Suricata IOS blocked

micropone

which rule set has IOS apple updates and youtube listed… Cant watch youtube on mobile's

thanks in advance

bmeeks

which rule set has IOS apple updates and youtube listed… Cant watch youtube on mobile's

thanks in advance

My first suspicion would be alerts from the stream5 preprocessor. It can give a lot of false positives in some environments. You will need to look on the ALERTS tab to see which alerts are firing on your IOS devices. Should be able to track things down using the IP addresses of the Apple devices to match up with alerts on the ALERTS tab.

Bill

micropone

thanks Bill…

bmeeks

@micropone:

thanks Bill…

Once you locate the offending alerts on the ALERTS tab, you can then decide if they are likely false positives. If you conclude they are, you can simply disable those rules by clicking the red X icon in the column on the far right for GID:SID.

Bill

micropone

thanks I got it working…. and yes I red X'ed it...