[Oisf-users] Suricata inspects all packets?

Tue May 10 11:27:00 UTC 2016

Hi, 
I am new to IPS/IDS and netfilter framework. I have a query on packet handling by suricata & netfilter. 

In IPS mode, we add iptables rule to pass packets to NFQ on which suricata is listening. Suricata processes those packets and issues verdict for that flow. 
Does netfilter send packets from same flow to suricata even after verdict is given? I would assume that conntrack would kick-in here to bypass the queuing for optimization ... 
is that right? But conntrack is not mandatory for suricata/netfilter functioning. 

Please help me understand ... 

Thanks & regards, 
Vishal V. Kotalwar 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20160510/51ed7827/attachment.html>