Snort 3 not dropping packets in IPS/inline mode

Snort 3 is not dropping the packets even after the rule specifies to block
packets. It is running in inline mode and shows *drop* but the packets are
being sent however.

Snort is using the DAQ modules for running in inline mode. The command I
use to run snort is as below:

*./snort --daq-dir /usr/local/lib/daq --daq afpacket --daq-var debug
--daq-var fanout_type=hash -i eth0:eth1 -Q -R
/usr/local/snort/rules/local.rules -A alert_fast*

I have two network interfaces attached as required which are up and running.

Any help is highly appreciated and would mean a lot. PFA screenshot
for reference.


Thanks & Regards,

Mikha George
[image: image.png]

[image: image.png]

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette