Suricata

IPS did not pass traffic with or without pass rules:

pass ip any any <> any any (msg:"IP pass"; sid:3031; rev:1;)

pass tcp any any <> any any (msg:"TCP pass"; sid:3032; rev:1;)

related: https://redmine.openinfosecfoundation.org/issues/6587

As mentioned in the other bug, I am finding the same behavior using af-packet in tap and IPS mode.

Hi @Francis Trudeau,

have you tested the functionality with other capture modes as well?
Can't it be possible there is a configuration issue?

Sorry, ok, I followed your comments in other tickets and I see there is some underlying issue with the setup/Suricata. Considering it works neither with AFP or with DPDK it seems like the capture modules is not the one to blame.

Lukas Sismis wrote in #note-3:

Hi @Francis Trudeau,

have you tested the functionality with other capture modes as well?
Can't it be possible there is a configuration issue?

See this related bug:

https://redmine.openinfosecfoundation.org/issues/6587

If I create a bridge and use the same config file, except with '-i br0' instead of '--dpdk', I see detections.

This is also happening with '--af-packet'