Introduction
Suricata is Snort's modern successor: multi-thread engine, deep packet inspection, supports TLS/HTTP/SSH/DNS/SMB, can inspect 10 Gbps with proper hardware.
Three modes:
- IDS: inspect and log alerts (passive)
- IPS: inspect and block malicious packets (active, inline)
- NSM: record traffic for forensics
Rules: Emerging Threats (free), Talos (free with snort.org), Proofpoint (commercial).
Prerequisites
- VPS Debian / Ubuntu
- 2 vCPU minimum, 4+ recommended
- 4 GB RAM
- Root access
- Primary interface identified (eth0, ens3...)
Step 1: Installation
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install -y suricata
sudo suricata --build-info
Step 2: Base configuration
ip a
sudo nano /etc/suricata/suricata.yaml
af-packet:
- interface: ens3
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
use-mmap: yes
vars:
address-groups:
HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
EXTERNAL_NET: "!$HOME_NET"
Step 3: Download ET rules
sudo suricata-update
sudo suricata-update list-sources
sudo suricata-update enable-source et/open
sudo suricata-update enable-source oisf/trafficid
sudo suricata-update
Step 4: Start Suricata
sudo systemctl enable --now suricata
sudo tail -f /var/log/suricata/suricata.log
Look for engine started.
Step 5: View alerts
sudo tail -f /var/log/suricata/fast.log
Test: from another machine:
nmap -sS -O your-vps.com
sudo grep nmap /var/log/suricata/fast.log
Step 6: Parse eve.json
sudo apt install -y jq
sudo tail -n 100 /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
# Count by signature
sudo cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .alert.signature' | sort | uniq -c | sort -rn | head
# Top source IPs
sudo cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .src_ip' | sort | uniq -c | sort -rn | head
Step 7: IPS mode (blocking)
Requires nftables/iptables and patience.
sudo apt install -y nftables
sudo nano /etc/nftables.conf
table inet filter {
chain forward {
type filter hook forward priority 0;
queue num 0
}
}
sudo systemctl enable --now nftables
/etc/default/suricata:
RUN=yes
LISTENMODE=nfqueue
sudo systemctl restart suricata
Suricata receives packets via nfqueue. Rules with drop action block.
Step 8: Write a custom rule
sudo nano /etc/suricata/rules/local.rules
drop http any any -> any any (msg:"Block sqlmap"; content:"sqlmap"; http_user_agent; sid:1000001;)
alert tcp any any -> $HOME_NET 31337 (msg:"Port 31337 classic backdoor"; sid:1000002;)
Enable in suricata.yaml:
rule-files:
- suricata.rules
- local.rules
sudo systemctl restart suricata
Step 9: TLS/crypto detection
alert tls any any -> any any (msg:"Self-signed TLS detected"; tls.subject; content:"CN=self"; sid:1000003;)
List SNI from HTTPS:
sudo cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="tls") | .tls.sni' | sort -u | head
Useful for: C2 detection, suspicious DoH, Tor.
Step 10: Performance
threading:
cpu-affinity:
- management-cpu-set:
cpu: [ 0 ]
- receive-cpu-set:
cpu: [ 0 ]
- worker-cpu-set:
cpu: [ "1-3" ]
mode: "exclusive"
af-packet:
- interface: ens3
ring-size: 32768
block-size: 32768
Step 11: Visualization
Integrate with:
- ELK via Filebeat
- Grafana + Loki
- Wazuh (native)
- SELKS (Suricata + ELK turnkey)
Step 12: Tune false positives
sudo cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .alert.signature_id' | sort | uniq -c | sort -rn | head
echo "2008581" | sudo tee -a /etc/suricata/disable.conf
sudo suricata-update
sudo systemctl restart suricata
Troubleshooting
Suricata won't start
sudo suricata -T -c /etc/suricata/suricata.yaml
No alerts despite nmap test
sudo grep interface /etc/suricata/suricata.yaml
sudo tcpdump -i ens3 host 8.8.8.8 -c 5
Low performance / dropped packets
sudo suricatasc -c "iface-stat ens3"
Increase ring-size, add workers.
"rule-files: file does not exist"
sudo suricata-update
Useful commands
sudo systemctl status suricata
sudo suricatasc -c reload-rules
sudo suricatasc -c "dump-counters"
sudo suricata -r capture.pcap -l /tmp/out
sudo tail -f /var/log/suricata/eve.json | jq
sudo suricata-update && sudo systemctl restart suricata
Conclusion
Suricata provides:
- Known attack detection/blocking
- TLS, DNS, HTTP, SMB visibility
- Compatible with standard SIEM ecosystems
- Multi-gigabit performance with proper tuning
Going further:
- Pair with Zeek for network visibility
- Integrate with Wazuh as event source
- Use SELKS for turnkey stack
Resources
- Official docs: https://docs.suricata.io
- Source: https://github.com/OISF/suricata
- Emerging Threats rules: https://rules.emergingthreats.net
- SELKS: https://www.stamus-networks.com/selks