# \#suricata **URL:** https://forum.suricata.io/tag/suricata/25.md [Latest](https://forum.suricata.io/latest.md) · [Categories](https://forum.suricata.io/categories.md) · [Tags](https://forum.suricata.io/tags.md) --- ## [Suricata 8.0.7 with NFQUEUE causes outbound TCP connections to hang, even with no OUTPUT queue](https://forum.suricata.io/t/suricata-8-0-7-with-nfqueue-causes-outbound-tcp-connections-to-hang-even-with-no-output-queue/6523)
**Author:** [@sfullak](https://forum.suricata.io/u/sfullak)\ **Replies:** 0\ **Last updated:** [October 9, 2026, 3:02pm UTC](https://forum.suricata.io/t/suricata-8-0-7-with-nfqueue-causes-outbound-tcp-connections-to-hang-even-with-no-output-queue/6523 "2026-10-09T15:02:17Z")
Hello, I’m running Suricata in IPS mode on a public Debian server, using nftables and NFQUEUE. When Suricata is running, new outbound TCP connections from the server can hang, even though the NFQUEUE rule is in the INP… --- ## [Libsuricata status](https://forum.suricata.io/t/libsuricata-status/6476)
**Author:** [@cvontela\_microsoft](https://forum.suricata.io/u/cvontela_microsoft)\ **Replies:** 3\ **Last updated:** [October 2, 2026, 9:19pm UTC](https://forum.suricata.io/t/libsuricata-status/6476 "2026-10-02T21:19:45Z")
Hi Devs, I would appreciate your guidance on current status of libsuricata, can you please help answer: What is current maturity and intended use of libsuricata? Is its API considered experimental or suitable for pordu… --- ## [Packetless Application layer interface](https://forum.suricata.io/t/packetless-application-layer-interface/6477)
**Author:** [@cvontela\_microsoft](https://forum.suricata.io/u/cvontela_microsoft)\ **Replies:** 4\ **Last updated:** [October 2, 2026, 9:19pm UTC](https://forum.suricata.io/t/packetless-application-layer-interface/6477 "2026-10-02T21:19:38Z")
Hi Developers, I am evaluating Suricata to provide IDPS for traffic from L3-L7 and I see the drawback is it only accepts packet level input. In our scenario where TLS termination happens later after L3/4 inspection and … --- ## [Possible NFQUEUE bug: repeat-mark omitted with batchcount \> 1 in workers mode](https://forum.suricata.io/t/possible-nfqueue-bug-repeat-mark-omitted-with-batchcount-1-in-workers-mode/6478)
**Author:** [@cvontela\_microsoft](https://forum.suricata.io/u/cvontela_microsoft)\ **Replies:** 0\ **Last updated:** [October 1, 2026, 9:54pm UTC](https://forum.suricata.io/t/possible-nfqueue-bug-repeat-mark-omitted-with-batchcount-1-in-workers-mode/6478 "2026-10-01T21:54:19Z")
We reproduced an NFQUEUE packet loop with Suricata 8.0.7 when combining workers mode, repeat mode and verdict batching. Suricata is started with: suricata -c /etc/suricata/suricata.yaml -q 1000 –runmode workers Rele… --- ## [Building a dedicated Suricata box for inline/transparent bridge IPS function on Linux Mint](https://forum.suricata.io/t/building-a-dedicated-suricata-box-for-inline-transparent-bridge-ips-function-on-linux-mint/6448)
**Author:** [@Goros](https://forum.suricata.io/u/Goros)\ **Replies:** 7\ **Last updated:** [September 11, 2026, 4:21pm UTC](https://forum.suricata.io/t/building-a-dedicated-suricata-box-for-inline-transparent-bridge-ips-function-on-linux-mint/6448 "2026-09-11T16:21:13Z")
Hi all, I’m both a linux and suricata newbie, so bear with me - my entire computer career has been dos, windows and some mac - I’m not a coder or anything but have a pretty well-built out homelab (so I’m trying to learn… --- ## [Does Suricata 7/8 support compiling from source on Windows 32-bit?](https://forum.suricata.io/t/does-suricata-7-8-support-compiling-from-source-on-windows-32-bit/6418)
