<html><body><div style="font-family: lucida console,sans-serif; font-size: 12pt; color: #000000"><div>Hello Jason,</div><div>Thank you, you solution is helped resolve the issue. </div><div>As side note. When matched traffic is marked is it make sense set it as DROP in rule action ? Or just let firewall put source ip in ipset with timeout and then just drop.</div><div><br data-mce-bogus="1"></div><div>Slava.</div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Jason Ish" <ish@unx.ca><br><b>To: </b>"oisf-users" <oisf-users@lists.openinfosecfoundation.org><br><b>Sent: </b>Thursday, October 18, 2018 2:37:49 PM<br><b>Subject: </b>Re: [Oisf-users] suricata update modify<br></div><div><br></div><div data-marker="__QUOTED_TEXT__"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Hi Slava,</div><div dir="ltr"><br></div><div class="gmail_quote"><div dir="ltr">On Thu, Oct 18, 2018 at 5:58 AM Slava Bendersky <<a href="mailto:volga629@networklab.ca" target="_blank">volga629@networklab.ca</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div style="font-family:"lucida console",sans-serif;font-size:12pt;color:rgb(0,0,0)"><div>Hello Everyone,</div><div>Can't figure out how to insert nfq connection mark in drop rules in /etc/suricata/modify.conf.</div><div>First one works, second incorrect.</div><div>Any help thank you.</div><br><div><div>re:. ^alert drop</div><div>re:. ";)$" "; nfq_set_mark:0x2\/0xffffffff;)" </div></div></div></div></blockquote><br><div>In your second line you'll have to escape the ')' as its not part of a regular expression grouping, so this will have it looking like:</div><br><div>re:. ";\)$" "; nfq_set_mark:0x2\/0xffffffff;)" <br></div><br><div>Also, in your "to" expression you should not be escaping the "/", this will result in a rule that won't be loaded by Suricata. So what I think you are looking for is:</div><br><div>re:. ";\)$" "; nfq_set_mark:0x2/0xffffffff;)" <br></div><br><div>Hope that helps,</div><div>Jason</div></div></div></div></div>
<br>_______________________________________________<br>Suricata IDS Users mailing list: oisf-users@openinfosecfoundation.org<br>Site: http://suricata-ids.org | Support: http://suricata-ids.org/support/<br>List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br><br>Conference: https://suricon.net<br>Trainings: https://suricata-ids.org/training/<br></div></div></body></html>