# In Suricata IDS mode. is it possible to block/drop/pass good traffic so it will not be seen in kibana? **URL:** \ **Category:** Rules\ **Tags:** ips\ **Created:** [August 30, 2021, 10:44pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666 "2021-08-30T22:44:13Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![MYK](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@MYK](https://forum.suricata.io/u/MYK)\ **Post date:** [August 30, 2021, 10:44pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/1 "2021-08-30T22:44:13Z")
Newbie to Suricata here. In Suricata IDS mode. is it possible to block/drop/pass good traffic so it will not be seen in kibana? drop ip any any \<\> any any (msg:“pass traffic for test”; sid:123;) drop ip xxx any \<\> xxx any (msg:“pass traffic for test”; sid:123;) These syntax did not work. i was still seeing traffic from that IP address. Please help i also tried several commands such as supress, not, pass ---
**Author:** ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)\ **Post date:** [August 31, 2021, 5:55am UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/2 "2021-08-31T05:55:45Z")
Hi, As far as I know it is not possible, it can only be in IPS mode. ---
**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\ **Post date:** [August 31, 2021, 8:35am UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/3 "2021-08-31T08:35:56Z")
Hi MYK, I haven’t used Kibana myself, so I’m not sure, but could some of the options in ignoring traffic be useful for you, perhaps? There are a few possibilities there, from filtering, to adding pass ou suppress rules, to bypassing traffic… [9.7. Ignoring Traffic — Suricata 7.0.0-dev documentation](https://suricata.readthedocs.io/en/latest/performance/ignoring-traffic.html) Welcome to our forum and let us know if you found something that works for you! 🙂 ---
**Author:** ![cthomas](https://avatars.discourse-cdn.com/v4/letter/c/e8c25b/32.png) [@cthomas](https://forum.suricata.io/u/cthomas)\ **Post date:** [August 31, 2021, 12:43pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/4 "2021-08-31T12:43:47Z")
I’m guessing trying to filter on Elastic ingest is too heavy? Are you ingesting the `drops.json` separately? Or everything in 1 eve json output? If you drop `any any` in IPS mode I assume you would get nothing through the wire and everything in eve drops output. ---
**Author:** ![cthomas](https://avatars.discourse-cdn.com/v4/letter/c/e8c25b/32.png) [@cthomas](https://forum.suricata.io/u/cthomas)\ **Post date:** [September 1, 2021, 2:36am UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/5 "2021-09-01T02:36:23Z")
Ah, re-read what suricatalfon said, yes you can not drop in I **D** S mode. You could write alerts to a separate json file and ingest only that. Or filter with logstash/filebeat to only send **alerts** from your eve output. ---
**Author:** ![MYK](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@MYK](https://forum.suricata.io/u/MYK)\ **Post date:** [September 1, 2021, 3:22pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/6 "2021-09-01T15:22:54Z")
Ok Thanks Guys. Ive tried several commands such as drop, pass, supress,bypass with not luck in IDS mode. Seems like the only command that works is “Alerts ip any any \<\> any any (msg:“pass traffic for test”; sid:123;)” Pretty much what im trying to figure out is how to ignore ignore traffic, so it wont show in kibana. As of right now were just seeing alot of good traffic and were trying to ignore those traffic within suricata. For example were seeing nessus scanning traffic. We would like to ignore the Nessus scanner IP addresses. ---
**Author:** ![MYK](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@MYK](https://forum.suricata.io/u/MYK)\ **Post date:** [September 1, 2021, 4:09pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/7 "2021-09-01T16:09:26Z")
Hi Ju. Thank you but i have visited that site and tried those BPF commands but unfortunately did not work. not sure if BPF workds in IDS mode. our monitoring system is configured for IDS mode only ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [September 5, 2021, 2:17pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/8 "2021-09-05T14:17:03Z")
Any system behind a tap, SPAN port cannot affect traffic flow as the system(s) receive a copy of traffic that’s already been transmitted. You can configure Suricata to ignore traffic from specific IP addresses, CIDR blocks through BPF and/or setting up the rule variables `HOME_NET` and `EXTERNAL_NET` @jufajardini posted a link with examples recently … see [In Suricata IDS mode. is it possible to block/drop/pass good traffic so it will not be seen in kibana? - #3 by jufajardini](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/3) ---
**Author:** ![MYK](https://avatars.discourse-cdn.com/v4/letter/m/b77776/32.png) [@MYK](https://forum.suricata.io/u/MYK)\ **Post date:** [September 6, 2021, 6:56am UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/9 "2021-09-06T06:56:01Z")
Thanks Jeff. These are the commands that ive tried with no luck drop ip any any \<\> any any (msg:“pass traffic for test”; sid:123;) drop ip xxx any \<\> xxx any (msg:“pass traffic for test”; sid:123;) Pass HOME\_NET any \<\> External Net (msg:“pass traffic for test”; sid:123;) supress any any \<\> any any (msg:“pass traffic for test”; contains “[google.com](http://google.com)”; sid:123;) can you give me an example of how to “ignore” traffic like DNS or IP? any help would be appreciated. thank you. ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [September 6, 2021, 2:05pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/10 "2021-09-06T14:05:03Z")
Again – you won’t be able to drop traffic using Suricata in IDS mode. You won’t be able to drop traffic behind a network tap, span port, or similar. Here’s a BPF filter to ignore UDP traffic sent to the default DNS port: `udp dst port not 53`. You can add this to the end of the Suricata command line ---
