Suricata IPS not dropping packets, rather just creating alert.

I configured suricata as an IPS by following this tutorial - But the system is not dropping the packets even after I modified the rule woth sid 2100498 from alert to modify in the suricata.rules. yet this is just creating the alert and not dropping the packet when i test it out. Can anyone help me

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Site Moderator
Site Moderator badge
February 12, 2023

Hello @zakiscubadiver

You can inspect the local rules file - /var/lib/suricata/rules/local.rules and check if you have any allow rules before the block ones. This might cause a similar experience.

Hope that this helps!

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up