Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining signature-based and protocol anomaly detection with file extraction.
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for high-throughput, protocol-aware traffic inspection (HTTP, TLS, DNS, SMB) and SIEM integration. Use when running Suricata in IDS or inline IPS mode to detect or block malicious traffic, or when combining signature-based and protocol anomaly detection with file extraction.
Deploying a high-performance IDS/IPS capable of multi-threaded packet processing for 10+ Gbps network links
Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols
Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers
Running in inline (IPS) mode to actively block malicious traffic at network choke points
Combining signature-based detection with protocol anomaly detection and file extraction
Do not use as a standalone security solution without complementary controls, for encrypted traffic inspection without TLS decryption capabilities, or on systems with insufficient CPU/memory for the expected traffic volume.
Prerequisites
Suricata 7.0+ installed from PPA or source (suricata --build-info)
Network interface on a span port, tap, or inline bridge for traffic capture
AF_PACKET or DPDK support for high-performance packet capture
Emerging Threats Open or Pro ruleset subscription (or Snort Talos rules via oinkcode)
suricata-update tool for automated rule management
Elasticsearch/Kibana or Splunk for log analysis and visualization
# Disable NIC offloading featuressudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off sg off
# Set interface to promiscuous modesudo ip linkset eth1 promisc on
# For high-performance deployments, configure AF_PACKET with multiple threads# Edit /etc/suricata/suricata.yaml
Step 3: Configure suricata.yaml
# /etc/suricata/suricata.yaml (key sections)# Network variablesvars:address-groups:HOME_NET:"[10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]"EXTERNAL_NET:"!$HOME_NET"HTTP_SERVERS:"$HOME_NET"DNS_SERVERS:"$HOME_NET"SMTP_SERVERS:"$HOME_NET"# Default rule pathdefault-rule-path:/var/lib/suricata/rulesrule-files:-suricata.rules# AF_PACKET configuration for high performanceaf-packet:-interface:eth1threads:autocluster-id:99cluster-type:cluster_flowdefrag:yesuse-mmap:yesring-size:200000buffer-size:262144# EVE JSON logging (primary output format)outputs:-eve-log:enabled:yesfiletype:regularfilename:eve.jsonpcap-file:falsecommunity-id:truetypes:-alert:tagged-packets:yespayload:yespayload-printable:yeshttp-body:yeshttp-body-printable:yes-http:extended:yes-dns:query:yesanswer:yes-tls:extended:yes-files:force-magic:yesforce-hash: [md5, sha256]
-smtp:extended:yes-flow-netflow-anomaly:enabled:yes-stats:totals:yesthreads:yes# PCAP logging for captured packets that trigger alerts-pcap-log:enabled:yesfilename:alert-%n.pcaplimit:100mbmax-files:50mode:normaluse-stream-depth:nohonor-pass-rules:no# Stream engine settingsstream:memcap:512mbchecksum-validation:noreassembly:memcap:1gbdepth:1mbtoserver-chunk-size:2560toclient-chunk-size:2560# Detection enginedetect:profile:highcustom-values:toclient-groups:200toserver-groups:200sgh-mpm-context:autoinspection-recursion-limit:3000# Protocol detection and parsingapp-layer:protocols:http:enabled:yesmemcap:64mbtls:enabled:yesdetection-ports:dp:443,8443ja3-fingerprints:yesdns:enabled:yestcp:enabled:yesudp:enabled:yessmb:enabled:yesdetection-ports:dp:139,445ssh:enabled:yeshassh:yes
Step 4: Download and Manage Rulesets
# Update Suricata rules using suricata-updatesudo suricata-update
# Enable additional rule sourcessudo suricata-update list-sources
sudo suricata-update enable-source et/open
sudo suricata-update enable-source oisf/trafficid
sudo suricata-update enable-source ptresearch/attackdetection
# Update with all enabled sourcessudo suricata-update
# Check rule statisticssudo suricata-update list-sources --enabled
wc -l /var/lib/suricata/rules/suricata.rules
# Disable noisy rulessudotee /etc/suricata/disable.conf << 'EOF'# Disable overly broad rules
2100498
2013028
2210000-2210050
group:emerging-policy.rules
EOF
# Create custom local rulessudotee /etc/suricata/rules/local.rules << 'EOF'# Detect reverse shell connections
alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"LOCAL Reverse Shell Port 4444"; flow:established,to_server; content:"|2f 62 69 6e 2f|"; sid:9000001; rev:1; classtype:trojan-activity; priority:1;)
# Detect DNS tunneling by query length
alert dns $HOME_NET any -> any any (msg:"LOCAL DNS Tunneling Long Query"; dns.query; content:"."; offset:50; sid:9000002; rev:1; classtype:policy-violation; priority:2;)
# Detect TLS to suspicious JA3 hash (Cobalt Strike default)
alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL Cobalt Strike JA3 Hash"; ja3.hash; content:"72a589da586844d7f0818ce684948eea"; sid:9000003; rev:1; classtype:trojan-activity; priority:1;)
