Suricata in IPS mode dropping tcp traffic

Hi,

I am running suricata in IPS mode. I have just one simple rule, which is to alert me of any ip traffic. The rule is triggering fine. However, all of my tcp packets are being dropped.
I am not sure why this is happening.

Hi,

can you give us more details about your setup? How you run and configured Suricata, what version you use etc.?

There can be multiple reasons for that to happen.

I am using 6.0.2. the latest version. I did not change much in the config file, only the max-pending-packets.

My home network is the one i am protecting. I am using the gateway configuration where suricata ips inspects the traffic that passes through it.

Please provide the config and the start command so we can get those necessary details.
Did you change the rule from “alert” to “drop”?

The command I am using to run is “sudo suricata -c /etc/suricata/suricata.yaml -q 0 -v”

My iptables config is sudo iptables -I FORWARD -i eth4 -o eth7 -j NFQUEUE

My rules is : alert tcp any any → any any (msg: “TCP Packet found”; ) just to test.

My config file is:
suricata.yaml (70.7 KB)

  1. What about the other direction of the packets coming from eth7 to eth4?

  2. This will generate a lot of log messages, this might be the issue. What happens if you don’t run that rule?

  3. Post stats.log as well

Right now I am controlling the node connected to eth7 so there is no traffic in that direction. The udp and icmp traffic passes just fine.

Let me replicate the error, I will post stats.log shortly.

Thanks

Here is the stats.log file.
stats.zip (658.9 KB)

When I ping using ICMP or UDP, my packets are delivered, but not with TCP.

and here is what it prints on my screen, 2 packets (UDP) accepted, and 2 packets (TCP) dropped.

and if I do not run any rule, the packets are still dropped.

So I solved the problem by setting drop-invalid to no in the stream settings in suricata.yaml. I am not sure why it was considering the packets to be invalid because I generated them using hping3, and they seem fine.