Type to search…
Skip to content

Suricata

A firewall that looks inside packets - write IDS/IPS signatures and block traffic by content, by protocol and by country.

Taught in
Seguretat i alta disponibilitatTallafocsASIX

Introduction

In Netfilter you wrote rules that decide by looking at the address and the port.

With that you can say let port 443 through.

What you can’t say is let port 443 through except when this travels.

And most attacks aren’t at the network level: they’re inside what travels through the port you’ve opened.

Suricata looks at the content. It’s at once:

  • an IDS (Intrusion Detection System) — generates alerts,
  • an IPS (Intrusion Prevention System) — also drops packets,
  • and an NSM (Network Security Monitoring) — logs everything that passes for later analysis.

Working environment

Create an Ubuntu 24.04 virtual machine in Desktop.

Download the suricata project from xtec:

shell
sudo apt install git
git clone https://gitlab.com/xtec/suricata
cd suricata

The project comes with a script that installs Ansible, which will do the rest of the work:

shell
./ansible.sh

Look at what interfaces the virtual machine has:

shell
ip --brief addr

lo               UNKNOWN        127.0.0.1/8 ::1/128 
enp1s0           UP             192.168.123.11/22 fe80::b4a1:54f4:7454:d2fd/64 
enp2s0           UP             10.2.76.37/16 fe80::d18f:22b8:b29b:935c/64

Next you’ll install Suricata on the enp1s0 interface with the suricata.yaml playbook:

shell
ansible-playbook suricata.yaml --ask-become-pass

Keep reading — it's free.

The rest of this page is open to anyone with a free account. Nothing is sold here and nothing is charged for: the account exists so we know who agreed to the terms, and so we can send you the newsletter if you want it.

Create a free account

You will be asked to accept the Terms · Privacy Policy