**Author:** [@yangxiaolin](https://forum.suricata.io/u/yangxiaolin)\ **Replies:** 2\ **Last updated:** [September 1, 2026, 3:18am UTC](https://forum.suricata.io/t/does-suricata-7-8-support-compiling-from-source-on-windows-32-bit/6418 "2026-09-01T03:18:55Z")
Does Suricata 7/8 support compiling from source on Windows 32-bit? --- ## [Why ET rules used hex bytes instead of the original characters?](https://forum.suricata.io/t/why-et-rules-used-hex-bytes-instead-of-the-original-characters/6438)
**Author:** [@SamFreeman](https://forum.suricata.io/u/SamFreeman)\ **Replies:** 3\ **Last updated:** [August 20, 2026, 8:50am UTC](https://forum.suricata.io/t/why-et-rules-used-hex-bytes-instead-of-the-original-characters/6438 "2026-08-20T08:50:56Z")
Hello everyone! While studying the rules from Emerging Threats, I noticed one peculiarity. In the rules, instead of the original symbols (for example, “.”) their hexadecimal byte values are used. Example Rules: alert… --- ## [Suricata update rules on Windows](https://forum.suricata.io/t/suricata-update-rules-on-windows/3655)
**Author:** [@azazaza.over90000](https://forum.suricata.io/u/azazaza.over90000)\ **Replies:** 3\ **Last updated:** [August 11, 2026, 12:33pm UTC](https://forum.suricata.io/t/suricata-update-rules-on-windows/3655 "2026-08-11T12:33:47Z")
Hello everyone! Tell me, please, how can I set the automatic update of the rules for Suricata on the Windows OS? On Linux, you can use suricata-update, but what about Windows? --- ## [Ja4 Fingerprint match against the dataset when ssl proxy is involved ,whereing Ja4 FP is calculated by proxy](https://forum.suricata.io/t/ja4-fingerprint-match-against-the-dataset-when-ssl-proxy-is-involved-whereing-ja4-fp-is-calculated-by-proxy/6421)
**Author:** [@prathimak](https://forum.suricata.io/u/prathimak)\ **Replies:** 3\ **Last updated:** [August 5, 2026, 8:23am UTC](https://forum.suricata.io/t/ja4-fingerprint-match-against-the-dataset-when-ssl-proxy-is-involved-whereing-ja4-fp-is-calculated-by-proxy/6421 "2026-08-05T08:23:57Z")
Hi everyone, I am deploying Suricata (8.0.5) in a topology where an upstream SSL proxy handles TLS termination/decryption before passing the plaintext traffic to Suricata. Suricata Dataset would be used to support big … --- ## [Running Watcher with Suricata on Windows – Connection Loop / Setup Guidance](https://forum.suricata.io/t/running-watcher-with-suricata-on-windows-connection-loop-setup-guidance/6422)
**Author:** [@Morpheus101](https://forum.suricata.io/u/Morpheus101)\ **Replies:** 0\ **Last updated:** [August 3, 2026, 10:07pm UTC](https://forum.suricata.io/t/running-watcher-with-suricata-on-windows-connection-loop-setup-guidance/6422 "2026-08-03T22:07:10Z")
Hello everyone, I’m trying to get Watcher up and running on a Windows environment alongside the latest build of Suricata, but I’ve hit a roadblock. I managed to get the Watcher web UI to load in the browser, but the in… --- ## [Feature Request: Ability to use local fqdns (to get ipv4 and/or ipv6) in address-groups vars](https://forum.suricata.io/t/feature-request-ability-to-use-local-fqdns-to-get-ipv4-and-or-ipv6-in-address-groups-vars/5735)
**Author:** [@jonny5](https://forum.suricata.io/u/jonny5)\ **Replies:** 6\ **Last updated:** [July 20, 2026, 1:55pm UTC](https://forum.suricata.io/t/feature-request-ability-to-use-local-fqdns-to-get-ipv4-and-or-ipv6-in-address-groups-vars/5735 "2026-07-20T13:55:58Z")
TLDR; What if we add a dynamic feature to address-group vars via fqdn strings in the list? Have Suricata resolve and add/remove as ( static +/- ( dynamic +/- updates) ) or whatever works better. The long: There are se… --- ## [A question about the AF\_PACKET TPACKET\_V3 implementation](https://forum.suricata.io/t/a-question-about-the-af-packet-tpacket-v3-implementation/6415)
