Suricata

Suricata matches the traffic on a network against rules and records an alert when it finds something suspicious. It is open source software developed by the non-profit OISF, and with a different setup it can also block traffic.

This review is for people who have read packets in Wireshark and now want to try something that watches traffic automatically. After reading it, you can do the following:

• Install Suricata on a test Ubuntu machine and fetch rules
• Trigger an alert with a test rule and read the logs
• Explain the difference between IDS mode and IPS mode

##What Suricata is for

The official documentation describes Suricata as a network IDS, IPS, and network security monitoring (NSM) engine.

• It matches traffic against rules and records matches as alerts
• It writes results to fast.log (one line per alert) and eve.json (detailed records in JSON)
• It can read saved pcap files and inspect them later
• In IPS mode, it can block traffic that matches rules

##IDS mode and IPS mode

To run IPS mode on Linux, for example, you send traffic to NFQUEUE with iptables and start Suricata with the -q option and a queue number. The steps in this review cover IDS mode only.

##Try it safely on a test Ubuntu machine

Use a virtual machine you built yourself and inspect only that machine’s own traffic. These steps follow the official quickstart.

1. Add the official PPA and install Suricata and jq, a tool for reading JSON.

   sudo add-apt-repository ppa:oisf/suricata-stable
   sudo apt update
   sudo apt install suricata jq

2. Run ip addr to find the network interface name and IP address.

3. Open /etc/suricata/suricata.yaml and check that HOME_NET includes your network. Set interface in the af-packet section to the name you found in step 2.

4. Run sudo suricata-update to fetch rules. By default, it installs the ET Open ruleset in /var/lib/suricata/rules.

5. Restart Suricata with sudo systemctl restart suricata.

6. In another terminal, run sudo tail -f /var/log/suricata/fast.log. Then run curl http://testmynids.org/uid/index.html. This URL returns a response that matches a test rule in ET Open (sid 2100498).

7. If an alert line appears in fast.log, detection is working.

##Get and manage rules

Use suricata-update, which ships with Suricata, to fetch and update rules.

The official docs recommend updating rules often. You can also add rules you write yourself as a rule file.

##Common command line options

With -r, you can inspect pcap files you recorded yourself in Wireshark.

##Cautions

##Read next

• cd ../wiresharkWiresharkreads the packets behind an alert one at a time
• cd ../wazuhWazuha monitoring platform that collects Suricata alerts in a dashboard
• cat ~/guides/lab-setup.mdHow to set up a safe test lab