I kept engine regressions separate from replays of the installed policy. That distinction matters here: the upstream regression cases passed, while the installed rules produced zero alerts on 20 unchanged upstream captures.
This page keeps the shared controls, retained measurements, failures, and comparison limits together. The linked files are there when you need the underlying table or method.
These are offline engine runs on the Vault. Upstream cases carry their own rules and assertions; installed-policy runs use the appliance snapshot. Offline drop records show rule selection, while physical-wire blocking is documented in the separate inline test.
You can reuse Trevor-measured data from this page under the repository MIT terms. Retain the required notices when reusing the project documentation, and credit Trevor Unland when citing this run. Project media has separate terms in the repository.
Open the details under any row for the specific setup, outcome, artifact identity, and supporting file.
Upstream fixtures and their own rules
Measured on Protectli V1610 · Owned Vault test
23 distinct cases passed. One SSH case was skipped because it requires Suricata 9; it is not included as a pass.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Upstream fixtures and their own rules
Unchanged PCAPs · appliance rule snapshot
Measured on Protectli V1610 · Owned Vault test
All 20 replays completed with zero alerts. These captures and the installed policy did not produce alert coverage in this run.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Unchanged PCAPs · appliance rule snapshot
Original invalid TCP checksums retained
Measured on Protectli V1610 · Owned Vault test
The HTTP UID fixture produced one allowed signature alert and other cases produced no alerts. Invalid TCP checksums prevent using this original replay to infer HTTPS stream inspection.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Original invalid TCP checksums retained
Only invalid TCP checksum fields changed
Measured on Protectli V1610 · Owned Vault test
All eight corrected replays completed with zero invalid TCP checksums. HTTP produced three allowed alerts including the UID signature; HTTPS produced one TLS event without a UID alert.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Only invalid TCP checksum fields changed
Inert offline SNI positive and negative fixtures
Measured on Protectli V1610 · Owned Vault test
Four exact names produced blocked matches and drop records. Four suffix negatives and one reserved-domain control avoided those matches; all nine met the authored expectations.
Protectli V1610 · OPNsense 26.7.5 / Suricata 8.0.7_1 · Owned Vault test · Inert offline SNI positive and negative fixtures
Supporting evidence
These are the few files that support this page directly. The repository holds the wider project history.