# Suricata 7.0.0 unexpected midstream behavior in NFQ mode

**URL:** <https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861>\
**Category:** Help\
**Tags:** suricata, suricata-7\
**Created:** [August 24, 2023, 2:51pm UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861 "2023-08-24T14:51:51Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![msdean](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/msdean/32/1255_2.png) [@msdean](https://forum.suricata.io/u/msdean)\
**Post date:** [August 24, 2023, 2:51pm UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/1 "2023-08-24T14:51:52Z")

</div>

Hi,  
I’ve recently tested the official suricata 7.0.0 stable release in NFQ IPS mode, and noticed that if Suricata comes up while a TCP connection is already established (iperf test for example), it drops the flow with reasons “stream midstream” and then “flow drop”.  
suricata.yaml documentation states the following:

```auto
# midstream: false # don't allow midstream session pickups
# midstream-policy: ignore # Can be "drop-flow", "pass-flow", "bypass",
                              # "drop-packet", "pass-packet", "reject" or
                              # "ignore" default is "ignore"

```

When I explicitly set `stream.midstream-policy` to `ignore`, I get the expected behavior (flow is no longer dropped).

This is a change in behavior from suricata 6.x. Given the documentation I think this is a bug.

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [August 25, 2023, 2:33pm UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/3 "2023-08-25T14:33:10Z")

</div>

Hi Dean,

Could you run

```auto
$ /path/to/your/suricata -c /path/to/your/suricata.yaml <logging, pcap, rule args> -vvv 2>&1 >/tmp/out
$ grep exception-policy /tmp/out

```

With my 7.0 bits, this is logged `Config: exception-policy: stream.midstream-policy: ignore (defined via 'exception-policy' master switch) [ExceptionPolicyGetDefault:util-exception-policy.c:219]`

Ru

---

<div class="post-metadata">

**Author:** ![msdean](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/msdean/32/1255_2.png) [@msdean](https://forum.suricata.io/u/msdean)\
**Post date:** [August 27, 2023, 6:22am UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/4 "2023-08-27T06:22:39Z")

</div>

Hi Jeff,  
I’m not sure what you mean by `<logging, pcap, rule args>`.  
I just ran it the way I usually do the verbosity flags:  
`suricata -c /etc/suricata/suricata.yaml -q 999 -vvv 2>&1 >/tmp/out`  
But I don’t see the config output in /tmp/out (grep returns nothing). TBH it seems like `-vvv` had no effect.  
I tried running with a pcap file `-r <pcap file>` and also no change.

