Suricata

Sorry, but how suricata can ignore packets (local or capture mode) if the callback is only call once per flow. It souldn't be called for all packets of flow ?

Roger Vulliez wrote in #note-2:

Sorry, but how suricata can ignore packets (local or capture mode) if the callback is only call once per flow. It souldn't be called for all packets of flow ?

No, the idea is that the capture method knows the details of the flow and no longer passes packets on that flow to Suricata anymore. One good example is a custom capture card that supports bypass. Suricata notifies the card of the flow it wants bypassed, the card will then track that flow and not send packets on that flow to Suricata, freeing up Suricata for other packets.

OK, I use NFQ, if I understand correctly only the first packet have to be bypassed is marked (bypass-mark), in firawall rules I have to copy this mark to connection and no queueing those pakects to suricata ?

        chain output-ips{
                type filter hook output priority 1;

                ct mark *bypass-mark* accept
                queue 0-1
        }

        chain output-ips-mark{
                type filter hook input priority 2;

                ct mark set mark
        }

Same for input.