Tools · Network IDS and detection as code · 13 / 24
Suricata: the row timestamp is not the filename
The timestamp on an eve.json row is the event time in that record. A time inside the capture’s filename is your label. Write the row’s timestamp, and do not schedule from the filename.
The row carries its own clock
Each eve.json object has a timestamp for that event. For a replay of a saved capture, that time comes from the packets in the file. It is not the time you started the replay, and it is not a clock you typed into the filename.
A filename like ws07-morning.pcap can contain a date you chose when you saved it. That date helps you find the file. It does not replace the timestamp on a row inside the output.
When you pressed run is a third clock
The job log says when the replay started. That is when the tool ran. Rows can show timestamps from hours or days earlier, because that is what the capture holds. Write the replay time only if you label it as the replay. Do not file it as the event time.
Two rows with different timestamps are two event times even when they came from one replay of one file.
What to file
File the row timestamp as the event time, the filename as the capture’s name, and the replay time if you have it, each labeled. Do not write a single unlabeled time. If the row timestamp and the filename disagree, keep both and use the row for any sentence about when the event happened.
Worked case: a morning file and an afternoon packet
The capture is named lab-2026-11-03-morning.pcap. A row in the eve.json output has timestamp 2026-11-03T15:04:11Z. The replay job started at 09:00Z the next day. A draft says the event was in the morning because of the filename, and also says it happened when the job ran.
The note lists three clocks. The event time is 15:04:11Z from the row. The filename is the label on the capture. The job time is when the replay ran. The sentence about when the packet occurred uses the row. The morning label is not edited onto the timestamp.
filename: lab-2026-11-03-morning.pcap row timestamp: 2026-11-03T15:04:11Z replay started: 2026-11-04T09:00:00Z event time: the row not: morning, and not when the job started
Diagram
Three clocks people swap
Only the row timestamp is the event time.
- Row timestamp
When the event in that record occurred.
- Filename
A label you gave the capture. It can be wrong or vague.
- Replay time
When the tool read the file. Not the packet.
- The note
Label all three, and use the row for “when.”
Check yourself
1. A row is timestamped 15:04Z and the capture file is named morning. What time is the event?
2. The replay ran the next day. What is that later time?
3. Why keep the filename at all?