Suricata IDS/IPS

Suricata is an open-source intrusion detection and prevention system (IDS/IPS) for real-time network traffic analysis on VyOS. This guide covers installing Suricata on VyOS, configuring threat-detection rules, IDS and IPS modes, and integrating with security monitoring in Yandex Cloud and VK Cloud. Suricata performs deep packet inspection (DPI), detects network attacks by signature, and can block malicious traffic in IPS mode.

Overview

What is Suricata

Suricata is a powerful network security engine:

Intrusion Detection System (IDS)
Intrusion Prevention System (IPS)
Network Security Monitoring (NSM)
Real-time network packet analysis
Support for multiple protocols
Open Source project

Key Features

Intrusion Detection (IDS):

Network traffic analysis
Detection of suspicious activity
Detection of attacks and malicious traffic
Alert generation
Passive monitoring mode

Intrusion Prevention (IPS):

Blocking of suspicious traffic
Real-time traffic modification
Preventing attacks before they succeed
Active network protection
Automated response

Network Security Monitoring (NSM):

Collection and analysis of network data
Anomaly detection
Threat identification
Incident forensics
Compliance monitoring

Multi-Protocol Support:

HTTP/HTTPS
FTP/FTPS
SMB/CIFS
SSH
DNS
TLS/SSL
SMTP
And many others

How It Works

Capture - capturing packets from the interface
Decode - decoding protocols
Detection - applying detection rules
Logging - recording events
Alert - generating alerts
Action - performing actions (for IPS)

Installation and Activation

Checking Availability

Suricata is included in VyOS 1.5.x (Circinus) and newer.

Check the VyOS version:

show version

Enabling Suricata

Basic service activation:

set service suricata
commit
save

After activation you must update the rules:

update suricata

The update suricata command:

Downloads the latest detection rules
Updates the configuration
Restarts the service
Is mandatory for correct operation

Basic Configuration

Selecting an Interface to Monitor

Specifying the interface for traffic analysis:

set service suricata interface eth0
commit

Multiple interfaces:

set service suricata interface eth0
set service suricata interface eth1
set service suricata interface eth2
commit

Recommendations:

WAN interface - for detecting external threats
DMZ interface - for protecting public-facing services
LAN interfaces - for internal threat detection

Address Groups

Creating address groups for flexible rules:

set service suricata address-group HOME_NET address 192.168.1.0/24
set service suricata address-group HOME_NET address 10.0.0.0/8
set service suricata address-group HOME_NET address 172.16.0.0/12
commit

Multiple groups:

# Internal network
set service suricata address-group HOME_NET address 192.168.0.0/16
set service suricata address-group HOME_NET address 10.0.0.0/8

# DMZ network
set service suricata address-group DMZ_NET address 192.168.100.0/24

# External (Internet)
set service suricata address-group EXTERNAL_NET address !192.168.0.0/16
set service suricata address-group EXTERNAL_NET address !10.0.0.0/8

# DNS servers
set service suricata address-group DNS_SERVERS address 8.8.8.8
set service suricata address-group DNS_SERVERS address 8.8.4.4

# Web servers
set service suricata address-group WEB_SERVERS address 192.168.100.10
set service suricata address-group WEB_SERVERS address 192.168.100.11

commit

Using negation:

# Everything except the internal network
set service suricata address-group EXTERNAL_NET address !192.168.0.0/16

Port Groups

Creating port groups:

set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTP_PORTS port 8000
commit

Port group examples:

# HTTP ports
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTP_PORTS port 8000
set service suricata port-group HTTP_PORTS port 8888

# HTTPS ports
set service suricata port-group HTTPS_PORTS port 443
set service suricata port-group HTTPS_PORTS port 8443

# SSH ports
set service suricata port-group SSH_PORTS port 22
set service suricata port-group SSH_PORTS port 2222

# Mail ports
set service suricata port-group MAIL_PORTS port 25
set service suricata port-group MAIL_PORTS port 587
set service suricata port-group MAIL_PORTS port 465

