Hi,
I am trying to order events of wireshark data i.e. events like
time1 src, dst,src_port,dst_port SYN
time2 src, dst,src_port,dst_port FIN
time3 src, dst,src_port,dst_port SYN
time4 src, dst,src_port,dst_port FIN
but transaction creates a transaction out of the time2 and time event. which do not belong together despite using startwith and endwith.
I used the following
eval sdspdp=src+":"+dst+":"+src_port+":"+dst_port
| transaction sdspdp startswith="SYN" endswith="FIN" keepevicted=true unifyends=true | where closed_txn=1 | table time packet_info closed_txn
And I would expect the SYN before the HELLO and FIN, but it isn't. Why ?
time packet_info closed_txn
2020-10-22 18:51:42.772567 2020-10-22 18:51:42.791144 2020-10-22 18:51:42.933482 | 50020 → 8089 [FIN, ACK] Seq=930 Ack=119936 Win=81408 Len=0 TSval=2422219150 TSecr=1505344044 50020 → 8089 [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2422219110 TSecr=0 WS=128 Client Hello | 1 | 2020-10-22 18:51:42.464082 2020-10-22 18:51:42.492535 2020-10-22 18:51:42.602374 | 54728 → http-alt(8080) [FIN, ACK] Seq=896 Ack=32983 Win=42368 Len=0 TSval=2422219067 TSecr=2891895242 54728 → http-alt(8080) [SYN] Seq=0 Win=14600 Len=0 MSS=1460 SACK_PERM=1 TSval=2422219032 TSecr=0 WS=128 Client Hello | 1 Thank you Markus |
