unified2 - multiple events and single packet question

[Jeff Sundquist <jeffsundquist () gmail com>]

I have a single packet that triggers multiple rules and I end up with the
following unified2 from it:

(Event)
sensor id: 0 event id: 1 event second: 1395855838 event microsecond: 898374
sig id: 2011967 gen id: 1 revision: 3  classification: 29
priority: 1 ip source: 192.168.34.253 ip destination: 192.168.234.100
src port: 60968 dest port: 80 protocol: 6 impact_flag: 0 blocked: 0

Packet
sensor id: 0 event id: 1 event second: 1395855838
packet second: 1395855838 packet microsecond: 898374
linktype: 1 packet_length: 207
[    0] 00 0C 29 88 8C 67 00 22 19 D4 DC 85 08 00 45 00  ..)..g."......E.
[   16] 00 C1 1E 70 40 00 40 06 8D 14 C0 A8 22 FD C0 A8  ...p@.@....."...
[   32] EA 64 EE 28 00 50 29 B8 0F 2E 7E 4D 21 1E 50 18  .d.(.P)...~M!.P.
[   48] 00 5C 74 F9 00 00 47 45 54 20 2F 63 6D 64 2E 65  .\t...GET /cmd.e
[   64] 78 65 3F 31 32 26 66 6F 6F 3D 2F 62 6F 74 2E 65  xe?12&foo=/bot.e
[   80] 78 65 26 62 61 72 3D 31 31 32 20 48 54 54 50 2F  xe&bar=112 HTTP/
[   96] 31 2E 30 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A  1.0..User-Agent:
[  112] 20 57 67 65 74 2F 31 2E 31 30 2E 32 20 28 52 65   Wget/1.10.2 (Re
[  128] 64 20 48 61 74 20 6D 6F 64 69 66 69 65 64 29 0D  d Hat modified).
[  144] 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 0D 0A 48 6F  .Accept: */*..Ho
[  160] 73 74 3A 20 31 39 32 2E 31 36 38 2E 32 33 34 2E  st: 192.168.234.
[  176] 31 30 30 0D 0A 43 6F 6E 6E 65 63 74 69 6F 6E 3A  100..Connection:
[  192] 20 4B 65 65 70 2D 41 6C 69 76 65 0D 0A 0D 0A      Keep-Alive....

(Event)
sensor id: 0 event id: 2 event second: 1395855838 event microsecond: 898374
sig id: 2009361 gen id: 1 revision: 4  classification: 21
priority: 2 ip source: 192.168.34.253 ip destination: 192.168.234.100
src port: 60968 dest port: 80 protocol: 6 impact_flag: 0 blocked: 0

(Event)
sensor id: 0 event id: 3 event second: 1395855838 event microsecond: 898374
sig id: 1002 gen id: 1 revision: 10  classification: 30
priority: 1 ip source: 192.168.34.253 ip destination: 192.168.234.100
src port: 60968 dest port: 80 protocol: 6 impact_flag: 0 blocked: 0


Question : Is this the correct behavior?  The unified2 doc states the
following "A Unified2 Packet is provided with each Unified2 Event record".


I ask because barnyard2 isn't recording all three signatures since there is
no packet included.  I want to know whether I need to update barnyard2 or
if there is an issue with snort or if I'm missing something.

One more...  If a single packet for 3 rules is correct, is there a way to
associate event 2 and 3 with the packet?

Thanks,
Jeff

------------------------------------------------------------------------------

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!