Why does af-packet not support IPS?

Help
1

I have tested af-packet on two different types of servers. Why can’t af-packe drop packets in IPS mode?But the alert message is displayed in the log.
Is it because my network card does not support af-packet?

My machine configuration：
ubuntu18.04
kernel version: 4.15.0-112-generic
Ethernet controller: Intel Corporation I211 Gigabit Network Connection

af-packet:

  • interface: enp1s0
    threads: 1
    defrag: no
    cluster-type: cluster_flow
    cluster-id: 98
    copy-mode: ips
    copy-iface: enp2s0
    buffer-size: 64535
    use-mmap: yes
  • interface: enp2s0
    threads: 1
    cluster-id: 97
    defrag: no
    cluster-type: cluster_flow
    copy-mode: ips
    copy-iface: enp1s0
    buffer-size: 64535
    use-mmap: yes
2

In order to get the IPS function to work, you need to set the action in signatures to drop from alert.

3

The reject and drop signatures are invalid.
For example:
reject tcp any any -> any any (msg:“IPS”; content:“google”; sid:10002; rev:1;)
drop tcp any any -> any any (msg:“IPS”; content:“google”; sid:10002; rev:1;)

4

I can just comment that in the /etc/default/suricata config file is written that only the nfqueue mode supports IPS:
# Listen mode: pcap, nfqueue, custom_nfqueue or af-packet
# depending on this value, only one of the two following options
# will be used (af-packet uses neither).
# Please note that IPS mode is only available when using nfqueue
LISTENMODE=af-packet