<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #3366ff"><div>Any info on this is appreciated ... please help. </div><div><br></div><div data-marker="__SIG_PRE__"><div><span style="color: rgb(51, 102, 255);" data-mce-style="color: #3366ff;">Thanks & regards,</span><br></div><div><span style="color: rgb(51, 102, 255);" data-mce-style="color: #3366ff;">Vishal V. Kotalwar</span></div></div><br><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Vishal Kotalwar V" <vishalkv@altencalsoftlabs.com><br><b>To: </b>"oisf-users" <oisf-users@lists.openinfosecfoundation.org><br><b>Sent: </b>Tuesday, May 10, 2016 4:57:00 PM<br><b>Subject: </b>[Oisf-users] Suricata inspects all packets?<br></div><br><div data-marker="__QUOTED_TEXT__"><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #3366ff"><div>Hi,</div><div> I am new to IPS/IDS and netfilter framework. I have a query on packet handling by suricata & netfilter.</div><br><div>In IPS mode, we add iptables rule to pass packets to NFQ on which suricata is listening. Suricata processes those packets and issues verdict for that flow. </div><div>Does netfilter send packets from same flow to suricata even after verdict is given? I would assume that conntrack would kick-in here to bypass the queuing for optimization ...</div><div>is that right? But conntrack is not mandatory for suricata/netfilter functioning.</div><br><div>Please help me understand ... </div><br><div><div><span style="color: rgb(51, 102, 255);">Thanks & regards,</span><br></div><div><span style="color: rgb(51, 102, 255);">Vishal V. Kotalwar</span></div></div></div><br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>Suricata User Conference November 9-11 in Washington, DC: http://oisfevents.net<br></div></div></body></html>