<html><head></head><body>Just because the signature has the word drop in it does not mean it will drop the packet unles you have IPS mode configured and action in signature is set to "drop"<div><br></div><div>Do you have IPS mode configured and enabled? Either use NFQUEUE compiled in Suricata or use AF-Packet mode.<br><div><br></div><div>Leonard<font face="Arial" size="4"><br></font><br><br><br><div><strong>
From:
</strong>
James Moe <jimoe@sohnen-moe.com>
<br>
<strong>
To:
</strong>
"oisf-users@lists.openinfosecfoundation.org" <oisf-users@lists.openinfosecfoundation.org>
<br>
<strong>
Sent:
</strong>
3/4/2016 6:02 PM
<br>
<strong>
Subject:
</strong>
[Oisf-users] How do I get IPF mode to, well, P?
<br><br><blockquote class="mori" style="margin:0 0 0 .8ex;border-left:1px solid #CCC;padding-left:1ex;">Hello,<br> opensuse 42.1<br> linux 4.1.15-8-default x86_64<br> suricata 3.0<br><br> suricata is built in IPF mode using NFQUEUE.<br> I see this in <fast.log>, thinking the packet should be dropped:<br>03/04/2016-13:34:38.972801 [**] [1:2402000:3998] ET DROP Dshield Block<br>Listed Source group 1 [**] [Classification: Misc Attack] [Priority: 2]<br>{TCP} 185.130.5.98:43578 -> 192.168.69.246:587<br><br> <drop.log> is size 0, as always.<br> - drop:<br> enabled: yes # no<br> filename: drop.log<br> append: yes<br><br> My understanding of IPF was that suricata would block, or drop,<br>certain packets to prevent intrusion. Clearly my understanding is deficient.<br> How does suricata actually prevent intrusion?<br><br>-- <br>James Moe<br>moe dot james at sohnen-moe dot com<br>520.743.3936<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net</blockquote></div></div></div></body></html>