[PATCH 19/20] suricata: Start capture first and then load rules

Signed-off-by: Michael Tremer michael.tremer@ipfire.org --- config/suricata/suricata.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/config/suricata/suricata.yaml b/config/suricata/suricata.yaml index cedf49589..f53905b55 100644 --- a/config/suricata/suricata.yaml +++ b/config/suricata/suricata.yaml @@ -608,9 +608,10 @@ detect: toserver-groups: 25 sgh-mpm-context: auto inspection-recursion-limit: 3000 + # If set to yes, the loading of signatures will be made after the capture # is started. This will limit the downtime in IPS mode. - #delayed-detect: yes + delayed-detect: yes

prefilter: # default prefiltering setting. "mpm" only creates MPM/fast_pattern