Suricata

Using the pcap and the rules file attached with Suricata - 3.1dev (rev 7f700a1) - there is inconsistent number of alerts generated (reproducible across runs ) as follows:

suricata -c /etc/suricata/suricata.yaml -S threshold.rules -r Scan.pcap -v -l log/ --runmode=single

Produces 15 alerts (as it should)

suricata -c /etc/suricata/suricata.yaml -S threshold.rules -r Scan.pcap -v -l log/ --runmode=autofp

Produces 17 alerts

suricata -c /etc/suricata/suricata.yaml -S threshold.rules -v --unix-socket=/var/run/suricata666.socket
/usr/bin/suricatasc /var/run/suricata666.socket -c "pcap-file Scan.pcap log/" 

Produces 17 alerts, after a few runs it can get 18 alerts

suricata -c /etc/suricata/suricata.yaml -S threshold.rules -v --unix-socket=/var/run/suricata666.socket
/usr/bin/suricatasc /var/run/suricata666.socket -c "pcap-file Scan.pcap log/" 

with "max-pending-packets: 4096" setting in suricata.yaml produces 20 alerts

suricata -c /etc/suricata/suricata.yaml -S threshold.rules -v --unix-socket=/var/run/suricata666.socket
/usr/bin/suricatasc /var/run/suricata666.socket -c "pcap-file Scan.pcap log/" 

with "max-pending-packets: 20000" setting in suricata.yaml produces 21 alerts.