Currently this article is applicable ONLY to sensor versions < 1320 hosted and 1371 for on-premise, the override will be available again in version 1390 for both hosted and on-premise.Some signature hits and corresponding events have traffic captures (pcaps) and some does not.
The IDS service (Suricata) keeps in memory a buffer of recent packets for each flow it analyzes, so that, when an alert is generated, the corresponding buffer is dumped to a pcap file. However, the pcap snipping mechanism is memory constrained: if the IDS service cannot keep all the packets in the buffer, it will throw away the least recent ones.
Based on this, the appliance might not be able to generate a pcap for a given alert for the following reasons:
- The appliance allocate memory for the pcap snipping feature based on the resources available to the appliance. With a minimum of 1GB of buffer, recent appliances allow the buffer to take 40% of the memory available to the sniffing component. Older appliances (<1360) instead statically allocated only 2GB of RAM.
- It is known from threat intelligence data that the alerts are normally triggering at the very beginning of a flow. When encountering the so-called "elephant flows", likely to be associated to backups or large file transfers, we optimize CPU utilization by no longer tracking the pcap data. This happens by default after the first 8MB of data transferred by a flow. If an alert triggers that deep into a flow, it is very likely that the alert is a false positive.
When it comes to buffer size, the buffer size needs are directly proportional to the number of concurrent flows expected on a given appliance, as well as the configured MTU (sensors with larger MTUs will use more memory to store packets).