Identify start of new transaction when previous one hasn't finished

[RolandBird]

I need a search that can identify when a new TCP session from an IP Address is established but the previous TCP session hasn't closed. Below is a mock up of the raw event data. Line 1 & 3 are the start and end of the first transaction, but line 2 occurs between them and is from the same source. How can I detect a new transaction from the same source when an existing one hasn't finished.

Line, Source, Destination , TCP Stream, TCP Flag

1, 10.10.10.10, 10.10.10.20, 1, SYN (Start Event)

2, 10.10.10.10, 10.10.10.20, 2, SYN (Start Event) <---- EVENT to detect

3, 10.10.10.10, 10.10.10.20, 1, FIN (End Event)

4, 10.10.10.10, 10.10.10.20, 2, FIN (End Event)

5, 10.10.10.10, 10.10.10.20, 3, SYN (Start Event)

6, 10.10.10.10, 10.10.10.20, 3, FIN (End Event)

[aholzer]

Have you tried also specifying the endswith? It might be smart enough to figure out something with the same tcp stream that matches the "startswith" should have an endswith:

| transaction tcp_stream startswith="SYN" endswith="FIN"

Hope this helps

[kristian_kolb]

If you have a unique number (like "TCP Stream") for the connection you can use that as a basis for your searches, rather than making transactions based on IP addresses;

For the duration of a session, you could use something like

... | stats min(_time) as begin max(_time) as end by "TCP Stream" | eval dur=end-begin

Lots of transaction stuff can be done with stats instead, and it's faster.

---

UPDATE:

... | transaction ip startswith="start" endswith="end" | search eventcount != 2

something along those lines, perhaps. Can't test it at the moment.

/K

[kristian_kolb]

It doesn't. It's just a slightly more efficient version of transaction. Do you just want to detect the fact that a transaction has started before the previous has ended?

see update to my original answer.

[RolandBird]

I'm not sure how this will help identify when a Start Event occurs in between a Start/End event that has come from the same IP.

Line 1 - Start event for connection from IP 10.10.10.10 creating TCP stream 1
Line 3 - End event for connection from IP 10.10.10.10 TCP Stream 1 ends

if you use the following command the transaction are grouped

| transaction tcp_stream

The second transaction starts before the first one has finished. Not sure how the stat command you have shown identifies this.