Re: Snort 3 not dropping packets in IPS/inline mode

You can enable packet tracer to debug the issue and see if the verdict was applied correctly:

packet_tracer = { enable = true, }

and you can also capture the pcap to see if tcp RST is generated correctly for both directions.
If you are using VLAN, please try the latest code, there was a bug fix related to drop connection for vlan traffic.


From: Snort-users <[email protected]> on behalf of Mikha George via Snort-users <[email protected]>
Date: Wednesday, January 19, 2022 at 5:43 PM
To: [email protected] <[email protected]>
Subject: [Snort-users] Snort 3 not dropping packets in IPS/inline mode
Snort 3 is not dropping the packets even after the rule specifies to block packets. It is running in inline mode and shows drop but the packets are being sent however.

Snort is using the DAQ modules for running in inline mode. The command I use to run snort is as below:

./snort --daq-dir /usr/local/lib/daq --daq afpacket --daq-var debug --daq-var fanout_type=hash -i eth0:eth1 -Q -R /usr/local/snort/rules/local.rules -A alert_fast

I have two network interfaces attached as required which are up and running.

Any help is highly appreciated and would mean a lot. PFA screenshot for reference.



Thanks & Regards,

Mikha George
[cid:ii_kylgfhtu0]

[cid:ii_kylggav31]

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette