Re: Snort 3 not dropping packets in IPS/inline mode

Hi Steven,

Thank you for the response.

Enabling the packet tracer showed the below result.

[image: image.png]

On Thu, Jan 20, 2022 at 9:05 PM Steven Baigal (sbaigal) <[email protected]>
wrote:

> You can enable packet tracer to debug the issue and see if the verdict was
> applied correctly:
>
>
>
> *packet_tracer = { enable = true, }*
>
>
>
> *and you can also capture the pcap to see if tcp RST is generated
> correctly for both directions.*
>
> If you are using VLAN, please try the latest code, there was a bug fix
> related to drop connection for vlan traffic.
>
>
>
>
>
> *From: *Snort-users <[email protected]> on behalf of
> Mikha George via Snort-users <[email protected]>
> *Date: *Wednesday, January 19, 2022 at 5:43 PM
> *To: *[email protected] <[email protected]>
> *Subject: *[Snort-users] Snort 3 not dropping packets in IPS/inline mode
>
> Snort 3 is not dropping the packets even after the rule specifies to block
> packets. It is running in inline mode and shows *drop* but the packets
> are being sent however.
>
> Snort is using the DAQ modules for running in inline mode. The command I
> use to run snort is as below:
>
> *./snort --daq-dir /usr/local/lib/daq --daq afpacket --daq-var debug
> --daq-var fanout_type=hash -i eth0:eth1 -Q -R
> /usr/local/snort/rules/local.rules -A alert_fast*
>
> I have two network interfaces attached as required which are up and
> running.
>
> Any help is highly appreciated and would mean a lot. PFA screenshot
> for reference.
>
>
>
> Thanks & Regards,
>
> Mikha George
>
>
>
>

_______________________________________________
Snort-users mailing list
[email protected]
Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-users

	To unsubscribe, send an email to:
	[email protected]

Please visit http://blog.snort.org to stay current on all the latest Snort news!

Please follow these rules: https://snort.org/faq/what-is-the-mailing-list-etiquette