# Suricata AF-PACKET IPS not dropping **URL:** \ **Category:** Help\ **Tags:** ips\ **Created:** [September 26, 2021, 1:41pm UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755 "2021-09-26T13:41:57Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![Danielix](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Danielix](https://forum.suricata.io/u/Danielix)\ **Post date:** [September 26, 2021, 1:41pm UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/1 "2021-09-26T13:41:57Z")
Hi, im new here, if im doing something wrong pls let me know; I’ve succesfully setup Suricata as IPS with AF-PACKET in this way: Internet \<-\> router \<-\> suricata \<-\> swicth to my lan everything work and suricata detect any “attack” in fast.log but is not actually blocking it, it is only showed as alarm but not blocked, why? ---
**Author:** ![syoc](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@syoc](https://forum.suricata.io/u/syoc)\ **Post date:** [September 26, 2021, 6:04pm UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/2 "2021-09-26T18:04:20Z")
Hi, can you show an example of a rule that triggered and you thing should have dropped the traffic? ---
**Author:** ![Danielix](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Danielix](https://forum.suricata.io/u/Danielix)\ **Post date:** [September 26, 2021, 8:24pm UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/3 "2021-09-26T20:24:42Z")
Thia one for example is the result of a test attack i did 09/26/2021-15:31:09.716478 [**] [1:2400001:3022] ET DROP Spamhaus DROP Listed Traffic Inbound group 2 [**] [Classification: Misc Attack] [Priority: 2] {TCP} 42.169.49.121:55226 → 192.168.1.250:0 09/26/2021-15:31:09.728897 [**] [1:2400013:3022] ET DROP Spamhaus DROP Listed Traffic Inbound group 14 [**] [Classification: Misc Attack] [Priority: 2] {TCP} 143.49.59.206:55370 → 192.168.1.250:0 Suricata pop this alert in fast.log but do nothing to stop the attack ---
**Author:** ![netsecuris23](https://avatars.discourse-cdn.com/v4/letter/n/58f4c7/32.png) [@netsecuris23](https://forum.suricata.io/u/netsecuris23)\ **Post date:** [September 26, 2021, 11:17pm UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/4 "2021-09-26T23:17:29Z")
Did you set the action (drop) on the signature? ---
**Author:** ![Danielix](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Danielix](https://forum.suricata.io/u/Danielix)\ **Post date:** [September 27, 2021, 8:34am UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/5 "2021-09-27T08:34:16Z")
Yes,i used suricata-update with modify.conf to change from alert to drop and verified by myself in suricata.rules, in fact many attacks are blocked but this hping3 flood still can get throught suricata and hit my “victim” device ---
**Author:** ![Andreas\_Herz](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/andreas_herz/32/52_2.png) [@Andreas\_Herz](https://forum.suricata.io/u/Andreas_Herz)\ **Post date:** [September 28, 2021, 9:20pm UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/6 "2021-09-28T21:20:53Z")
Can you share version and configuration file of Suricata? Is this hping3 flood exactly shown in the fast.log? ---
**Author:** ![Danielix](https://avatars.discourse-cdn.com/v4/letter/d/b9e5f3/32.png) [@Danielix](https://forum.suricata.io/u/Danielix)\ **Post date:** [November 25, 2021, 11:31am UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/7 "2021-11-25T11:31:51Z")
sorry for late reply, it was my misconfiguration. ---
**Author:** ![rainune](https://avatars.discourse-cdn.com/v4/letter/r/a183cd/32.png) [@rainune](https://forum.suricata.io/u/rainune)\ **Post date:** [February 16, 2022, 9:44am UTC](https://forum.suricata.io/t/suricata-af-packet-ips-not-dropping/1755/8 "2022-02-16T09:44:17Z")
I have encountered a similar problem. Can you tell me where did you configure it wrong?