Hi, I am running suricata in IPS mode. I have just one simple rule, which is to alert me of any ip traffic. The rule is triggering fine. However, all of my tcp packets are being dropped. I am not sure why this is happening.

So I solved the problem by setting drop-invalid to no in the stream settings in suricata.yaml. I am not sure why it was considering the packets to be invalid because I generated them using hping3, and they seem fine.

Suricata in IPS mode dropping tcp traffic

Help

cs.lev (cs.lev) April 17, 2024, 8:34am 13

Found solution here

The key was to set the exception-policy from auto to either ignore or bypass.

1 Like

DPDK_VPP can't receive packets when DPDK_Suricata is launched because primary mode conflicts?

Topic		Replies	Views
Suricata 5.0.6 inline on RHEL dropping tls traffic with no alerts Help ips , centos , rules	4	879	August 29, 2021
Suricata don't reject http/ssh Help ips	2	674	March 16, 2023
Is Suricata dropping the packets or blocking the attacker's IP? Help ips	6	7030	January 31, 2021
Inline Configuration not working Help ips , suricata	1	36	November 4, 2024
Suricata IPS NFQUEUE mode not dropping Packets Help	1	1059	July 9, 2021

Suricata in IPS mode dropping tcp traffic

Related topics