**Author:** ![Bilal-SG](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/bilal-sg/32/1810_2.png) [@Bilal-SG](https://forum.suricata.io/u/Bilal-SG)\ **Post date:** [December 30, 2022, 7:08pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/11 "2022-12-30T19:08:02Z")
Hello Corey, Could you please advise how to separate alerts from normal traffic and make them written into a separate file? Such that, normal traffic into traffic.json and alerts into alerts.json. Because I don’t want normal traffic to show up in Kibana… Also, normal traffic is eating up my storage resources in SIEM and I don’t want them to be fed into the SIEM. So appreciate your help in this issue. Thanks, Bilal ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [January 3, 2023, 1:46pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/12 "2023-01-03T13:46:15Z")
Hi, You can separate alerts into a separate output file. If I understand your question, you’d like to separate logging information from alerts. If that’s correct, use multiple `eve-log` sections in your Suricata configuration file `suricata.yaml`. Here’s a [link](https://forum.suricata.io/t/logging-different-kind-of-logs-in-different-eve-files/329/2) to an older forum post where this is presented. ---
**Author:** ![Bilal-SG](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/bilal-sg/32/1810_2.png) [@Bilal-SG](https://forum.suricata.io/u/Bilal-SG)\ **Post date:** [January 3, 2023, 2:08pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/13 "2023-01-03T14:08:50Z")
Hi Jeff, Thanks a lot for answering my inquiry! I’ve applied the steps mentioned successfully. Another question please, assuming that you have ELK SIEM and you want to forward Suricata alerts to for better visibility, would it be a good practice to forward alerts only? I mean, isn’t it necessary also from detection perspective to look at flow or snmp? Knowing in my network, flow and snmp are highly consuming the storage capacity and occupying more than 50% of the inspected traffic. Please need your advice about the best practice to combine between detection capability and network visibility in one hand and saving storage resource and eliminating unnecessary traffic in another hand. Thanks a lot!! Regards, Bilal ---
**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\ **Post date:** [January 3, 2023, 2:17pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/14 "2023-01-03T14:17:46Z")
I’m glad you were able to solve the immediate problem of separating log information from alerts. Regarding your second question, the alerts contain some contextual information but the logs should be available for full forensic analysis. This is my opinion; others in the forum will probably have other ideas of how to handle the balance of storage resources and what’s necessary for investigation. ---
**Author:** ![sscally](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@sscally](https://forum.suricata.io/u/sscally)\ **Post date:** [January 11, 2023, 11:14pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/15 "2023-01-11T23:14:49Z")
This can be done with pass rules. It’s what I currently do to reduce alerts forwarded to graylog. Using pass rules stops any alert entry from going into the default eve.log I’m assuming you are storing and loading your custom rules in a separate file and have the file defined in the suricata.yaml file under the suricata-update section ```auto rule-files: - suricata.rules - your-custom-file.rules ``` In your-custom-file.rules you can have entries like this: ```auto # Modifies SID2100366 - GPL ICMP_INFO PING *NIX as these hosts are allowed to ping each other. pass icmp $MONITORING_HOSTS any -> $MONITORED_HOSTS any (itype:8; sid:1100000; rev:1;) ``` $MONITORING\_HOSTS and $MONITORED\_HOSTS are defined in my suricata.yaml similar to HOME\_NET, HTTP\_SERVERS, SSH\_PORTS. Note that having a msg value here doesn’t really matter here since you aren’t actually creating an alert or log entry anywhere. We sometimes include them or make comments above the signature. Make sure to include a unique SID from within the local range. * * * **Example** If you want to pass all http traffic for a set of host you can do the following: In suricata.yaml define the host(s) ```auto WEB_SVR1: "[1.1.1.1, 2001:100::84]" WEB_SVR2: "[1.1.1.2,2001:100::85]" ``` In your custom rule file you add the following: ```auto pass http $WEB_SVR1 [80,443] -> $WEB_SRV2 [80,443] (msg:"Allow these servers to talk to each other";) ``` or pass all traffic ```auto pass ip $WEB_SVR1 any -> $WEB_SRV2 any (msg:"Allow these servers to talk to each other";) ``` Note the direction here, I don’t have rules using the \<\> specification but you should be able to replace → with \<\>. **Test New Rule** You can use suricata with the -T flag to have it test loading the configurations and rules files. Any errors in your rule will show up. ```auto /usr/bin/suricata -T -c /etc/suricata/suricata.yaml ``` You may need to run suricata-update here I can’t remember. We deploy this as playbook so we may have just added suricata-update to prime the new rule loading. You will also need to restart the Suricata service to load in the new rules you have created. You can look into having suricata-update reload the service or for right now I would say just perform the systemd restart. Its usually something like: ```auto systemctl restart suricata ``` ---
**Author:** ![sscally](https://avatars.discourse-cdn.com/v4/letter/s/ccd318/32.png) [@sscally](https://forum.suricata.io/u/sscally)\ **Post date:** [January 11, 2023, 11:22pm UTC](https://forum.suricata.io/t/in-suricata-ids-mode-is-it-possible-to-block-drop-pass-good-traffic-so-it-will-not-be-seen-in-kibana/1666/16 "2023-01-11T23:22:13Z")
Hi Bilal, I only send alerts from the eve.json file into our graylog cluster. Depending on how busy your network or where you are tapping your mirror traffic you can use something like [https://arkime.com/](https://arkime.com/) to do full packet capturing and indexing. If you install Arkime on the same box or can give it access to the eve.json log it will attach the matching alert SID to the entry. > **[Arkime Settings](https://arkime.com/settings#suricata)** > > Arkime settings