Suricata not taking account suppress list

[jorgek]

How to use the suppress list in Suricata to don't log alerts such as
SURICATA STREAM Packet with invalid timestamp.

Below is the rule I created to ignore those alerts/blocking:

Apparently, even with this rule, Suricata still keep alerting/blocking.
Anything am I missing?

Thanks

[bmeeks]

@jorgek said in Suricata not taking account suppress list:

How to use the suppress list in Suricata to don't log alerts such as
SURICATA STREAM Packet with invalid timestamp.

Below is the rule I created to ignore those alerts/blocking:

Apparently, even with this rule, Suricata still keep alerting/blocking.
Anything am I missing?

Thanks

Once you have created this custom Suppress List, you will need to go back to the INTERFACE SETTINGS tab for the interface where you want to use the list. Scroll down to the Suppress List drop-down selector and select your custom list. Save the change on that tab, and then go over to the INTERFACES tab and restart Suricata on the interface for it to see the list. The SUPPRESS tab is where you create or edit Suppression Lists, but they are not used until assigned to an interface on its respective INTERFACE SETTINGS tab.

If you did all of the above steps already, and the Suppression List is not working, you may have duplicate Suricata processes running on the same interface. If that is the case, only one of the processes will respond to the Suppress List change. The other duplicate(s) will not. To see if you have multiple running instances on the same interface, run this command from a shell prompt on the firewall:

ps -ax | grep suricata

You should see exactly one process per configured Suricata interface. If you see any duplicates, you will need to kill them. Easiest way to do this is to run these commands from the same shell prompt:

/usr/local/etc/rc.d/suricata.sh stop
ps -ax | grep suricata
kill -9 <pid>

where <pid> is the process ID of any remaining Suricata processes. You can then restart Suricata on all interfaces using this command:

/usr/local/etc/rc.d/suricata.sh start

[jorgek]

@bmeeks Thanks, I didn't notice that option in interface settings. I did that and now I am monitoring the behavior of Suricata. Cheers