# Database ports
set service suricata port-group DB_PORTS port 3306
set service suricata port-group DB_PORTS port 5432
set service suricata port-group DB_PORTS port 1433

commit

Logging Configuration

EVE JSON Logs

EVE (Extensible Event Format) is the primary logging format:

set service suricata log eve filetype regular
commit

File types:

regular - regular file
unix_dgram - Unix domain socket
unix_stream - Unix stream socket

Event Types for Logging

Enabling various event types:

# Alert events
set service suricata log eve alerts

# HTTP transactions
set service suricata log eve http

# DNS queries
set service suricata log eve dns

# TLS/SSL connections
set service suricata log eve tls

# File transactions
set service suricata log eve files

# SSH connections
set service suricata log eve ssh

# Flow records
set service suricata log eve flow

# Statistics
set service suricata log eve stats

commit

Full logging configuration:

set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve dns
set service suricata log eve tls
set service suricata log eve files
set service suricata log eve ssh
set service suricata log eve flow
set service suricata log eve stats
commit

Log Locations

Suricata logs are located in:

/var/log/suricata/eve.json - the primary log in JSON format
/var/log/suricata/fast.log - fast alert format
/var/log/suricata/stats.log - statistics

Rule Management

Updating Rules

Updating the rule set:

update suricata

This command:

Downloads the latest rules from Emerging Threats and other sources
Updates /etc/suricata/suricata.yaml
Restarts Suricata with the new rules

It is recommended to run this regularly (weekly or daily).

Rule Sources

By default, VyOS uses:

Emerging Threats Open - a free rule set
ET/OISF ruleset - community rules

Rule categories:

Malware detection
Exploit attempts
Policy violations
Scan detection
Botnet C&C communication
Phishing attempts
Web attacks

Configuration Examples

Example 1: Basic WAN Protection

# Enable Suricata
set service suricata

# Monitor WAN interface
set service suricata interface eth0

# Define networks
set service suricata address-group HOME_NET address 192.168.1.0/24
set service suricata address-group EXTERNAL_NET address !192.168.1.0/24

# Logging
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve dns

commit
save

# Update rules
update suricata

Example 2: Web Server Protection

# Enable Suricata
set service suricata

# Monitor DMZ interface
set service suricata interface eth2

# Networks
set service suricata address-group DMZ_NET address 192.168.100.0/24
set service suricata address-group WEB_SERVERS address 192.168.100.10
set service suricata address-group WEB_SERVERS address 192.168.100.11

# Ports
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTPS_PORTS port 443

# Logging with HTTP details
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve tls
set service suricata log eve files

commit
save
update suricata

Example 3: Comprehensive Network Protection

# Enable Suricata
set service suricata

# Monitor all interfaces
set service suricata interface eth0
set service suricata interface eth1
set service suricata interface eth2

# Internal networks
set service suricata address-group HOME_NET address 192.168.0.0/16
set service suricata address-group HOME_NET address 10.0.0.0/8

# DMZ
set service suricata address-group DMZ_NET address 192.168.100.0/24

# Critical servers
set service suricata address-group DB_SERVERS address 192.168.50.10
set service suricata address-group DB_SERVERS address 192.168.50.11
set service suricata address-group WEB_SERVERS address 192.168.100.10
set service suricata address-group WEB_SERVERS address 192.168.100.20

# External
set service suricata address-group EXTERNAL_NET address !192.168.0.0/16
set service suricata address-group EXTERNAL_NET address !10.0.0.0/8

# Service ports
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTPS_PORTS port 443
set service suricata port-group SSH_PORTS port 22
set service suricata port-group DB_PORTS port 3306
set service suricata port-group DB_PORTS port 5432

# Comprehensive logging
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve dns
set service suricata log eve tls
set service suricata log eve ssh
set service suricata log eve files
set service suricata log eve flow
set service suricata log eve stats

commit
save
update suricata

Operational Commands

Viewing the Configuration

show service suricata

Displays:

Service status
Monitored interfaces
Address groups
Port groups
Logging settings

Restarting Suricata

restart suricata

A restart is required after:

Changing the configuration
Updating the rules
Modifying interfaces

Updating Rules and Configuration

update suricata

Performs:

Downloading new rules
Updating the configuration
Automatically restarting the service