# Detect SSH brute force
alert ssh $EXTERNAL_NET any -> $HOME_NET 22 (msg:"LOCAL SSH Brute Force Attempt"; flow:to_server; threshold:type both, track by_src, count 10, seconds 60; sid:9000004; rev:1; classtype:attempted-admin; priority:2;)
# Detect data exfiltration via HTTP POST (large uploads)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"LOCAL Large HTTP POST Upload"; flow:to_server,established; http.method; content:"POST"; http.content_len; content:">"; byte_test:8,>,10000000,0,string; sid:9000005; rev:1; classtype:policy-violation; priority:2;)
EOF
# Add local rules to configurationecho" - local.rules" | sudotee -a /etc/suricata/suricata.yaml
Step 5: Deploy and Validate
# Validate configurationsudo suricata -T -c /etc/suricata/suricata.yaml -v
# Run Suricata in IDS modesudo suricata -c /etc/suricata/suricata.yaml --af-packet=eth1 -D
# Or run in IPS mode (inline with NFQueue)# First configure iptables to send traffic to NFQueue# sudo iptables -I FORWARD -j NFQUEUE --queue-num 0# sudo suricata -c /etc/suricata/suricata.yaml -q 0 -D# Create systemd servicesudotee /etc/systemd/system/suricata.service << 'EOF'
[Unit]
Description=Suricata IDS/IPS
After=network.target
Requires=network.target
[Service]
Type=simple
ExecStartPre=/usr/bin/suricata -T -c /etc/suricata/suricata.yaml
ExecStart=/usr/bin/suricata -c /etc/suricata/suricata.yaml --af-packet=eth1 --pidfile /var/run/suricata.pid
ExecReload=/bin/kill -USR2 $MAINPID
Restart=on-failure
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable --now suricata
# Test with a known signature
curl http://testmynids.org/uid/index.html
# Should trigger ET GPL rule for uid.# Verify alerts are generatedsudotail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
Suricata's primary logging format producing structured JSON events for alerts, protocol metadata, flow records, and statistics
AF_PACKET
Linux kernel packet capture mechanism used by Suricata for high-performance traffic capture with kernel-bypass capabilities
JA3/JA3S
TLS fingerprinting method that creates hash values from TLS Client Hello and Server Hello parameters for identifying applications and malware
HASSH
SSH fingerprinting method similar to JA3 that creates hashes from SSH key exchange parameters to identify SSH client and server implementations
Community ID
Standardized flow identifier hash that enables correlation of the same network flow across different monitoring tools (Suricata, Zeek, Wireshark)
suricata-update
Official rule management tool that downloads, merges, and manages multiple rulesets with enable/disable controls
Tools & Systems
Suricata 7.0+: Open-source multi-threaded IDS/IPS/NSM engine with protocol detection, file extraction, and JA3/HASSH fingerprinting
suricata-update: Ruleset management tool supporting ET Open, ET Pro, Snort rules, and custom rule sources
Elastic Stack (ELK): Log aggregation and visualization platform with native Suricata module in Filebeat for dashboards and alerting
Scirius: Web-based Suricata rule management interface for editing, enabling/disabling, and monitoring rule performance
Evebox: Lightweight event viewer for Suricata EVE JSON logs with alert management and escalation capabilities
Common Scenarios
Scenario: Deploying Suricata IDS on a 10 Gbps Enterprise Network Perimeter
Context: A technology company needs to deploy IDS at their internet egress point handling 10 Gbps of traffic. They require protocol-level metadata logging for threat hunting, signature-based alerting for known threats, and JA3 fingerprinting for detecting malware C2 communications. Alerts must feed into their Elastic SIEM.
Approach:
Deploy Suricata on a server with 16 CPU cores, 64 GB RAM, and dual 10G NICs using AF_PACKET with 14 worker threads
Enable ET Open and ptresearch/attackdetection rulesets via suricata-update, totaling approximately 35,000 active rules
Configure EVE JSON logging with community-id, extended HTTP/TLS/DNS metadata, and file hashing (MD5 + SHA256)
Enable JA3 and HASSH fingerprinting for TLS and SSH traffic profiling
Write custom rules for organization-specific threats: known bad JA3 hashes, DNS queries to DGA domains, large data uploads to uncommon destinations
Integrate with Elastic via Filebeat's Suricata module, deploying pre-built Kibana dashboards for real-time visibility
Tune rules over a 2-week baseline period, disabling false-positive generators and adjusting thresholds
Pitfalls:
Not allocating sufficient CPU threads, causing packet drops at peak traffic volumes
Enabling all available rules without tuning, overwhelming analysts with false positives
Forgetting to disable NIC offloading, resulting in incorrect checksums and missed detections
Not enabling community-id, making it difficult to correlate Suricata events with Zeek or other tools
