# Some RDP traffic dropped with no rules set to 'drop'

**URL:** <https://forum.suricata.io/t/some-rdp-traffic-dropped-with-no-rules-set-to-drop/5603>\
**Category:** Help\
**Tags:** ips\
**Created:** [April 16, 2025, 5:22pm UTC](https://forum.suricata.io/t/some-rdp-traffic-dropped-with-no-rules-set-to-drop/5603 "2025-04-16T17:22:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ronald\_Ratzlaff](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ronald_ratzlaff/32/3545_2.png) [@Ronald\_Ratzlaff](https://forum.suricata.io/u/Ronald_Ratzlaff)\
**Post date:** [April 16, 2025, 5:22pm UTC](https://forum.suricata.io/t/some-rdp-traffic-dropped-with-no-rules-set-to-drop/5603/1 "2025-04-16T17:22:37Z")

</div>

Suricata 7.0.10 in IPS mode  
Installed via apt package  
Ubuntu Server 24.04

Hi everyone,  
My suricata appears to drop some RDP traffic, although none of the rules are set to ‘drop’.  
In the eve.json I get lines such as follows with the corresponding IPs of affected IPs:

{“timestamp”:“2025-04-15T16:23:53.520495+0000”,“flow\_id”:1225914623322712,“in\_iface”:“enp4s0”,“event\_type”:“flow”,“vlan”:[150],“src\_ip”:“[redacted-source-IP]”,“src\_port”:28748,“dest\_ip”:“[redacted-dest-ip]”,“dest\_port”:3389,“proto”:“TCP”,“app\_proto”:“rdp”,“flow”:{“pkts\_toserver”:11,“pkts\_toclient”:10,“bytes\_toserver”:3809,“bytes\_toclient”:9808,“start”:“2025-04-15T16:13:32.154358+0000”,“end”:“2025-04-15T16:13:51.400560+0000”,“age”:19,“state”:“established”,“reason”:“timeout”,“alerted”:false,“action”:“drop”},“metadata”:{“flowbits”:[“ms.rdp.established”]},“community\_id”:“1:il10QbP02ZHL+d2Cogs5tVKLHVM=”,“tcp”:{“tcp\_flags”:“1e”,“tcp\_flags\_ts”:“1e”,“tcp\_flags\_tc”:“1e”,“syn”:true,“rst”:true,“psh”:true,“ack”:true,“state”:“established”,“ts\_max\_regions”:1,“tc\_max\_regions”:1}}

As I mentioned, no rules are set to ‘drop’, and I get no alerts for this, but some RDP connections simply time out. Once I remove Suricata from the network the same RDP connections work flawlessly.

Any pointers will be greatly appreciated!

---

<div class="post-metadata">

**Author:** ![Ronald\_Ratzlaff](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ronald_ratzlaff/32/3545_2.png) [@Ronald\_Ratzlaff](https://forum.suricata.io/u/Ronald_Ratzlaff)\
**Post date:** [April 16, 2025, 7:03pm UTC](https://forum.suricata.io/t/some-rdp-traffic-dropped-with-no-rules-set-to-drop/5603/2 "2025-04-16T19:03:16Z")

</div>

I was able to resolve the issue myself by setting ‘exception-policy’ to bypass.

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [April 24, 2025, 3:11pm UTC](https://forum.suricata.io/t/some-rdp-traffic-dropped-with-no-rules-set-to-drop/5603/3 "2025-04-24T15:11:25Z")

</div>

Good catch!

for suricata 7.0.11 or 7.0.12 we should have an option to log the exception policy triggered in the flow event, this would make troubleshooting situations like yours easier. Sorry it wasn’t there yet!

---

<div class="post-metadata">

**Author:** ![Ronald\_Ratzlaff](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/ronald_ratzlaff/32/3545_2.png) [@Ronald\_Ratzlaff](https://forum.suricata.io/u/Ronald_Ratzlaff)\
**Post date:** [April 24, 2025, 3:46pm UTC](https://forum.suricata.io/t/some-rdp-traffic-dropped-with-no-rules-set-to-drop/5603/4 "2025-04-24T15:46:17Z")

</div>

That sounds like a terrific idea! Thanks for following up.