**Author:** [@Jal](https://forum.suricata.io/u/Jal)\ **Replies:** 2\ **Last updated:** [July 20, 2026, 2:21am UTC](https://forum.suricata.io/t/a-question-about-the-af-packet-tpacket-v3-implementation/6415 "2026-07-20T02:21:58Z")
Hi, While reading the AF\_PACKET TPACKET\_V3 implementation in Suricata,I have a question and hope to gain some insight In AFPReadFromRingV3(), the ownership of a block is returned to the kernel by writing: pbd-\>hdr.bh1… --- ## [Why Proper Suri Oculus Configuration Matters More Than You Think](https://forum.suricata.io/t/why-proper-suri-oculus-configuration-matters-more-than-you-think/6414)
**Author:** [@fil104](https://forum.suricata.io/u/fil104)\ **Replies:** 0\ **Last updated:** [July 16, 2026, 7:25am UTC](https://forum.suricata.io/t/why-proper-suri-oculus-configuration-matters-more-than-you-think/6414 "2026-07-16T07:25:58Z")
One of the design principles behind Suri Oculus is that many aspects of its behavior are controlled by a single configuration file. It defines what data is collected, how it is processed, and which features are available… --- ## [Excited to share: julioliraup/Antiphishing ruleset is now officially available in suricata-update!](https://forum.suricata.io/t/excited-to-share-julioliraup-antiphishing-ruleset-is-now-officially-available-in-suricata-update/6410)
**Author:** [@julioliraup](https://forum.suricata.io/u/julioliraup)\ **Replies:** 0\ **Last updated:** [July 15, 2026, 12:47pm UTC](https://forum.suricata.io/t/excited-to-share-julioliraup-antiphishing-ruleset-is-now-officially-available-in-suricata-update/6410 "2026-07-15T12:47:04Z")
Hi everyone, I am incredibly excited to announce that my open-source project, julioliraup/Antiphishing, has been officially added to the suricata-update source index! As the author of this project, I developed it from … --- ## [Suri Oculus 4.0 – Local Rules Management](https://forum.suricata.io/t/suri-oculus-4-0-local-rules-management/6400)
**Author:** [@fil104](https://forum.suricata.io/u/fil104)\ **Replies:** 0\ **Last updated:** [July 12, 2026, 1:59pm UTC](https://forum.suricata.io/t/suri-oculus-4-0-local-rules-management/6400 "2026-07-12T13:59:27Z")
One of the areas I’m currently working on for Suri Oculus 4.0 is improving the management of local Suricata rules. Many Suricata deployments eventually accumulate a growing collection of custom rules. These may include … --- ## [Need help in understanding "timestamp" field in "flow" event type of eve.json](https://forum.suricata.io/t/need-help-in-understanding-timestamp-field-in-flow-event-type-of-eve-json/3822)
**Author:** [@aanand](https://forum.suricata.io/u/aanand)\ **Replies:** 2\ **Last updated:** [July 8, 2026, 11:12am UTC](https://forum.suricata.io/t/need-help-in-understanding-timestamp-field-in-flow-event-type-of-eve-json/3822 "2026-07-08T11:12:11Z")
Hi all, I need some help in understanding the meaning of “timestamp” field of flow event types in eve.json output of Suricata. What does this timestamp represent? I noticed that “timestamp” is different from “start” and … --- ## [Rule counters profiling](https://forum.suricata.io/t/rule-counters-profiling/6378)
**Author:** [@user555](https://forum.suricata.io/u/user555)\ **Replies:** 0\ **Last updated:** [June 29, 2026, 7:36pm UTC](https://forum.suricata.io/t/rule-counters-profiling/6378 "2026-06-29T19:36:12Z")
Hello. Are there any ways to access these counters while Suricata is running? For example, via suricatasc. I didn’t find any information about this in the documentation, although it is assumed that the counters exist. --- ## [Suricata IDS on 100Gbps link via AF\_PACKET and an Intel E810-CQDA2 with ICE driver](https://forum.suricata.io/t/suricata-ids-on-100gbps-link-via-af-packet-and-an-intel-e810-cqda2-with-ice-driver/4892)
**Author:** [@greg](https://forum.suricata.io/u/greg)\ **Replies:** 13\ **Last updated:** [June 26, 2026, 5:58pm UTC](https://forum.suricata.io/t/suricata-ids-on-100gbps-link-via-af-packet-and-an-intel-e810-cqda2-with-ice-driver/4892 "2026-06-26T17:58:52Z")
Hello back again with more real world stats and a golden config. This has been a real adventure as I have found tuning Suricata and the underlying system for high throughput is not a simple task, and I have been round a… --- ## [Encrypted traffic inspection](https://forum.suricata.io/t/encrypted-traffic-inspection/2530)
