Open Information Security Foundation

10/25/2019

06:26 PM Suricata Support #3251: Bypass question

And if I use pass. what is the advantage to using bypass rather than just a plain pass statement? Dan Collins

06:24 PM Suricata Support #3251: Bypass question

Peter Manev wrote:
> The action order here is for "alert" , so the defaults in yaml should apply. If you want to max... Dan Collins

03:01 PM Suricata Support #3251: Bypass question

Peter Manev wrote:
> The action order - https://github.com/OISF/suricata/blob/master/suricata.yaml.in#L1074 - is ... Dan Collins

10/24/2019

11:55 PM Suricata Support #3251: Bypass question

Anyone....... Dan Collins

10/16/2019

08:25 PM Suricata Support #3251 (Closed): Bypass question

When using bypass in an alert rule, do the default action-order rules still apply where pass and drop are done before... Dan Collins

10/15/2019

11:22 PM Suricata Support #3224: What happens to packets

Oh, that right, bypass doesn't work with UDP, correct? Dan Collins

11:20 PM Suricata Support #3224: What happens to packets

As a follow up to that. For the purpose of memory and performance, if I want all UDP traffic to pass, is it better to... Dan Collins

10:36 PM Suricata Support #3224: What happens to packets

IPS. Thanks Dan Collins

10:29 PM Suricata Support #3225: Bypass feature

Dan Collins wrote:
> And by the way, I have tested the above rules and they do work. But now I have concerns that th... Dan Collins

10:24 PM Suricata Support #3225: Bypass feature

And by the way, I have tested the above rules and they do work. But now I have concerns that the drop rule is happeni... Dan Collins