Actions
Bug #4220
openfailed to hit a signature with option --simulate-ips
Affected Versions:
Effort:
Difficulty:
Label:
Description
Hi,
I have a pcap trace which can hit my signature with the configurations in the attachment in IDS mode.
But the same trace failed to hit the same signature with the same configuration in IPS mode.
Is it by design or a bug?
How to reproduce:
1. uncompress the tar.gz to /home/inline-test, make sure all files are under /home/inline-test
2. cd /home/inline-test
3. ntd-ids -c ./suricata.yaml -r ./1flowB.pcap, and we can see eve logs.
4. ntd-ids -c ./suricata.yaml -r ./1flowB.pcap --simulate-ips, and we can't see any eve logs.
Files
Actions