# Suricata IDS/IPS

> Suricata IDS/IPS on VyOS - intrusion detection, real-time network traffic analysis and security monitoring in Yandex Cloud and VK Cloud

Source: https://opennix.org/en/docs/vyos/services/vyos-suricata/


Suricata is an open-source intrusion detection and prevention system (IDS/IPS) for real-time network traffic analysis on VyOS. This guide covers installing Suricata on VyOS, configuring threat-detection rules, IDS and IPS modes, and integrating with security monitoring in Yandex Cloud and VK Cloud. Suricata performs deep packet inspection (DPI), detects network attacks by signature, and can block malicious traffic in IPS mode.

## Overview

### What is Suricata

**Suricata** is a powerful network security engine:
- Intrusion Detection System (IDS)
- Intrusion Prevention System (IPS)
- Network Security Monitoring (NSM)
- Real-time network packet analysis
- Support for multiple protocols
- Open Source project

### Key Features

**Intrusion Detection (IDS)**:
- Network traffic analysis
- Detection of suspicious activity
- Detection of attacks and malicious traffic
- Alert generation
- Passive monitoring mode

**Intrusion Prevention (IPS)**:
- Blocking of suspicious traffic
- Real-time traffic modification
- Preventing attacks before they succeed
- Active network protection
- Automated response

**Network Security Monitoring (NSM)**:
- Collection and analysis of network data
- Anomaly detection
- Threat identification
- Incident forensics
- Compliance monitoring

**Multi-Protocol Support**:
- HTTP/HTTPS
- FTP/FTPS
- SMB/CIFS
- SSH
- DNS
- TLS/SSL
- SMTP
- And many others

### How It Works

1. **Capture** - capturing packets from the interface
2. **Decode** - decoding protocols
3. **Detection** - applying detection rules
4. **Logging** - recording events
5. **Alert** - generating alerts
6. **Action** - performing actions (for IPS)

## Installation and Activation

### Checking Availability

Suricata is included in VyOS 1.5.x (Circinus) and newer.

Check the VyOS version:
```
show version
```

### Enabling Suricata

Basic service activation:

```
set service suricata
commit
save
```

After activation you must update the rules:
```
update suricata
```

The `update suricata` command:
- Downloads the latest detection rules
- Updates the configuration
- Restarts the service
- Is mandatory for correct operation

## Basic Configuration

### Selecting an Interface to Monitor

Specifying the interface for traffic analysis:

```
set service suricata interface eth0
commit
```

Multiple interfaces:

```
set service suricata interface eth0
set service suricata interface eth1
set service suricata interface eth2
commit
```

Recommendations:
- **WAN interface** - for detecting external threats
- **DMZ interface** - for protecting public-facing services
- **LAN interfaces** - for internal threat detection

### Address Groups

Creating address groups for flexible rules:

```
set service suricata address-group HOME_NET address 192.168.1.0/24
set service suricata address-group HOME_NET address 10.0.0.0/8
set service suricata address-group HOME_NET address 172.16.0.0/12
commit
```

Multiple groups:

```
# Internal network
set service suricata address-group HOME_NET address 192.168.0.0/16
set service suricata address-group HOME_NET address 10.0.0.0/8

# DMZ network
set service suricata address-group DMZ_NET address 192.168.100.0/24

# External (Internet)
set service suricata address-group EXTERNAL_NET address !192.168.0.0/16
set service suricata address-group EXTERNAL_NET address !10.0.0.0/8

# DNS servers
set service suricata address-group DNS_SERVERS address 8.8.8.8
set service suricata address-group DNS_SERVERS address 8.8.4.4

# Web servers
set service suricata address-group WEB_SERVERS address 192.168.100.10
set service suricata address-group WEB_SERVERS address 192.168.100.11

commit
```

Using negation:
```
# Everything except the internal network
set service suricata address-group EXTERNAL_NET address !192.168.0.0/16
```

### Port Groups

Creating port groups:

```
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTP_PORTS port 8000
commit
```

Port group examples:

```
# HTTP ports
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTP_PORTS port 8000
set service suricata port-group HTTP_PORTS port 8888

# HTTPS ports
set service suricata port-group HTTPS_PORTS port 443
set service suricata port-group HTTPS_PORTS port 8443

# SSH ports
set service suricata port-group SSH_PORTS port 22
set service suricata port-group SSH_PORTS port 2222

# Mail ports
set service suricata port-group MAIL_PORTS port 25
set service suricata port-group MAIL_PORTS port 587
set service suricata port-group MAIL_PORTS port 465

# Database ports
set service suricata port-group DB_PORTS port 3306
set service suricata port-group DB_PORTS port 5432
set service suricata port-group DB_PORTS port 1433

commit
```