Here are a few examples of the deny flow when I don’t explicitly set the policy to `ignore`:

```auto
{
    "timestamp": "2023-08-27T05:57:11.762905+0000",
    "flow_id": 2150756213700390,
    "event_type": "drop",
    "src_ip": "10.0.40.6",
    "src_port": 23157,
    "dest_ip": "<reducted1>",
    "dest_port": 443,
    "proto": "TCP",
    "pkt_src": "wire/pcap",
    "direction": "to_server",
    "drop": {
        "len": 1112,
        "tos": 0,
        "ttl": 64,
        "ipid": 64019,
        "tcpseq": 3123774421,
        "tcpack": 1932030041,
        "tcpwin": 501,
        "syn": false,
        "ack": true,
        "psh": true,
        "rst": false,
        "urg": false,
        "fin": false,
        "tcpres": 0,
        "tcpurgp": 0,
        "reason": "stream midstream"
    }
},
{
    "timestamp": "2023-08-27T05:57:24.213124+0000",
    "flow_id": 1196838486818802,
    "event_type": "drop",
    "src_ip": "10.0.40.6",
    "src_port": 33617,
    "dest_ip": "<reducted2>",
    "dest_port": 80,
    "proto": "TCP",
    "pkt_src": "wire/pcap",
    "direction": "to_server",
    "drop": {
        "len": 52,
        "tos": 0,
        "ttl": 64,
        "ipid": 63572,
        "tcpseq": 1002311777,
        "tcpack": 3557248460,
        "tcpwin": 501,
        "syn": false,
        "ack": true,
        "psh": false,
        "rst": false,
        "urg": false,
        "fin": false,
        "tcpres": 0,
        "tcpurgp": 0,
        "reason": "stream midstream"
    }
},
{
    "timestamp": "2023-08-27T05:57:25.829569+0000",
    "flow_id": 1592649310743450,
    "event_type": "drop",
    "src_ip": "10.0.40.6",
    "src_port": 10705,
    "dest_ip": "<reducted3>",
    "dest_port": 443,
    "proto": "TCP",
    "pkt_src": "wire/pcap",
    "direction": "to_server",
    "drop": {
        "len": 71,
        "tos": 0,
        "ttl": 64,
        "ipid": 19855,
        "tcpseq": 1543874525,
        "tcpack": 1926112880,
        "tcpwin": 501,
        "syn": false,
        "ack": true,
        "psh": true,
        "rst": false,
        "urg": false,
        "fin": false,
        "tcpres": 0,
        "tcpurgp": 0,
        "reason": "stream midstream"
    }
},
{
    "timestamp": "2023-08-27T05:57:59.546539+0000",
    "flow_id": 1592649310743450,
    "event_type": "drop",
    "src_ip": "<reducted3>",
    "src_port": 443,
    "dest_ip": "10.0.40.6",
    "dest_port": 10705,
    "proto": "TCP",
    "pkt_src": "wire/pcap",
    "direction": "to_client",
    "drop": {
        "len": 40,
        "tos": 0,
        "ttl": 111,
        "ipid": 10262,
        "tcpseq": 1926112880,
        "tcpack": 1543874525,
        "tcpwin": 0,
        "syn": false,
        "ack": true,
        "psh": false,
        "rst": true,
        "urg": false,
        "fin": false,
        "tcpres": 0,
        "tcpurgp": 0,
        "reason": "flow drop"
    }
},
{
    "timestamp": "2023-08-27T05:58:25.492259+0000",
    "flow_id": 1196838486818802,
    "event_type": "drop",
    "src_ip": "<reducted2>",
    "src_port": 80,
    "dest_ip": "10.0.40.6",
    "dest_port": 33617,
    "proto": "TCP",
    "pkt_src": "wire/pcap",
    "direction": "to_client",
    "drop": {
        "len": 40,
        "tos": 0,
        "ttl": 128,
        "ipid": 41927,
        "tcpseq": 3557248460,
        "tcpack": 1002311778,
        "tcpwin": 0,
        "syn": false,
        "ack": true,
        "psh": false,
        "rst": true,
        "urg": false,
        "fin": false,
        "tcpres": 0,
        "tcpurgp": 0,
        "reason": "flow drop"
    }
}

```

---

<div class="post-metadata">

**Author:** ![Jeff\_Lucovsky](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jeff_lucovsky/32/11_2.png) [@Jeff\_Lucovsky](https://forum.suricata.io/u/Jeff_Lucovsky)\
**Post date:** [August 27, 2023, 12:05pm UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/5 "2023-08-27T12:05:49Z")

</div>

Please also check the suricata log file. This is most often in `/var/log/suricata.log` but the location may vary depending on the system you’re using.

---

<div class="post-metadata">

**Author:** ![msdean](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/msdean/32/1255_2.png) [@msdean](https://forum.suricata.io/u/msdean)\
**Post date:** [August 28, 2023, 11:31am UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/6 "2023-08-28T11:31:02Z")

</div>

Yea, I’m running suricata in a container, so I’m aware of where my logs are, but I’m getting the exact same output.

---

<div class="post-metadata">

**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\
**Post date:** [August 31, 2023, 5:36am UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/7 "2023-08-31T05:36:32Z")

</div>

> [@msdean](#):
>
> This is a change in behavior from suricata 6.x. Given the documentation I think this is a bug.

This is documented here [12.3. Exception Policies — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/configuration/exception-policies.html?highlight=policy)

---

<div class="post-metadata">

**Author:** ![msdean](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/msdean/32/1255_2.png) [@msdean](https://forum.suricata.io/u/msdean)\
**Post date:** [August 31, 2023, 6:35am UTC](https://forum.suricata.io/t/suricata-7-0-0-unexpected-midstream-behavior-in-nfq-mode/3861/8 "2023-08-31T06:35:37Z")

</div>

Ah ha! sneaky 🙂  
Thank you for the clarification.