Hello, ok an short update, it looks like suricata drops the whole traffic, but just for a short time. I guess this comes from the "seconds 10" config? Is there a way to higher the drop time? Regards Michael