## Logging Configuration

### EVE JSON Logs

EVE (Extensible Event Format) is the primary logging format:

```
set service suricata log eve filetype regular
commit
```

File types:
- `regular` - regular file
- `unix_dgram` - Unix domain socket
- `unix_stream` - Unix stream socket

### Event Types for Logging

Enabling various event types:

```
# Alert events
set service suricata log eve alerts

# HTTP transactions
set service suricata log eve http

# DNS queries
set service suricata log eve dns

# TLS/SSL connections
set service suricata log eve tls

# File transactions
set service suricata log eve files

# SSH connections
set service suricata log eve ssh

# Flow records
set service suricata log eve flow

# Statistics
set service suricata log eve stats

commit
```

Full logging configuration:

```
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve dns
set service suricata log eve tls
set service suricata log eve files
set service suricata log eve ssh
set service suricata log eve flow
set service suricata log eve stats
commit
```

### Log Locations

Suricata logs are located in:
- `/var/log/suricata/eve.json` - the primary log in JSON format
- `/var/log/suricata/fast.log` - fast alert format
- `/var/log/suricata/stats.log` - statistics

## Rule Management

### Updating Rules

Updating the rule set:

```
update suricata
```

This command:
- Downloads the latest rules from Emerging Threats and other sources
- Updates `/etc/suricata/suricata.yaml`
- Restarts Suricata with the new rules

It is recommended to run this regularly (weekly or daily).

### Rule Sources

By default, VyOS uses:
- **Emerging Threats Open** - a free rule set
- **ET/OISF ruleset** - community rules

Rule categories:
- Malware detection
- Exploit attempts
- Policy violations
- Scan detection
- Botnet C&C communication
- Phishing attempts
- Web attacks

## Configuration Examples

### Example 1: Basic WAN Protection

```
# Enable Suricata
set service suricata

# Monitor WAN interface
set service suricata interface eth0

# Define networks
set service suricata address-group HOME_NET address 192.168.1.0/24
set service suricata address-group EXTERNAL_NET address !192.168.1.0/24

# Logging
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve dns

commit
save

# Update rules
update suricata
```

### Example 2: Web Server Protection

```
# Enable Suricata
set service suricata

# Monitor DMZ interface
set service suricata interface eth2

# Networks
set service suricata address-group DMZ_NET address 192.168.100.0/24
set service suricata address-group WEB_SERVERS address 192.168.100.10
set service suricata address-group WEB_SERVERS address 192.168.100.11

# Ports
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTPS_PORTS port 443

# Logging with HTTP details
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve tls
set service suricata log eve files

commit
save
update suricata
```

### Example 3: Comprehensive Network Protection

```
# Enable Suricata
set service suricata

# Monitor all interfaces
set service suricata interface eth0
set service suricata interface eth1
set service suricata interface eth2

# Internal networks
set service suricata address-group HOME_NET address 192.168.0.0/16
set service suricata address-group HOME_NET address 10.0.0.0/8

# DMZ
set service suricata address-group DMZ_NET address 192.168.100.0/24

# Critical servers
set service suricata address-group DB_SERVERS address 192.168.50.10
set service suricata address-group DB_SERVERS address 192.168.50.11
set service suricata address-group WEB_SERVERS address 192.168.100.10
set service suricata address-group WEB_SERVERS address 192.168.100.20

# External
set service suricata address-group EXTERNAL_NET address !192.168.0.0/16
set service suricata address-group EXTERNAL_NET address !10.0.0.0/8

# Service ports
set service suricata port-group HTTP_PORTS port 80
set service suricata port-group HTTP_PORTS port 8080
set service suricata port-group HTTPS_PORTS port 443
set service suricata port-group SSH_PORTS port 22
set service suricata port-group DB_PORTS port 3306
set service suricata port-group DB_PORTS port 5432

# Comprehensive logging
set service suricata log eve filetype regular
set service suricata log eve alerts
set service suricata log eve http
set service suricata log eve dns
set service suricata log eve tls
set service suricata log eve ssh
set service suricata log eve files
set service suricata log eve flow
set service suricata log eve stats

commit
save
update suricata
```

