On Sun, Oct 09, 2016 at 09:43:16PM +0200, Andreas Herz wrote: >Can you also be specific about _how_ you run suricata? >So NFQUEUE or AF_PACKET IPS mode? --af-packet has the problem, --pcap does not Mike Stone