[Oisf-users] Suricata as an IPS

[Charles Devoe]

There is a bit of a debate going on here as to whether Suricata has to be inline to work in IPS mode.

The confusion is coming from this

Reject
This is an active rejection of the packet. Both receiver and sender receive a reject packet. There are two types of reject packets that will be automatically selected. If the offending packet concerns TCP, it will be a Reset-packet. For all other protocols it will be an ICMP-error packet. Suricata also generates an alert. When in Inline/IPS mode, the offending packet will also be dropped like with the 'drop' action.


Some are reading this as we can monitor on one interface and send out the reject over  a management interface.  In essence we would receive traffic via a tap or SPAN/Mirror port and send it back out over a management port.

So the bottom line here :  Is it possible to run Suricata as an IPS without being in line.




This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.

. . . . .
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20191119/8d025d34/attachment.html>