[Oisf-users] suppress in threshold + packets dropped

[Andreas Herz]

On 28/11/16 at 09:05, erik clark wrote:
> I am supressing 33 signatures with
> 
> suppress gen_id 1, sig_id $sid
> 
> Since doing this, I see that Suricata is dropping around 12% of the
> packets. This doesnt make any sense. Are suppressed signatures "dropped"?
> Why are my stats crazy like this?

Do you have an example rule?
You might have run into this issue:

https://redmine.openinfosecfoundation.org/issues/1247

-- 
Andreas Herz