I think it should be better to read the proxy config which port is used.
Many installtions still use 800

Arne


Am 2020-04-01 11:02, schrieb Stefan Schantl:
> Fixes #12308.
> 
> Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
> ---
>  config/suricata/suricata.yaml | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/config/suricata/suricata.yaml 
> b/config/suricata/suricata.yaml
> index cb7ececb4..4a605c272 100644
> --- a/config/suricata/suricata.yaml
> +++ b/config/suricata/suricata.yaml
> @@ -30,7 +30,7 @@ vars:
>      ENIP_SERVER: "$HOME_NET"
> 
>    port-groups:
> -    HTTP_PORTS: "[80,81]"
> +    HTTP_PORTS: "[80,81,3128]"
>      SHELLCODE_PORTS: "!80"
>      ORACLE_PORTS: 1521
>      SSH_PORTS: "[22,222]"