Snort 3 + NFQ with IPS mode

[darksky]

Thanks, I replied in the other thread... let's keep our conversation there to simplicity's sake.

IPS mode of snort3 is not dropping traffic

I added -s 64000 to the snort start line. I am confused though... for IPS mode, shouldn't I be using pipeline = 'nfq' not pipeline = 'afpacket'? I have modified my local.lua based on @efahl suggestion:

`/etc/snort/local.lua`

config = 'IPS' -- 'IDS' or 'IPS' pipeline = 'afpacket' -- 'afpacket' or 'nfq' if config == 'IDS' then mode = tap action = 'alert' else mode = inline snort = { ['-Q'] = true } act…