Suricata

abarna

Any one knows Why below logs shown in suricata.
After suricata crashed
07/16/2026-18:01:25.191657 [] [1:2210054:1] SURICATA STREAM excessive retransmissions [] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 172.16.255.24:61541 -> 172.16.255.30:2010
07/21/2026-13:14:42.216343 [] [1:2210054:1] SURICATA STREAM excessive retransmissions [] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 172.16.255.30:41624 -> 172.16.255.13:8042
07/21/2026-18:35:19.016540 [] [1:2210054:1] SURICATA STREAM excessive retransmissions [] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 172.16.255.13:54826 -> 172.16.255.30:2010

Note:
Above is implement pfsense community edition 2.8, What might be the reason.
FYI also allowing direct internet also

SteveITS

@abarna We found we had to disable all the stream rules.

Be aware when the package is upgraded any categories that are unchecked are re enabled. There is a specific way to disable them permanently if desired.

bmeeks

Many of the Suricata STREAM EVENTS rules will generate false positives. Those rules are primarily informational and not necessarily indicative of malicious intent. My recommendation was to always disable the EVENTS rules (there are several categories of them that ship installed by default with Suricata from upstream).

When the Suricata package is reinstalled or updated on pfSense (which is basically a reinstall as well), the default supplied EVENTS rules are automatically enabled. This was done to make sure any new EVENTS rules were made available, but an unfortunate side effect is any manual disabling the admin had previously configured on the RULES tab was lost in the update.

To make changes to the EVENTS rules permanent, use the SID MGMT tab features. SID management configuration runs with each startup of Suricata, and rules disabled there remain disabled and won't get "default enabled" again with package updates.