Tools · Network IDS and detection as code · 17 / 24
Suricata: app_proto is not the destination port
app_proto is the protocol Suricata assigned to the flow. The destination port is a number on the packet. Write both, and do not name the application from the port alone.
The classifier writes app_proto
On a flow or alert record, app_proto is the application Suricata settled on after it looked at the payload, or the word it uses when that look failed. It is a classification for this flow. It is not a second copy of the port, and it is not a signature message.
The words you will see include dns, http, tls, and failed. failed means the classifier did not name an application. It does not mean the packet was empty, and it does not mean you may substitute the well-known use of the port.
The port stays a number
dest_port is the destination port in the packet. Port 53 is often DNS, and port 443 is often TLS, in the sense that people expect those services there. Expectation is not a field. If app_proto and the usual service for that port disagree, the note keeps the disagreement.
src_port is the other number. Do not move it into the application sentence either. A high source port is normal for a client and says nothing about which application was classified.
What to file
File dest_port and app_proto as two cells. If you write “DNS” or “HTTPS”, the sentence has to point at app_proto, or at a protocol record that actually carries that application. A port number by itself does not earn the name.
When app_proto is missing, write “app_proto not on this row.” Do not fill the gap from a port list.
Worked case: 443 with a failed classification
A lab row for 10.8.0.14 to 10.8.0.80 shows dest_port 443 and app_proto failed. A draft says the workstation opened HTTPS to the lab server, because 443 is the HTTPS port.
The note quotes 443 and failed. It does not say HTTPS. There is no tls record in the file for this flow, so there is no handshake to cite either. The finding stops at the port and the failed classification.
src: 10.8.0.14 dest: 10.8.0.80 dest_port: 443 app_proto: failed tls record for this flow: none write: port 443, classification failed not: the workstation opened HTTPS
Diagram
A port number and a classification
One is on the packet. The other is what the engine named.
Is. A number in the packet
443. Often expected to be TLS
Does not. Fill in app_proto when classification failed
Is. The application Suricata assigned
failed. No application name was assigned
Use. When you name DNS, HTTP, or TLS
Check yourself
1. app_proto on a row is failed, and dest_port is 443. What may you call the application?
2. Where does the word DNS belong if you want to say the flow was DNS?
3. The row has a destination port and no app_proto field. What do you write?