**Author:** [@Daryald](https://forum.suricata.io/u/Daryald)\ **Replies:** 6\ **Last updated:** [June 14, 2026, 9:00pm UTC](https://forum.suricata.io/t/encrypted-traffic-inspection/2530 "2026-06-14T21:00:03Z")
I am trying to decrypt SSL traffic using MITM/Squid proxy and sending it to Suricata (Security Onion), Is this possible? I want to achieve encrypted payload inspection in HTTPS attacks. Ja3 fingerprinting is working fine… --- ## [How to detect HTTPS traffic without decryption?](https://forum.suricata.io/t/how-to-detect-https-traffic-without-decryption/6353)
**Author:** [@Jacob\_Fang](https://forum.suricata.io/u/Jacob_Fang)\ **Replies:** 2\ **Last updated:** [June 7, 2026, 7:48am UTC](https://forum.suricata.io/t/how-to-detect-https-traffic-without-decryption/6353 "2026-06-07T07:48:49Z")
How can I use Suricata to detect and generate alerts for HTTPS traffic without decrypting it? 1. Do not use certificates. --- ## [Pcre vs content](https://forum.suricata.io/t/pcre-vs-content/6346)
**Author:** [@user555](https://forum.suricata.io/u/user555)\ **Replies:** 0\ **Last updated:** [May 26, 2026, 9:24pm UTC](https://forum.suricata.io/t/pcre-vs-content/6346 "2026-05-26T21:24:28Z")
Hello again! Sorry for being a nuisance, but I have another question. The documentation states that regular expressions are executed last, after content matches: https://docs.suricata.io/en/latest/rules/payload-keywords.… --- ## [Alert limit and detection failure in Suricata](https://forum.suricata.io/t/alert-limit-and-detection-failure-in-suricata/6337)
**Author:** [@user555](https://forum.suricata.io/u/user555)\ **Replies:** 0\ **Last updated:** [May 23, 2026, 8:44am UTC](https://forum.suricata.io/t/alert-limit-and-detection-failure-in-suricata/6337 "2026-05-23T08:44:41Z")
Hello dear colleagues, I am testing rule performance and have encountered several problems. Could you please help me figure out if I am doing something wrong? The essence of the problem: I generated signatures (file s… --- ## [Installing suricata 8.0.5](https://forum.suricata.io/t/installing-suricata-8-0-5/6326)
**Author:** [@lohama3491](https://forum.suricata.io/u/lohama3491)\ **Replies:** 2\ **Last updated:** [May 22, 2026, 4:06pm UTC](https://forum.suricata.io/t/installing-suricata-8-0-5/6326 "2026-05-22T16:06:42Z")
Suricata version: 8.0.5 Operating system: Oracle Linux 9 and Oracle Linux 10 Installed suricata from official repo. Hi, I am in the process of updating suricata to latest version, 8.0.5 from 8.0.4. I run sudo dnf inst… --- ## [Path-B r11: bridging Squid ICAP and Suricata AF\_PACKET IPS with a synthetic FlowBus](https://forum.suricata.io/t/path-b-r11-bridging-squid-icap-and-suricata-af-packet-ips-with-a-synthetic-flowbus/6301)
**Author:** [@Cetux](https://forum.suricata.io/u/Cetux)\ **Replies:** 0\ **Last updated:** [May 18, 2026, 8:00am UTC](https://forum.suricata.io/t/path-b-r11-bridging-squid-icap-and-suricata-af-packet-ips-with-a-synthetic-flowbus/6301 "2026-05-18T08:00:22Z")
Hi everyone, I would like to share a small preproduction lab project I have been working on: Path-B v8.0-beta1-r11. It is not meant to be a production security gateway and it is not a dashboard project. It is an archit… --- ## [SuriGuard: A Open Source Graphical Interface for Suricata Logs- - Seeking Contributors and Testers](https://forum.suricata.io/t/suriguard-a-open-source-graphical-interface-for-suricata-logs-seeking-contributors-and-testers/5179)
