SURICATA ignore IP based on schedule

[eng3]

I have a local VM that is a vulnerability scanner. Most of its traffic triggers Suricata. Is there a way I can configure it to ignore traffic from to/from the IP during the scheduled scan times? Outside scan time, I'd like to still have protection incase the scanner system becomes compromised.

[bmeeks]

No, Suricata has no feature to allow that. The closest you can get is to create your own cron tasks (two of them) that stop Suricata for the duration of your scan, and then start it again when the scan is complete.

You can stop and start Suricata using the shell script /usr/local/etc/rc.d/suricata.sh.

The commands would be:

/usr/local/etc/rc.d/suricata.sh stop
/usr/local/etc/rc.d/suricata.sh start

Those commands will stop and start Suricata on all configured interfaces. It goes without saying that with the Suricata processes stopped, all hosts are unprotected for the duration of your scan.