When Suricata is configured with pcap-log to save packets that trigger alerts, only the HTTP request packet is recorded immediately. The corresponding response packet, however, will only be written into the saved pcap file when a subsequent alert occurs in that flow. How can this be resolved?
My Configuration：
- pcap-log:
enabled: yes
filename: pcaps/log-%t-%n.pcap
limit: 10mb
max-files: 100
compression: none
mode: multi
use-stream-depth: no
honor-pass-rules: no
conditional: alerts
When an alert is triggered, only the request packet is captured—there is no corresponding response packet.
The response packet from the previous alert is only written into the pcap file when another alert is triggered.
My use case requires extracting the pcap traffic for each alert individually. However, the issue described above prevents me from doing so. I sincerely hope someone can help me resolve this.
I’m not an expert, but I’ve noticed that you’re using mode: multi which leads to the creation of multiple (per thread) pcap files (cf 12.1. Suricata.yaml — Suricata 8.0.1-dev documentation). If you change that to mode: normal do you see any differences?
That link is without the aforementioned change to the suricata yaml. I’m asking for a sample of when the change is done, and suricata run with those settings
Yes, but I encountered the problem when running with this configuration. As you can imagine, this is a common problem. I think it would be better if you try it according to the method I said.
I understand, but sometimes we ask such questions to gather a better understanding of the scenario, when it happens, and what are the differences, so we can possibly help
