<!DOCTYPE html>
<html><head>
<meta charset="UTF-8">
</head><body><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: rgb(0, 0, 128);">Hello Kevin</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: rgb(0, 0, 128);">Assuming you are running Suricata in NFQ mode, you should be able to direct (by iptables rule) just the http/https traffic to Suri. You control this further by destination/port based rule too. In which case you won't be seeing any other alerts! </p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: rgb(0, 0, 128);">You should also be able to fine tune the IDS rule set to a point that it only monitors the traffic you require.</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: rgb(0, 0, 128);">We have a number of in cloud servers running exactly the same way and will be happy to share configs if required.</p><p style="font-size: 12pt; font-family: arial, helvetica, sans-serif; color: rgb(0, 0, 128);">Amar</p><blockquote type="cite">On April 22, 2018 at 10:26 PM Kevin Branch <kevin@branchnetconsulting.com> wrote: <br> <br><div dir="ltr"><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;">Hi all,</div><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;"><br></div><span style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff; float: none; display: inline;">I've used Suricata for years but always on a dedicated NIDS server for inspecting traffic behind a network firewall. Now I am trying a local install of Suricata on a Linux cloud server whose traffic I want to inspect. The server uses iptables to block all incoming connections other than http/https. My problem is that Suricata is generating lots of alerts about incoming connection attempts (scanning noise) that iptables is blocking anyway, which I would rather not hear about.</span><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;"><br></div><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;">Is there a way to make Suricata ignore packets that have already been dropped by the local iptables? I've toyed with the idea of using the iptables tee facility to pump a subset of eth0 traffic to a dummy0 interface and then having Suricata inspect that instead, but I thought I'd check in here to see if anyone has a better approach already working for them.</div><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;"><br></div><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;">Thanks,</div><div style="color: #222222; font-family: arial,sans-serif; font-size: 12.8px; font-style: normal; font-weight: 400; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; background-color: #ffffff;">Kevin</div><br></div>_______________________________________________ <br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org <br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/ <br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users <br> <br>Conference: https://suricon.net <br>Trainings: https://suricata-ids.org/training/</blockquote></body></html>