These days, I’m extending Mysql detecting & parser on Suricata. Everything works well while replaying the pcap file with the following command:
bin/suricata -c etc/spiderflow.yaml -r $1 -k none
However, while I want to stress test the new feature, I failed to find app_layer.flow.mysql or app_layer.tx.mysql in stats.log, even after I recheckout the code and rules. I used the below command to start it:
bin/suricata -c etc/spiderflow.yaml -D --netmap=p2p2
The following logs repeated many times in suricata.log. It seemed that MysqlState is allocated properly, but MysqlTx doesn’t:
[29630] 23/7/2019 – 18:03:40 - (app-layer-mysql.c:382) (MysqlStateAlloc) – Allocating mysql state.
[29630] 23/7/2019 – 18:03:40 - (app-layer-mysql.c:1116) (MysqlParseRequest) – No transaction for state 0x7f5893d3dfd0.
[29631] 23/7/2019 – 18:03:40 - (app-layer-mysql.c:484) (MysqlProbingParser) – Detected as ALPROTO_MYSQL.
In my implementation, MysqlTx is