<html><body><div id="edo-message"><div></div>Hello Ayhan</div><div id="edo-message"><br></div><div id="edo-message">If you don’t mind me asking; what are you trying to acheive in real terms?</div><div id="edo-message">Eg.</div><div id="edo-message">If you NEED to stop certain traffic, ( eg rdp) from entering your network, why not place the system in line. You will need three interfaces....unless you want the management port to double as in/out too.</div><div id="edo-message"><br></div><div id="edo-message">Reject is a rather raw way to Prevent (ips) as you could end up flooding your network with reset requests. </div><div id="edo-message"><br></div><div id="edo-message">In terms of your specific question I would guess that while the system is busy sending resets it is missing some of the other traffic! May be completely wrong here though!</div><div id="edo-message"><br></div><div id="edo-message">Anyway if you want Prevention just stick it in line with the world and the switch.</div><div id="edo-message"><br></div><div id="edo-message">Best</div><div id="edo-message">Amar Rathore</div><div id="edo-message">www.countersnipe.com</div><div id="edo-message"><br></div><div id="edo-meta"></div><div id="edo-original"><div><br><br><blockquote type="cite" style="margin:1ex 0 0 0;border-left:1px #ccc solid;padding-left:0.5ex;"><div>On Oct 1, 2019 at 3:13 PM, <<a href="mailto:ayhanardaistanbul@gmail.com">Ayhan ARDA</a>> wrote:<br><br></div><div><div dir="ltr">Hello,<div><br></div><div>I hope I'm writing it in the right place..</div><div><br></div><div>I have a security onion server and I have 2 interfaces. <br>The first is for management. The second is to sniff.<br>I mirrored the uplink port of the switch for sniff interface. (no inline traffic, only port mirror)<br>Everything works so well.(kibana,squert vs..)<br>I'm using the Suricata engine for alerting.<br>There are a few things I'm curious about.<br>I can see all the events.<br>I can reject some rules but not all of them. I tested this, for example when I reject off some rdp traffic and and my access is cut off. This is a good thing.<br>I only do this by typing reject at the beginning of the rule.<br><u>I wonder how did this rejection process? Because I only have one interface for sniff. </u>Why doesn't this method work in some rules?<br>Is this interface sending a tcp reset request to my Switch?<br>Why are some rejection rules working and others not?<br>Do I need a third interface for tcp rst packet to switch? <br><br>Regards<br>Ayhan ARDA<br><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><br><div></div></div></div></div></div>
</div></blockquote></div></div></body></html>