Open Information Security Foundation

10/14/2019

11:11 PM Suricata Documentation #3222: Configuring ipv6

I'd love to help any way I can
Daniel Vein

10/05/2019

08:40 PM Suricata Documentation #3222 (New): Configuring ipv6

suricata.yaml documentation doesn't mention how to set up ipv6 for HOME_NET var or host-os-policy.
For HOME var it... Daniel Vein

10/04/2019

10:38 PM Suricata Support #3197: suricata dropping traffic on alert

I was able to figure it out I had rule set to drop but it never triggered an alert.
alert http any any -> any any ... Daniel Vein

10/02/2019

09:09 PM Suricata Support #3197: suricata dropping traffic on alert

I used drop.conf to change rules and tested that drop rules do drop and show [drop] on fast.log but alert rules show ... Daniel Vein

09/28/2019

11:33 PM Suricata Support #3197: suricata dropping traffic on alert

user@debian:/var/run/suricata$ sudo suricata -c /etc/suricata/suricata.yaml -q 0 -q 1 --user suri --group suri -vvv
... Daniel Vein

09/27/2019

02:25 AM Suricata Support #3197 (Closed): suricata dropping traffic on alert

I probably have something misconfigured but suricata seems to drop traffic on alert on inline.
fast.log
09/26/... Daniel Vein

09/22/2019

08:58 PM Suricata Support #3183: Dropping privileges on debian. Permission denied to bind to socket

You can close this support ticket. I was able to figure it out looking at Bug #1973. I needed to change the default d... Daniel Vein

04:25 AM Suricata Support #3183 (Closed): Dropping privileges on debian. Permission denied to bind to socket

user@debian:~$ sudo suricata -c /etc/suricata/suricata.yaml -q 0 --user suri --group suri
21/9/2019 -- 23:02:23 - <N... Daniel Vein

04:19 AM Suricata Support #3126: Suricata can't drop privilages on Debian 10

Sorry to get back so late but my hardrive failed... could be part the issue. I decided to use debians suricata packag... Daniel Vein

08/28/2019

11:27 PM Suricata Support #3126: Suricata can't drop privilages on Debian 10

I tried your way but still no go, same errors. I then tried to correct permissions (which I'm not sure is the correct... Daniel Vein