Log PACKET_DROP in inline mode for invalid states as well
There are several spots like in "StreamTcpPacketStateNone" in stream-tcp.c where we drop packets if suricata is run in inline mode (NFQUEUE in my case) and we don't log anything about the packets, just increase the ips.blocked counter. While it was a faulty configuration (only one part of the connection was send into the NFQUEUE) i would still say that if we have suricata in IPS mode we should log the drops with more detail somehow, maybe use some messages we have for SCLogDebug for normal logging (drop.log for example).
Using the debug mode isn't very reasonable for a productive system but you might still end up with packet drops and want to see why they got dropped although no rule triggered.
At least we should add some output option to enable this kind of logging. Adding some lines to drop.log like "[DROP] $PACKETINFO - $REASON" shouldn't affect performance that much.
Updated by Andreas Herz about 3 years ago
They are a subset of the ips.blocked so like ips.blocked."reason" so while the generic counter increasing won't be something odd a huge counter for dropped packets to some invalid traffic type might be something to be easier spot by that.
But I don't remember the specific details from back then :)