<html><body><div style="font-family: lucida console,sans-serif; font-size: 12pt; color: #000000"><div>Hello Everyone,</div><div>Can't figure out how to insert nfq connection mark in drop rules in /etc/suricata/modify.conf.</div><div>First one works, second incorrect.</div><div>Any help thank you.</div><div><br></div><div><div>re:. ^alert drop</div><div>re:. ";)$" "; nfq_set_mark:0x2\/0xffffffff;)" </div></div></div></body></html>