I have built two simple rules
alert tcp any any -> any any (msg: "tcp detected"; sid: 2; rev: 1;) alert udp any any -> any any (msg: "udp detected"; sid: 1; rev: 1;)
Then from the same machine I do an nmap
nmap -sU myipaddress
Issue is, I get alerts from all other traffic but for the nmap I do not get any alerts. Does suricata have a rule to ignore the kind of traffic that destination ip = origin ip?