Actions
Security #5571
closed
VJ
ips: encapsulated packet logged as dropped, but not actually dropped
Security #5571:
ips: encapsulated packet logged as dropped, but not actually dropped
Git IDs:
Severity:
HIGH
Disclosure Date:
Description
We just upgraded from Suricata 6.0.6 setup in IPS with NFQUEUE to Suricata 6.0.8 with the same setup.
We have a drop rule in place (same rule since 6.0.6).
When we initiate traffic from the Suricata instance itself to the site that match the drop rule we get the following (correct) behavior:- fast.log logs the drop entry
- The traffic is actually dropped
- fast.log logs the drop entry
- The traffic is NOT dropped
Actions