Suricata 7.0.0 IPS AF_Packet+RSS huge drop in performance

[sbhardwaj (Shivani)]

Hi!
Your configuration file seems to have been from 7.0.0-beta1, it would be nice to sync it with 7.0.0.

Also, could you please check if your issue could be related to the newly added exception policies?

My traffic gets blocked after upgrading to Suricata 7

New default exception policies for 7 Suricata 7 will behave more like a firewall, so defaulting to failing closed. This is due to the exception policies defaulting to drop-flow or drop-packet. Whenever an exceptional condition is met, currently, conditions could be a midstream session pick-up, an application layer protocol error, or a memcap hit. Some set-ups can be more prone to such blocks, for instance, if your traffic usually shows many midstream sessions. Read more about all of Suricata’…

If this is the case, it could happen because of the old conf. The setting may be defaulting to auto and could be a potential reason for your drops.