Hello,
I’m using Suricata in IPS mode on a Linux, using an iptables rule that sends the packets to suricata using NFQUEUE. I can’t find in the documentation if it is possible to make a rule match a packet according to its possible marking from iptables?
For example I marked a packet with:
iptables -A PREROUTING -t mangle -i eth0 -p tcp --dport 80 -j MARK --set-mark 1
Which later is sent to Suricata using NFQUEUE.
I found a nfq_set_mark, but no nfq_get_mark. Is there such a possibility in suricta rules?