Re: Unified2 Missing event record

--===============4622751408371852110==
Content-Type: multipart/alternative; boundary="000000000000d0323e058dcf5d53"

--000000000000d0323e058dcf5d53
Content-Type: text/plain; charset="UTF-8"

On Tue, Jul 16, 2019 at 8:03 PM Ron H <[email protected]> wrote:

> Hi Albert,
> I running Snort as IDS  in inline mode - Using Daq PFRING ZC mode.
>
> *Snort Command: *
> snort -c snort.conf --daq-dir /usr/local/lib/daq --daq-mode passive --daq
> pfring_zc -i zc:100@0
>
> *Snort configuration:*
>  My snort configuration download from snort.com website and compatible
> with my snort version (2.9.11.1)
>
> *Unified2 configuraton in snort.conf:*
> output unified2: filename /usr/local/app/snort/unified2/snort.unifed2,
> limit 100M
>
> I will check if issue happening on the most recent version of snort.
>
> Thanks,
> Ron. :)
>
>
>
>
>
> On Tue, Jul 16, 2019 at 7:50 PM Ron H <[email protected]> wrote:
>
>> More details:
>> Our application creates pcaps files from unified2 snort output.
>> The application read unified2 records (Event record and Packet record)
>> The issue is Snort writes unifed2 files frequently without event record
>> (Only Packet record)
>>
>> This situation can be normal?
>>
>> Thanks,
>> Ron :)
>>
>>
>> On Tue, Jul 16, 2019 at 7:42 PM Ron H <[email protected]> wrote:
>>
>>> UP! :)
>>> Does someone know this issue?
>>>
>>> On Mon, Jul 8, 2019 at 7:31 PM Ron H <[email protected]> wrote:
>>>
>>>> Hey Snort devel,
>>>>
>>>> We have an issue with Snort Unified2 output.
>>>> Snort write packet record without write event record.
>>>> This issue happens frequently.
>>>>
>>>> out snort version is *2.9.11.1*
>>>> Snort run on Ubuntu 16.04 Docker container
>>>>
>>>> We are would be grateful to any assistance.
>>>> Thanks!
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>

--000000000000d0323e058dcf5d53
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><br></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">On Tue, Jul 16, 2019 at 8:03 PM Ron H &lt;<a href=3D"m=
ailto:[email protected]">[email protected]</a>&gt; wrote:<br></div><blo=
ckquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left=
:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Hi Albert,=
=C2=A0<div>I running Snort as IDS=C2=A0 in inline mode - Using Daq PFRING Z=
C mode.</div><div><br></div><div><b>Snort Command:=C2=A0</b></div><div>snor=
t -c snort.conf --daq-dir /usr/local/lib/daq --daq-mode passive --daq pfrin=
g_zc -i zc:100@0</div><div>=C2=A0</div><div><b>Snort configuration:</b></di=
v><div>=C2=A0My snort configuration download from <a href=3D"http://snort.c=
om" target=3D"_blank">snort.com</a> website and compatible with my snort ve=
rsion (2.9.11.1)</div><div><br></div><div><b>Unified2 configuraton in snort=
.conf:</b></div><div>output unified2: filename /usr/local/app/snort/unified=
2/snort.unifed2, limit 100M</div><div><br></div><div>I will check if issue =
happening on the most recent version of snort.</div><div><br></div><div>Tha=
nks,</div><div>Ron. :)</div><div><br></div><div><br></div><div><br></div><d=
iv><br></div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D=
"gmail_attr">On Tue, Jul 16, 2019 at 7:50 PM Ron H &lt;<a href=3D"mailto:ro=
[email protected]" target=3D"_blank">[email protected]</a>&gt; wrote:<br>=
</div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;b=
order-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Mo=
re details:<div>Our application creates pcaps files from unified2 snort out=
put.</div><div>The application read unified2 records (Event record and Pack=
et record)</div><div>The issue is Snort writes unifed2 files frequently wit=
hout event record (Only Packet record)</div><div><br></div><div>This situat=
ion can be normal?=C2=A0</div><div><br></div><div>Thanks,</div><div>Ron :)<=
/div><div>=C2=A0</div></div><br><div class=3D"gmail_quote"><div dir=3D"ltr"=
 class=3D"gmail_attr">On Tue, Jul 16, 2019 at 7:42 PM Ron H &lt;<a href=3D"=
mailto:[email protected]" target=3D"_blank">[email protected]</a>&gt; w=
rote:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0p=
x 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir=
=3D"ltr">UP! :)=C2=A0<div>Does someone know this issue?=C2=A0</div></div><b=
r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Mon, =
Jul 8, 2019 at 7:31 PM Ron H &lt;<a href=3D"mailto:[email protected]" tar=
get=3D"_blank">[email protected]</a>&gt; wrote:<br></div><blockquote clas=
s=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r=
gb(204,204,204);padding-left:1ex"><div dir=3D"ltr">Hey Snort devel,=C2=A0<d=
iv><br></div><div>We have an issue with Snort Unified2 output.</div><div>Sn=
ort write packet record without write event record.=C2=A0</div><div>This is=
sue happens=C2=A0frequently.=C2=A0</div><div><br></div><div>out snort versi=
on is <b>2.9.11.1</b></div><div>Snort run on Ubuntu 16.04 Docker container<=
/div><div><br></div><p style=3D"box-sizing:border-box;margin-bottom:16px;ma=
rgin-top:0px;color:rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFo=
nt,&quot;Segoe UI&quot;,Helvetica,Arial,sans-serif,&quot;Apple Color Emoji&=
quot;,&quot;Segoe UI Emoji&quot;,&quot;Segoe UI Symbol&quot;;font-size:14px=
">We are would be grateful to any assistance.</p><div><span style=3D"color:=
rgb(36,41,46);font-family:-apple-system,BlinkMacSystemFont,&quot;Segoe UI&q=
uot;,Helvetica,Arial,sans-serif,&quot;Apple Color Emoji&quot;,&quot;Segoe U=
I Emoji&quot;,&quot;Segoe UI Symbol&quot;;font-size:14px">Thanks!</span></d=
iv><div>=C2=A0</div><div><br></div><div><div><br></div><div><br><div><br></=
div><div><br></div></div></div></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>
</blockquote></div>

--000000000000d0323e058dcf5d53--

--===============4622751408371852110==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

--===============4622751408371852110==--