Hi Team, In Suricata 6.0.12 I see below flow drop log but unable to troubleshoot the root cause for this drop. Can somebody share the reason/troubleshooting steps for fixing the below flow drop error ? { “timestamp”: “2025-04-10T05:24:26.547841-0400”, “flow_id”: 1001867926354188, “in_iface”: “b…

Hi, thanks for posting to our community. Suricata 6 is no longer supported; we urge you to use the latest stable release – Suricata 7.0.10 There’s not enough information in your post - we ask that additional information including deployment (ids or ips?) configuration (suricata.yaml), how suricata…

[image] Jeff Lucovsky: Suricata 7.0.10 and if it reproduces with that version, please post here with additional contextual information so we can better help. "We have deployed Suricata as an IPS, operating in bridge mode, and installed it from the source. It is running on Red Hat Enterprise L…

There’s still not enough information to fully describe what’s happening. As an experiment, there’s a setting in suricata.yaml that could be changed: exception-policy: ignore to see what effect it has. This is just a guess based on limited information.

What would be the impact of setting exception-policy: ignore? Is this exception policy supported in Suricata 6.0.12? Additionally, under which section of the suricata.yaml file (e.g., stream, flow, etc.) should this be configured? Let me know what are all other information required from the suricat…

My guess was incorrect as in Suricata 6, the default value auto has the same effect as ignore. You could provide your suricata.yaml file after removing the rule variables (those are typically the only sensitive part of the file). I’d be willing to take a brief look but as Suri 6 is no longer suppo…

Suricata6 drops flow

Rules

kajamuhaiyadeen April 10, 2025, 2:47pm 7

I found the problematic rule.

1 Like