**Author:** [@Aaron\_Madison](https://forum.suricata.io/u/Aaron_Madison)\ **Replies:** 5\ **Last updated:** [May 14, 2026, 7:19am UTC](https://forum.suricata.io/t/suriguard-a-open-source-graphical-interface-for-suricata-logs-seeking-contributors-and-testers/5179 "2026-05-14T07:19:16Z")
Hello Suricata Community, This project aims to simplify Suricata log processing and make it more accessible to a broader audience, including network analysts, security teams, and even new users unfamiliar with command-l… --- ## [Engineering a Zero-Trust Kubernetes SIEM: Bypassing NAT Blindness with eBPF, TC, and Suricata](https://forum.suricata.io/t/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata/6291)
**Author:** [@Yeslem\_kh](https://forum.suricata.io/u/Yeslem_kh)\ **Replies:** 0\ **Last updated:** [May 13, 2026, 1:27pm UTC](https://forum.suricata.io/t/engineering-a-zero-trust-kubernetes-siem-bypassing-nat-blindness-with-ebpf-tc-and-suricata/6291 "2026-05-13T13:27:41Z")
Standard Kubernetes network security is fundamentally broken by NAT blindness. When an intrusion alert fires, traditional tools show a physical node IP, leaving you guessing which of the hundreds of ephemeral pods is act… --- ## [ClearNDR Community Version](https://forum.suricata.io/t/clearndr-community-version/6282)
**Author:** [@AshZolfi](https://forum.suricata.io/u/AshZolfi)\ **Replies:** 2\ **Last updated:** [May 7, 2026, 8:53am UTC](https://forum.suricata.io/t/clearndr-community-version/6282 "2026-05-07T08:53:48Z")
Hi, I recently started using ClearNDR and need some help with applying filters and creating policies. I find the information overwhelming and have been trying to reduce the amount of data by applying filters, focusing o… --- ## [OISF Suricata PPA does not support Ubuntu 24.04 (noble)](https://forum.suricata.io/t/oisf-suricata-ppa-does-not-support-ubuntu-24-04-noble/4787)
**Author:** [@antoninbas](https://forum.suricata.io/u/antoninbas)\ **Replies:** 5\ **Last updated:** [May 7, 2026, 4:26am UTC](https://forum.suricata.io/t/oisf-suricata-ppa-does-not-support-ubuntu-24-04-noble/4787 "2026-05-07T04:26:53Z")
Following the Ubuntu installation instructions won’t work on the latest LTS Ubuntu release (noble - 24.04). This is because the OISF PPA for Suricata on Launchpad does not support this Ubuntu release. Is there any plan t… --- ## [Showcasing my custom Suricata-powered security firewall project focused on real-time traffic inspection, threat detection, and operational visibility.](https://forum.suricata.io/t/showcasing-my-custom-suricata-powered-security-firewall-project-focused-on-real-time-traffic-inspection-threat-detection-and-operational-visibility/6263)
**Author:** [@Sincan2](https://forum.suricata.io/u/Sincan2)\ **Replies:** 2\ **Last updated:** [May 4, 2026, 3:36pm UTC](https://forum.suricata.io/t/showcasing-my-custom-suricata-powered-security-firewall-project-focused-on-real-time-traffic-inspection-threat-detection-and-operational-visibility/6263 "2026-05-04T15:36:09Z")
Hi Suricata community, I’d like to share a project I’ve been building: a custom security firewall powered by Suricata. The goal of this project was to go beyond a basic IDS/IPS setup and build something more practical … --- ## [Suricata IPS Mode Not Dropping Packets in af-packet Inline Configuration – Need Help!](https://forum.suricata.io/t/suricata-ips-mode-not-dropping-packets-in-af-packet-inline-configuration-need-help/5197)
**Author:** [@KenJ](https://forum.suricata.io/u/KenJ)\ **Replies:** 11\ **Last updated:** [April 26, 2026, 5:43am UTC](https://forum.suricata.io/t/suricata-ips-mode-not-dropping-packets-in-af-packet-inline-configuration-need-help/5197 "2026-04-26T05:43:22Z")
Hello Everyone, After having spent more than a week trying to understand the IPS mode in Suricata, trying both the Netfilter (NFQ) and af-packet modes, I finally decided to configure my Suricata installation as an af-pa… [Next page](https://forum.suricata.io/tag/suricata/25.md?match_all_tags=true&page=1&tags%5B%5D=suricata)