I had Suricata as IPS and can drop pings with
drop ICMP any any -> any any (msg:"ping droped ";sid: 200002;rev:1;)
but I can drop other packets
My example:
I had a file on my webserver on another machine and I have the hash of this file stored on a file in the Suricata machine and this rule:
drop tcp any any -> any any (msg:"hash detected";filemd5:/etc/suricata/rules/filename;sid:200004;rev:1;)
On filename I had a list of md5 hashes one of them, the file I’m using as a test
and the rule looks correct written because when I wget to the file get logged on Suricata log but the packet isn’t dropped, so that’s what I get on the log
03/30/2022-10:14:48.589623 [Drop] [**] [1:200004:1] hash detected [**] [Classification: (null)] [Priority: 3] {TCP} 169.69.1.10:80 -> 169.69.1.11:50432
The conclusion is, Suricata is detecting the hash and logging the success but doesn’t drop the packet