I followed a harmless request from my Windows client into Suricata, changed only its test signature to drop, and then restored it to alert. HTTPS and DNS controls checked that ordinary traffic still worked while the selected request was blocked.
This page keeps the shared controls, retained measurements, failures, and comparison limits together. The linked files are there when you need the underlying table or method.
This is a physical client-to-Vault check with exact connection evidence. The test signature verifies this inspection path; it is not a detection-rate study or inspection of decrypted HTTPS payloads.
You can reuse Trevor-measured data from this page under the repository MIT terms. Retain the required notices when reusing the project documentation, and credit Trevor Unland when citing this run. Project media has separate terms in the repository.
Open the details under any row for the specific setup, outcome, artifact identity, and supporting file.
Physical path · alert-only
Measured on Protectli V1610 · Owned Vault test
HTTP 200 returned the exact 39-byte UID body, and the original EVE record identified SID 2100498 with action allowed for the matching connection.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · alert-only
Physical path · inline Netmap drop
Measured on Protectli V1610 · Owned Vault test
curl timed out after ten seconds without a response body, while the exact corresponding EVE connection was recorded as blocked. Both observations are required for this result.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · inline Netmap drop
Physical path · HTTPS and DNS controls
Measured on Protectli V1610 · Owned Vault test
Certificate-validated HTTPS and a DNS lookup through the Vault both passed while the selected fixture rule was active.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · HTTPS and DNS controls
Physical path · test rule returned to alert
Measured on Protectli V1610 · Owned Vault test
The repeated UID request returned HTTP 200 and 39 bytes, with an exact allowed EVE match and the generated signature action back at alert.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Physical path · test rule returned to alert
Final installed snapshot
Measured on Protectli V1610 · Owned Vault test
Native validation exited successfully with dependency-complete selected rules. The final snapshot held 37,125 active rules: 37,121 alerts and four drops across ten enabled categories. Feed updates can change these counts.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Final installed snapshot
Recorded appliance configuration
Measured on Protectli V1610 · Owned Vault test
Listener, rule and console checks confirmed LAN-only HTTPS management, disabled SSH and password-protected console access. The off-device XML matched its device-side SHA256; five boot environments were retained on the SSD. The XML stays private because it contains secrets, and same-disk boot environments do not replace it.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Recorded appliance configuration
Supporting evidence
These are the few files that support this page directly. The repository holds the wider project history.