Quote from: dinguz on June 28, 2026, 11:46:48 PMWorth keeping in mind: with quick-match rule evaluation (the pf default), the first blocklist rule that matches gets the hit, and the packet never reaches the rules below it
Quote from: franco on Today at 10:43:29 AMIf you have manual rules to migrate then you will set hybrid or manual, but that is already set for your use case.
If you don't have manual rules nothing needs to be migrated.
Cheers,
Franco
red@cerberus:~ $ sudo sockstat | grep suricata
root suricata 29596 3 dgram -> /var/run/log
root suricata 29596 6 div4 *:8000 *:*
fred@cerberus:~ $
fred@cerberus:~ $
fred@cerberus:~ $ sudo ps auxwww | grep suricata
root 29596 0.1 23.8 2723192 1922216 - Ss 20Jun26 96:13.75 /usr/local/bin/suricata -D -d 8000 --pidfile /var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml
fred 19042 0.0 0.0 13744 2032 0 S+ 10:40 0:00.00 grep suricata
fred@cerberus:~ $
fred@cerberus:~ $
fred@cerberus:~ $ sudo fstat | grep suricata
root suricata 29596 text / 248115 -rwxr-xr-x 11994960 r
root suricata 29596 wd / 34 drwxr-xr-x 28 r
root suricata 29596 root / 34 drwxr-xr-x 28 r
root suricata 29596 0 /dev 20 crw-rw-rw- null rw
root suricata 29596 1 /dev 20 crw-rw-rw- null rw
root suricata 29596 2 /dev 20 crw-rw-rw- null rw
root suricata 29596 3* local dgram fffff8001bb27640 <-> fffff8001bce2dc0
root suricata 29596 4 /var/log 27980 -rw-r----- 0 w
root suricata 29596 5 - 476 -rw-r----- 6318542 w
root suricata 29596 6* divert raw 0 0fred@cerberus:~ $ sudo sockstat | grep suricata
root suricata 29596 3 dgram (not connected)
root suricata 29596 6 div4 *:8000 *:*
fred@cerberus:~ $
fred@cerberus:~ $ sudo ps auxwww | grep suricata
root 29596 0.1 23.8 2723192 1922216 - Ss 20Jun26 96:15.42 /usr/local/bin/suricata -D -d 8000 --pidfile /var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml
root 44586 0.0 0.0 14312 2888 - I 10:44 0:00.01 /bin/sh /usr/local/etc/rc.d/suricata stop
fred 67953 0.0 0.0 13744 2336 0 S+ 10:46 0:00.00 grep suricata
fred@cerberus:~ $
fred@cerberus:~ $ sudo fstat | grep suricata
root suricata 29596 text / 248115 -rwxr-xr-x 11994960 r
root suricata 29596 wd / 34 drwxr-xr-x 28 r
root suricata 29596 root / 34 drwxr-xr-x 28 r
root suricata 29596 0 /dev 20 crw-rw-rw- null rw
root suricata 29596 1 /dev 20 crw-rw-rw- null rw
root suricata 29596 2 /dev 20 crw-rw-rw- null rw
root suricata 29596 3* local dgram fffff8001bb27640
root suricata 29596 4 /var/log 27980 -rw-r----- 0 w
root suricata 29596 5 - 476 -rw-r----- 6320460 w
root suricata 29596 6* divert raw 0 0