From 20b4c4d863d40f4b6cc1fd68eed17d1214a05f9e Mon Sep 17 00:00:00 2001 From: Stefan Schantl Date: Mon, 18 Feb 2019 10:01:47 +0100 Subject: [PATCH] suricata: Swith to "16" as repeat-mark and repeat-mask. Marks "1-3" are used for marking source-natted packets on the interfaces and 4 up to 6 for TOS and QOS. The mark "32" is used by IPsec. See commit: f5ad510e3c0f416a1507999f5ad20ab171df9c07 Signed-off-by: Stefan Schantl --- config/suricata/suricata.yaml | 4 ++-- src/initscripts/system/suricata | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index 67b9e8a7d2..4fbd32b850 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -117,8 +117,8 @@ logging: nfq: mode: repeat - repeat-mark: 2 - repeat-mask: 2 + repeat-mark: 16 + repeat-mask: 16 # bypass-mark: 1 # bypass-mask: 1 # route-queue: 2 diff --git a/src/initscripts/system/suricata b/src/initscripts/system/suricata index 458aed44da..d2c758660c 100644 --- a/src/initscripts/system/suricata +++ b/src/initscripts/system/suricata @@ -29,8 +29,8 @@ NFQ_OPTS="--queue-bypass " network_zones=( red green blue orange ) # Mark and Mask options. -MARK="0x2" -MASK="0x2" +MARK="0x16" +MASK="0x16" # PID file of suricata. PID_FILE="/var/run/suricata.pid" -- 2.39.2