Viewing Logs

Alerts in real time:

monitor log suricata
tail -f /var/log/suricata/fast.log

EVE JSON logs:

tail -f /var/log/suricata/eve.json | jq

Filtering by event type:

tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="http")'

Statistics:

tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats")'

Log Analysis

EVE JSON Format

Example of an alert event:

{
  "timestamp": "2025-10-15T12:34:56.789123+0000",
  "flow_id": 123456789,
  "event_type": "alert",
  "src_ip": "203.0.113.45",
  "src_port": 54321,
  "dest_ip": "192.168.1.10",
  "dest_port": 80,
  "proto": "TCP",
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 2100498,
    "rev": 7,
    "signature": "GPL ATTACK_RESPONSE id check returned root",
    "category": "Potentially Bad Traffic",
    "severity": 2
  },
  "http": {
    "hostname": "example.com",
    "url": "/admin/",
    "http_method": "GET",
    "http_user_agent": "Mozilla/5.0",
    "status": 200
  }
}

Useful jq Queries

Top attack sources:

cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .src_ip' | sort | uniq -c | sort -rn | head -10

Top signatures:

cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .alert.signature' | sort | uniq -c | sort -rn | head -10

Alerts by severity:

cat /var/log/suricata/eve.json | jq 'select(.event_type=="alert") | select(.alert.severity==1)'

HTTP transactions:

cat /var/log/suricata/eve.json | jq 'select(.event_type=="http") | {host: .http.hostname, url: .http.url, method: .http.http_method}'

DNS queries:

cat /var/log/suricata/eve.json | jq 'select(.event_type=="dns") | {query: .dns.rrname, type: .dns.rrtype}'

SIEM Integration

Sending to Syslog

Syslog configuration on VyOS:

set system syslog host 192.168.1.100 facility local0 level info
set system syslog host 192.168.1.100 format octet-counted
commit

ELK Stack Integration

Filebeat on VyOS:

Installation (if available):

# Via container
set container name filebeat image 'docker.elastic.co/beats/filebeat:8.11.0'
set container name filebeat volume filebeat-config source '/config/filebeat.yml'
set container name filebeat volume suricata-logs source '/var/log/suricata'
commit

Filebeat config (/config/filebeat.yml):

filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/suricata/eve.json
    json.keys_under_root: true
    json.add_error_key: true

output.elasticsearch:
  hosts: ["192.168.1.100:9200"]
  index: "suricata-%{+yyyy.MM.dd}"

setup.kibana:
  host: "192.168.1.100:5601"

Splunk Integration

Splunk Universal Forwarder:

# inputs.conf
[monitor:///var/log/suricata/eve.json]
sourcetype = suricata
index = security

Wazuh Integration

Wazuh agent configuration:

<localfile>
  <log_format>json</log_format>
  <location>/var/log/suricata/eve.json</location>
</localfile>

Troubleshooting

Suricata Does Not Start

Problem: The service does not start after commit.

Diagnostics:

show log | grep suricata
systemctl status suricata
journalctl -u suricata -f

Possible causes:

Rules have not been updated
An error in the configuration
Insufficient memory
A port conflict

Solution:

# Update the rules
update suricata

# Verify the configuration
suricata -T -c /etc/suricata/suricata.yaml

# Check memory
show system memory

# Restart
restart suricata

Does Not See Traffic

Problem: No alerts are generated and traffic is not analyzed.

Diagnostics:

# Check the interface
show interfaces

# Check the capture mode
cat /etc/suricata/suricata.yaml | grep af-packet

# Statistics
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats")'

Solution:

# Make sure the interface is in promiscuous mode
ip link set eth0 promisc on

# Verify the correct interface
show service suricata

Too Many False Positives

Problem: Suricata generates too many false alerts.

Solution:

Tune the rules - disable overly noisy ones:

# Edit /etc/suricata/threshold.config
suppress gen_id 1, sig_id 2100498
threshold gen_id 1, sig_id 2013028, type both, track by_src, count 5, seconds 60

Whitelist known hosts:

# Add exceptions in the rules
pass ip 192.168.1.50 any -> any any (msg:"Whitelist monitoring server"; sid:1000001; rev:1;)

Configure address groups - exclude internal traffic from certain rules

High CPU Load

Problem: Suricata consumes a lot of CPU.

