SURICATA STREAM Packet with invalid timestamp
-
Hey Everyone... Looking for some advice. I have alot of these alerts in the log and would like to resolve rather then hide...
I am running XCP-NG on a Dell R620, with a pfsense VM. I have made sure all my clocks are in sync, turned off offloading on the VM's.
I do get the odd "SURICATA STREAM excessive "retransmissions" as well.
Any help appreciated! :) And yes I am relatively new to PFsense, Suricata etc. Thank you.
-
@draithan It's a false positive and because that, I am no longer bothered by them.
-
All of the Suricata stream events are for information only. They generally do not indicate threat. Many folks do disable lots of those built-in EVENTS-type rules, especially when running in Legacy Blocking Mode as they can result in needless blocks of traffic.
-
@draithan In our standard Suricata setup we:
• check "Disable hardware checksum offload" in (System->Advanced->Networking)
• Suricata: disable ALL stream-events.rules or it will block lots of traffic on false positives -
@steveits said in SURICATA STREAM Packet with invalid timestamp:
@draithan In our standard Suricata setup we:
• check "Disable hardware checksum offload" in (System->Advanced->Networking)
• Suricata: disable ALL stream-events.rules or it will block lots of traffic on false positivesOk thanks for the confirmation. Appreciate it. Not seeing anyone posting to not disable..
Appreciate everyones help!
