Transaction not using time ordered events

huaraz — Thu, 22 Oct 2020 18:57:17 GMT

Hi,

I am trying to order events of wireshark data i.e. events like

time1 src, dst,src_port,dst_port SYN

time2 src, dst,src_port,dst_port FIN

time3 src, dst,src_port,dst_port SYN

time4 src, dst,src_port,dst_port FIN

but transaction creates a transaction out of the time2 and time event. which do not belong together despite using startwith and endwith.

I used the following

eval sdspdp=src+":"+dst+":"+src_port+":"+dst_port
| transaction sdspdp startswith="SYN" endswith="FIN" keepevicted=true unifyends=true | where closed_txn=1 | table time packet_info closed_txn

And I would expect the SYN before the HELLO and FIN, but it isn't. Why ?

time packet_info closed_txn

2020-10-22 18:51:42.772567

2020-10-22 18:51:42.791144

2020-10-22 18:51:42.933482

50020 → 8089 [FIN, ACK] Seq=930 Ack=119936 Win=81408 Len=0 TSval=2422219150 TSecr=1505344044

50020 → 8089 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2422219110 TSecr=0 WS=128

Client Hello

2020-10-22 18:51:42.464082

2020-10-22 18:51:42.492535

2020-10-22 18:51:42.602374

54728 → http-alt(8080) [FIN, ACK] Seq=896 Ack=32983 Win=42368 Len=0 TSval=2422219067 TSecr=2891895242

54728 → http-alt(8080) [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2422219032 TSecr=0 WS=128

Client Hello

Thank you

Markus

Re: Transaction not using time ordered events

to4kawa — Sat, 24 Oct 2020 11:58:51 GMT

sample:

index=_internal | head 10 | streamstats count | eval _raw=count, flag="A" | transaction flag

before transaction, try | reverse

topic Re: Transaction not using time ordered events in Splunk Search

Transaction not using time ordered events

Re: Transaction not using time ordered events