Question
Suricata IPS not dropping packets, rather just creating alert.
I configured suricata as an IPS by following this tutorial - https://www.digitalocean.com/community/tutorials/how-to-configure-suricata-as-an-intrusion-prevention-system-ips-on-ubuntu-20-04. But the system is not dropping the packets even after I modified the rule woth sid 2100498 from alert to modify in the suricata.rules. yet this is just creating the alert and not dropping the packet when i test it out. Can anyone help me
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Hello @zakiscubadiver
You can inspect the local rules file -
/var/lib/suricata/rules/local.rulesand check if you have any allow rules before the block ones. This might cause a similar experience.Hope that this helps!