IDS/IPS with Snort and Suricata: Detection and Prevention

Introduction

IDS (Intrusion Detection System) and IPS (Intrusion Prevention System) monitor network traffic for malicious patterns. IDS detects and alerts; IPS can also block. Snort and Suricata are the two most popular open-source options. This guide focuses on Suricata, which is modern, multi-threaded, and actively maintained.

IDS vs IPS Modes

IDS mode: Monitors traffic passively (SPAN port or TAP), alerts only — no blocking
IPS mode: Inline with traffic (between firewall and switch), can drop malicious packets

Installing Suricata

BASH

# Ubuntu 22.04
apt install software-properties-common
add-apt-repository ppa:oisf/suricata-stable
apt update
apt install suricata

# Verify installation
suricata --version

Basic Configuration

Edit /etc/suricata/suricata.yaml:

YAML

# Network interface to monitor
af-packet:
  - interface: eth0
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

# Home network definition (your internal networks)
vars:
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
    EXTERNAL_NET: "!$HOME_NET"

# Outputs
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: /var/log/suricata/eve.json
      types:
        - alert
        - dns
        - http
        - tls
        - flow

Downloading Rules

BASH

# Install suricata-update (rule manager)
pip install suricata-update

# Update rules from Emerging Threats (free)
suricata-update

# List available rule sources
suricata-update list-sources

# Enable additional sources
suricata-update enable-source et/open
suricata-update enable-source ptresearch/attackdetection

# Update all enabled sources
suricata-update

Running Suricata

BASH

# Test configuration
suricata -T -c /etc/suricata/suricata.yaml

# Start as service
systemctl start suricata
systemctl enable suricata

# IDS mode — monitor eth0
suricata -c /etc/suricata/suricata.yaml -i eth0

# Check if running
systemctl status suricata
tail -f /var/log/suricata/suricata.log

Reading Alerts

Alerts are in JSON format in /var/log/suricata/eve.json:

BASH

# Watch for alerts in real-time
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

# Count alerts by signature
cat /var/log/suricata/eve.json | jq 'select(.event_type=="alert") | .alert.signature' | sort | uniq -c | sort -rn | head 20

# Show specific alert details
cat /var/log/suricata/eve.json | jq 'select(.event_type=="alert") | {src_ip, dest_ip, proto, alert}'

Writing Custom Rules

Suricata rules have a specific syntax:

TEXT

action proto src_ip src_port direction dest_ip dest_port (options)

Example rules:

TEXT

# Detect ICMP flood (ping flood)
alert icmp any any -> $HOME_NET any (msg:"Possible ICMP Flood"; threshold: type both, track by_src, count 100, seconds 10; sid:9000001; rev:1;)

# Detect SSH brute force attempt
alert tcp any any -> $HOME_NET 22 (msg:"SSH Brute Force Attempt"; flow:to_server; content:"SSH"; threshold: type threshold, track by_src, count 5, seconds 60; sid:9000002; rev:1;)

# Detect DNS query for known malware domain
alert dns any any -> any any (msg:"Malware DNS Query"; dns.query; content:"malware.example.com"; sid:9000003; rev:1;)

Store custom rules in /etc/suricata/rules/local.rules.

IPS Mode Setup (Inline)

For IPS mode, Suricata sits between interfaces:

BASH

# Enable nfqueue mode in suricata.yaml
# Then use iptables to route traffic through Suricata

iptables -I FORWARD -j NFQUEUE
iptables -I INPUT -j NFQUEUE
iptables -I OUTPUT -j NFQUEUE

# Run Suricata in IPS mode
suricata -c /etc/suricata/suricata.yaml -q 0

Integration with ELK Stack

BASH

# Ship Suricata eve.json to Elasticsearch via Filebeat
# /etc/filebeat/filebeat.yml
filebeat.inputs:
- type: log
  paths:
    - /var/log/suricata/eve.json
  json.keys_under_root: true

output.elasticsearch:
  hosts: ["elasticsearch:9200"]
  index: "suricata-%{+yyyy.MM.dd}"

Summary

Suricata is modern, multi-threaded IDS/IPS — prefer it over Snort for new deployments
Start in IDS mode on a SPAN port before going inline IPS
Update rules regularly with suricata-update
Monitor eve.json logs — integrate with ELK or Graylog for dashboards
Write custom rules for your specific environment threats