Diagnostics:

show system processes
top

Solution:

Optimize workers:

# /etc/suricata/suricata.yaml
threading:
  set-cpu-affinity: yes
  cpu-affinity:
    - management-cpu-set:
        cpu: [ 0 ]
    - receive-cpu-set:
        cpu: [ 1, 2 ]
    - worker-cpu-set:
        cpu: [ 3, 4 ]

Disable unnecessary logging:

delete service suricata log eve flow
delete service suricata log eve stats
commit

Limit the rules - use only the necessary categories

Logs Fill Up the Disk

Problem: /var/log/suricata/ takes up a lot of space.

Solution:

Log rotation:

# /etc/logrotate.d/suricata
/var/log/suricata/*.log /var/log/suricata/*.json {
    daily
    rotate 7
    missingok
    compress
    delaycompress
    notifempty
    create 0640 root root
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/suricata.pid 2>/dev/null` 2>/dev/null || true
    endscript
}

Send to a SIEM - instead of local storage
Filter events - log only alerts

Security and Best Practices

Deployment Recommendations

Start in IDS mode:
- Monitor traffic without blocking
- Study the alerts
- Tune the rules before switching to IPS
Regular rule updates:

# Cron job for automatic updates
# In VyOS via the task scheduler
set system task-scheduler task update-suricata executable path '/opt/vyatta/bin/vyatta-op-cmd-wrapper update suricata'
set system task-scheduler task update-suricata interval '1d'
commit

Performance monitoring:

# Packet drop statistics
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats") | .stats.capture'

Whitelist legitimate traffic:
- Scanning tools
- Monitoring systems
- Backup servers
Network segmentation:
- Different rules for different segments
- Stricter rules for the DMZ
- LAN with a focus on lateral movement
Integration with the firewall:
- Suricata for detection
- Firewall for enforcement
- Automated blocking
Resource reservation:
- CPU: at least 2 cores for Suricata
- RAM: 2-4 GB depending on traffic
- Disk: a fast SSD for logs
Configuration backup:

save /config/backup-suricata-$(date +%Y%m%d).config

Compliance Requirements

Suricata helps meet:

PCI DSS - network security monitoring
HIPAA - detection of unauthorized access
GDPR - detection of data breaches
SOC 2 - continuous monitoring

Performance

Recommended Specifications

Small network (< 100 Mbps):

CPU: 2 cores
RAM: 2 GB
Disk: SSD

Medium network (100-500 Mbps):

CPU: 4 cores
RAM: 4 GB
Disk: Fast SSD

Large network (> 500 Mbps):

CPU: 8+ cores
RAM: 8+ GB
Disk: NVMe SSD
Consider a dedicated IDS/IPS appliance

Optimization

Configuration for high performance:

# /etc/suricata/suricata.yaml (approximate)
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 2048
    block-size: 32768

threading:
  set-cpu-affinity: yes
  detect-thread-ratio: 1.5

Conclusion

Suricata on VyOS provides enterprise-grade protection:

Comprehensive detection - a broad range of threats
Multi-protocol - support for all major protocols
Real-time analysis - analysis in real time
Flexible rules - a flexible rule system
Rich logging - detailed logging in JSON
SIEM integration - integration with monitoring systems

Main use cases:

Network perimeter protection
DMZ monitoring
Detection of advanced threats
Compliance and audit
Incident response
Threat hunting

Properly configuring and tuning Suricata delivers:

Early threat detection
Prevention of successful attacks
Visibility into network activity
Compliance with security requirements
Incident forensics

Suricata is an essential component of a defense-in-depth strategy for VyOS routers in cloud and enterprise environments.

Related material

Firewall on VyOS - nftables firewall
VyOS monitoring - metrics collection and observability
Suricata on pfSense - IDS/IPS on the pfSense platform

Reviewed by OpenNix LLC · Last updated on 30 July 2026

Salt-Minion for Automation TFTP Server in VyOS