Suricata

Hello,

Please, check. When rescanning a same pcap file, different md5 hashes are counted from the same "string".

Suricata 6.0.3 from: https://suricata.io/download/ (https://www.openinfosecfoundation.org/download/windows/Suricata-6.0.3-1-64bit.msi)
Windows 10 (10.0.19042)

Same result on:
Suricata 6.0.1
Windows 10 (10.0.19042)

Attached file: ja3hash_test.pcap

WireShark:
[JA3 Fullstring: 771,60-47-61-53-5-10-49191-49171-49172-49195-49187-49196-49188-49161-49162-64-50-106-56-19-4,10-11-13-65281,23-24,0]
[JA3: 66d20946a7642aab5401b79bc2aa83d3]

eve.json

try 1: {"timestamp":"2022-04-08T04:27:54.168684+0300","flow_id":1093574097180080,"pcap_cnt":8,"event_type":"tls","src_ip":"10.113.156.63","src_port":49167,"dest_ip":"202.29.239.162","dest_port":443,"proto":"TCP","tls":{"ja3":{"hash":"40f43f6ff7000000e96dac08f77f0000","string":"771,60-47-61-53-5-10-49191-49171-49172-49195-49187-49196-49188-49161-49162-64-50-106-56-19-4,10-11-13-65281,23-24,0"},"ja3s":{"hash":"30f43f6ff7000000e96dac08f77f0000","string":"771,49191,65281-11"}}}

try 2: {"timestamp":"2022-04-08T04:27:54.168684+0300","flow_id":1726038096287152,"pcap_cnt":8,"event_type":"tls","src_ip":"10.113.156.63","src_port":49167,"dest_ip":"202.29.239.162","dest_port":443,"proto":"TCP","tls":{"ja3":{"hash":"c0f0dfb166000000e96dac08f77f0000","string":"771,60-47-61-53-5-10-49191-49171-49172-49195-49187-49196-49188-49161-49162-64-50-106-56-19-4,10-11-13-65281,23-24,0"},"ja3s":{"hash":"b0f0dfb166000000e96dac08f77f0000","string":"771,49191,65281-11"}}}

try 3: {"timestamp":"2022-04-08T04:27:54.168684+0300","flow_id":921423218021808,"pcap_cnt":8,"event_type":"tls","src_ip":"10.113.156.63","src_port":49167,"dest_ip":"202.29.239.162","dest_port":443,"proto":"TCP","tls":{"ja3":{"hash":"d0f21f9593000000e96dac08f77f0000","string":"771,60-47-61-53-5-10-49191-49171-49172-49195-49187-49196-49188-49161-49162-64-50-106-56-19-4,10-11-13-65281,23-24,0"},"ja3s":{"hash":"c0f21f9593000000e96dac08f77f0000","string":"771,49191,65281-11"}}}