discard

Description

Causes the current packet or connection (depending on the context of the event) to be dropped/discarded and the rule continues (no implied return). This command is identical to drop.

Syntax

discard

discard

  • Causes the current packet or connection (depending on the context of the event) to be discarded. Nothing is sent to the client.
  • Removes the corresponding entry from the system connection table. Note that, in the case of TCP, if subsequent segments arrive without SYN bit set (and ACK bit unset), a RST will be sent as a result. This is the standard behavior when segments of that type arrive when there is no system connection entry.

Examples

when SERVER_CONNECTED {
  if { [IP::addr [IP::client_addr] equals 10.1.1.80] } {
     discard
     log local0. "connection discarded from [IP::client_addr]"
  }
 }

After “discard” is executed, the rule will continue until the end of the current event so “connection discarded …” will be logged.