do it ? very appreciate !
I also tried to search the flow_id from event ssh in event flow, got nothing matched.

How often suricata generates a flow event ? possible to adjust the interval ?

5

Suricata only logs a flow when it considers the flow finished or timed out. There has been some discussion about making it dump flows on some interval, but we haven’t decided is it is worth the effort for us.

There is a ticket here: Feature #2301: netflow: dump records at interval - Suricata - Open Information Security Foundation

6

Thanks Victor !

Do you any suggestions to collect active flows in current version ?

Other question : While my http download session is still active, the flow event indicates it’s “shutdown”. Any doc to explain the details of how does suricata figure out of the reason of “close”, “forced” and “shutdown” ?

image
image800×1030 151 KB

7

reason: shutdown means that the flow is evicted because the engine is shutting down. So it seems you’ve stopped Suricata to get this log?