Tx_id in http flow

Help
1

Hi there,

I can’t find anywhere in suricata documentation how the tx_id value is being incremented, with regards to http flow.
Can anybody tell me how it actually works ?
Thanks very much in advance

Benoit

2

A transaction is a request response pair. Each gets it’s own id, starting at 0. So if the tx_id is 10, it means it’s the 11th (starting at 0) request response pair.

1 Like
3

Hi Victor,
Thank you for this answer which is crystal clear.
If multiple files are being transmitted within the same flow_id, is this tx_id being incremented for each of them ?

4

Usually, but not always. In case of a multipart body we may have multiple files in a single transaction (request/response pair).

1 Like
5

thanks again Victor for your reply