What happens to a packet that has no matching rule in Suricata. I assume it is ignored, but haven't found any definitive info on this.
So, if my assumption is correct and the packet is ignored, would it be better to capture all non pass matched packets with a drop rule for performance purposes or would the drop rule just increase the resource usage?
Essentially I am asking if matching every packet is a better approach. What are the pros and cons?
As a IDS/IPS Suricata is not used for white-listing anything which is allowed but for detecting signatures of known attacks, i.e. black-listing known malicious things. Insofar a rule to match everything and drop would not make any sense since this would essentially drop most of the innocent traffic. The expected behavior is instead to pass everything which was not specifically detected as attack. And this is what Suricata is doing when run as IPS inline.
