What the Intrusion Detection sees of a connection in hardware, measured - and the pages that say so, 2026-10-24
Suricata, OPNsense's Intrusion Detection, listens on this host. A connection the flow maker hands to the coprocessor no longer crosses it, so in IDS mode - which only listens - and in IPS mode without "Inspect, then hardware" running, Suricata sees how each connection starts and nothing after it. No page said so until today; asked about on the OPNsense forum. Since this change XGS: Overview and XGS: Settings say it whenever it is the case (what it cannot do).
The whole page, with how it was taken and what it does not show: What the Intrusion Detection sees of a connection in hardware, measured - and the pages that say so, 2026-10-24.
The discussion of this page is held in the project's GitHub Discussions. Showing it here loads giscus from giscus.app and GitHub, and writing in it needs a GitHub account - what that means.