ssh client ip : 173.246.103.108, src port : 40289 / dest ip : 192.168.100.108
I can see the ssh event to reflect the ssh connection
But I searched the event flow in the same time frame, but there’s NO flow event to show this connection.
root@ips:/var/log/suricata# suricata -V
This is Suricata version 5.0.1 RELEASE
suricate.yaml :
flow:
memcap: 2gb
hash-size: 65536
prealloc: 10000
emergency-recovery: 30
#managers: 1 # default to one flow manager
#recyclers: 1 # default to one flow recycler thread