<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #3366ff"><div>Hi,</div><div> I am new to IPS/IDS and netfilter framework. I have a query on packet handling by suricata & netfilter.</div><div><br data-mce-bogus="1"></div><div>In IPS mode, we add iptables rule to pass packets to NFQ on which suricata is listening. Suricata processes those packets and issues verdict for that flow. </div><div>Does netfilter send packets from same flow to suricata even after verdict is given? I would assume that conntrack would kick-in here to bypass the queuing for optimization ...</div><div>is that right? But conntrack is not mandatory for suricata/netfilter functioning.</div><div><br data-mce-bogus="1"></div><div>Please help me understand ... </div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="color: rgb(51, 102, 255);" data-mce-style="color: #3366ff;">Thanks & regards,</span><br></div><div><span style="color: rgb(51, 102, 255);" data-mce-style="color: #3366ff;">Vishal V. Kotalwar</span></div></div></div></body></html>