SURICATA STREAM Packet with invalid timestamp

[Draithan]

Hey Everyone... Looking for some advice. I have alot of these alerts in the log and would like to resolve rather then hide...

I am running XCP-NG on a Dell R620, with a pfsense VM. I have made sure all my clocks are in sync, turned off offloading on the VM's.

I do get the odd "SURICATA STREAM excessive "retransmissions" as well.

Any help appreciated! :) And yes I am relatively new to PFsense, Suricata etc. Thank you.

[NollipfSense]

@draithan It's a false positive and because that, I am no longer bothered by them.

[bmeeks]

All of the Suricata stream events are for information only. They generally do not indicate threat. Many folks do disable lots of those built-in EVENTS-type rules, especially when running in Legacy Blocking Mode as they can result in needless blocks of traffic.

[SteveITS]

@draithan In our standard Suricata setup we:

• check "Disable hardware checksum offload" in (System->Advanced->Networking)
• Suricata: disable ALL stream-events.rules or it will block lots of traffic on false positives

[Draithan]

@steveits said in SURICATA STREAM Packet with invalid timestamp:

@draithan In our standard Suricata setup we:

• check "Disable hardware checksum offload" in (System->Advanced->Networking)
• Suricata: disable ALL stream-events.rules or it will block lots of traffic on false positives

Ok thanks for the confirmation. Appreciate it. Not seeing anyone posting to not disable..

Appreciate everyones help!