<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hello,<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">Il giorno 1 dic 2018, alle ore 21:06, James Moe <<a href="mailto:jimoe@sohnen-moe.com" class="">jimoe@sohnen-moe.com</a>> ha scritto:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 28/11/2018 12.54 PM, Giuseppe Longo wrote:<br class=""><br class=""><blockquote type="cite" class=""><blockquote type="cite" class="">Chain OUTPUT (policy ACCEPT)<br class="">target prot opt source destination<br class="">NFQUEUE all -- anywhere anywhere NFQUEUE<br class="">num 0 bypass<br class=""></blockquote><br class="">Ok, looks correct.<br class="">Would you be able to generate a pcap and send it?<br class=""><br class=""></blockquote> For the instance:<br class="">12/01/2018-12:45:33.386511 [Drop] [**] [1:2260002:1] SURICATA Applayer<br class="">Detect protocol only one direction [**] [Classification: Generic<br class="">Protocol Command Decode] [Priority: 3] {TCP} 190.64.84.98:47029 -><br class="">192.168.69.246:25<br class=""><br class="">The PCAP filtered for IP.addr = 190.64.84.98:<br class=""><a href="https://www.dropbox.com/s/6ydhzr6vo5to566/suricata-rule-2260002.pcapng?dl=0" class="">https://www.dropbox.com/s/6ydhzr6vo5to566/suricata-rule-2260002.pcapng?dl=0</a><br class=""></div></div></blockquote><br class=""></div>'DROP: FALSE’ in alert-debug.log means that actually the _flow_ is not dropped.<div class="">Technically speaking, FLOW_ACTION_DROP flag is not set when your rule is </div><div class="">matching but the packet itself is dropped as you can see in your alert event</div><div class="">In eve.json ("action":”blocked”).</div><div class="">I think looking at ips.blocked counter is stats.log should confirm too.</div><div class=""><br class=""></div><div class="">The flow/stream is dropped when the drop action is triggered from the IP-only</div><div class="">module, or from a reassembled msg and/or from an applayer detection. (stream-tcp.c:4728)</div><div class=""><br class=""></div><div class="">At the end, everything should be fine. The packet is dropped and it is correct to see</div><div class="">‘drop:false’ in alert-debug.log. (if I’m not wrong.)</div><div class=""><br class=""></div><div class="">Giuseppe</div></body></html>