On 13/11/18 at 21:10, James Moe wrote: > On 11/11/2018 5.07 PM, James Moe wrote: > > > Does "[Drop]" not mean that the packet is dropped (blocked)? > > > Time and study has not resolved this issue. Can you share how you are running suricata? Which configuration are you using? Are the rules changed from alert to drop? -- Andreas Herz