[Oisf-users] Packets stucked in Nfqueue when running inline

[Fernando Ortiz]

2011/6/30 Eric Leblond <eric at regit.org>

> Hello,
>
> Is it possible for you to provide your ruleset or at least the NFQUEUE
> part (which chain is used ) ?
>
>
I am so sorry, for leaving this topic abandoned.

The NFQUEUE part:

iptables -A FORWARD  -m statistic --mode nth --every 2 -j NFQUEUE
--queue-num 2
iptables -A FORWARD  -j NFQUEUE --queue-num 1

Rules unchanged from Emerging
Threats<http://rules.emergingthreats.net/open/suricata/rules/>
:
 - botcc.rules
 - emerging-activex.rules
 - emerging-attack_response.rules
 - emerging-dos.rules
 - emerging-exploit.rules
 - emerging-ftp.rules
 - emerging-games.rules - emerging-pop3.rules - emerging-scan.rules
 - emerging-trojan.rules
 - emerging-virus.rules
 - emerging-voip.rules
 - emerging-web_client.rules
 - emerging-web_server.rules
 - emerging-user_agents.rules
 - emerging-current_events.rules
 - emerging-worm.rules

On the other hand, I had Suricata running for 16 days, and in that time,
only 300 packets in total were stucked in queues. Kind of weird. I did
upgrade suricata, this time running version 1.1beta2 (rev e5cc68a)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20110711/1e1c31df/attachment-0002.html>