Community id generated using pycommunity id mismatch the one generated using suricata

[corelight]

Community id generated using pycommunity id mismatch the one generated using suricata

[awelzel]

@AlyaGomaa , very nice catch!

i guess this means that suricata is the one doing something wrong, and not pycommunityid?

It looks like, yes. I moved it over to the Suricata project:
https://redmine.openinfosecfoundation.org/issues/6276
https://github.com/OISF/suricata/pull/9399/files

(I don't have permissions to close the issue - maybe you could yourself?)

[ckreibich]

Thanks again for this from me too — very helpful. Your finding made me realize an omission in the test data over in https://github.com/corelight/community-id-spec — the test traces have only individual flows (for example just one for IPv6 traffic), so they don't fully cover the endpoint-flipping logic if you only report per-flow Community IDs. I remember briefly comparing the Zeek and Suricata implementations with those traces and, seeing that they matched, moving on. But that was very incomplete...

[AlyaGomaa]

hey @ckreibich we've all been there, glad i could help!

[AlyaGomaa]

Hey thanks for your help! will close.