HackBlue

Tools · Network IDS and detection as code · 18 / 24

Suricata: tx_id is one transaction

tx_id numbers one transaction inside a flow, such as a single HTTP request. A second value is another transaction on that same flow, not a second computer.

11 min read · practice only with authorization

The number sits inside one flow

When Suricata parses several requests on one connection, it can stamp each of them with tx_id. The number orders those transactions. It is not a hostname, not an address, and not a case identifier someone assigned in a ticket system.

Zero and one are both real transactions. Zero is not “no request.” It is the first one the parser numbered.

Two values, one connection

Two rows that share a flow and differ in tx_id are two transactions. Their URLs, status codes, or file records can differ. Merging them into a single request drops one of those details. Splitting them into two machines invents a host the rows do not have.

A row with no tx_id is not automatically the whole flow. Write “tx_id not on this row” and cite the URL from the row you actually have.

What to file

File the flow identifier, the tx_id, and the request fields you are using, such as the URL. If you mention a second URL, it needs its own tx_id. Do not write a computer name into the tx_id cell.

Worked case: two URLs read as one download

On flow 991002 between 10.8.0.14 and 10.8.0.80, one HTTP row has tx_id 0 and URL /health, and another has tx_id 1 and URL /lab/report. A draft says the workstation made one download of the report, and that /health was only a label for the same request.

The note lists both transaction numbers and both URLs. /health is its own request. /lab/report is the next one on the same flow. Neither number is a second workstation.

Snippet
flow: 991002
10.8.0.14 -> 10.8.0.80
tx_id 0  url /health
tx_id 1  url /lab/report
write: two transactions on one flow
not: one download, and not two computers

Diagram

Keep each transaction beside its number

  1. Flow

    The connection the rows share.

    Flow
    991002
  2. tx_id 0

    The first transaction the parser numbered.

    Request
    /health
  3. tx_id 1

    The next transaction, still on that flow.

    Request
    /lab/report
  4. Note

    Cite both numbers if you mention both URLs.

    Note
    one flow, two requests

Check yourself

1. Two HTTP rows share a flow and show tx_id 0 and tx_id 1. What are they?

2. tx_id 0 is present. What does zero mean?

3. You have a URL and the row has no tx_id. What do you add?