<html><head></head><body>With one of the networks we monitor, the ISP was under a DDoS attack yesterday. It appears that Suricata kept functioning the whole time the attack was occurring because we kept seeing events. However, somewhere along the way the IPS appeared to lock up. The appliance was rebooted and everything came back to normal.<br><br>We run the IPS in AF-Packet mode. The actual network we monitor was not directly under the DDoS attack but slow Internet response times was experienced.<br><br>Is it possible that Suricata was experiencing some resource exhaustion? Logs did not show anything wrong.<br><br>Thanks.<br><br>Leonard<br><br><br></body></html>