## Operational Commands

### Viewing the Configuration

```
show service suricata
```

Displays:
- Service status
- Monitored interfaces
- Address groups
- Port groups
- Logging settings

### Restarting Suricata

```
restart suricata
```

A restart is required after:
- Changing the configuration
- Updating the rules
- Modifying interfaces

### Updating Rules and Configuration

```
update suricata
```

Performs:
- Downloading new rules
- Updating the configuration
- Automatically restarting the service

### Viewing Logs

Alerts in real time:
```
monitor log suricata
tail -f /var/log/suricata/fast.log
```

EVE JSON logs:
```
tail -f /var/log/suricata/eve.json | jq
```

Filtering by event type:
```
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="http")'
```

Statistics:
```
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats")'
```

## Log Analysis

### EVE JSON Format

Example of an alert event:
```json
{
  "timestamp": "2025-10-15T12:34:56.789123+0000",
  "flow_id": 123456789,
  "event_type": "alert",
  "src_ip": "203.0.113.45",
  "src_port": 54321,
  "dest_ip": "192.168.1.10",
  "dest_port": 80,
  "proto": "TCP",
  "alert": {
    "action": "allowed",
    "gid": 1,
    "signature_id": 2100498,
    "rev": 7,
    "signature": "GPL ATTACK_RESPONSE id check returned root",
    "category": "Potentially Bad Traffic",
    "severity": 2
  },
  "http": {
    "hostname": "example.com",
    "url": "/admin/",
    "http_method": "GET",
    "http_user_agent": "Mozilla/5.0",
    "status": 200
  }
}
```

### Useful jq Queries

Top attack sources:
```bash
cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .src_ip' | sort | uniq -c | sort -rn | head -10
```

Top signatures:
```bash
cat /var/log/suricata/eve.json | jq -r 'select(.event_type=="alert") | .alert.signature' | sort | uniq -c | sort -rn | head -10
```

Alerts by severity:
```bash
cat /var/log/suricata/eve.json | jq 'select(.event_type=="alert") | select(.alert.severity==1)'
```

HTTP transactions:
```bash
cat /var/log/suricata/eve.json | jq 'select(.event_type=="http") | {host: .http.hostname, url: .http.url, method: .http.http_method}'
```

DNS queries:
```bash
cat /var/log/suricata/eve.json | jq 'select(.event_type=="dns") | {query: .dns.rrname, type: .dns.rrtype}'
```

## SIEM Integration

### Sending to Syslog

Syslog configuration on VyOS:

```
set system syslog host 192.168.1.100 facility local0 level info
set system syslog host 192.168.1.100 format octet-counted
commit
```

### ELK Stack Integration

**Filebeat on VyOS:**

Installation (if available):
```bash
# Via container
set container name filebeat image 'docker.elastic.co/beats/filebeat:8.11.0'
set container name filebeat volume filebeat-config source '/config/filebeat.yml'
set container name filebeat volume suricata-logs source '/var/log/suricata'
commit
```

**Filebeat config** (`/config/filebeat.yml`):
```yaml
filebeat.inputs:
  - type: log
    enabled: true
    paths:
      - /var/log/suricata/eve.json
    json.keys_under_root: true
    json.add_error_key: true

output.elasticsearch:
  hosts: ["192.168.1.100:9200"]
  index: "suricata-%{+yyyy.MM.dd}"

setup.kibana:
  host: "192.168.1.100:5601"
```

### Splunk Integration

Splunk Universal Forwarder:

```bash
# inputs.conf
[monitor:///var/log/suricata/eve.json]
sourcetype = suricata
index = security
```

### Wazuh Integration

Wazuh agent configuration:

```xml
<localfile>
  <log_format>json</log_format>
  <location>/var/log/suricata/eve.json</location>
</localfile>
```

## Troubleshooting

### Suricata Does Not Start

**Problem**: The service does not start after commit.

**Diagnostics:**
```
show log | grep suricata
systemctl status suricata
journalctl -u suricata -f
```

**Possible causes:**
- Rules have not been updated
- An error in the configuration
- Insufficient memory
- A port conflict

**Solution:**
```
# Update the rules
update suricata

# Verify the configuration
suricata -T -c /etc/suricata/suricata.yaml

# Check memory
show system memory

# Restart
restart suricata
```

### Does Not See Traffic

**Problem**: No alerts are generated and traffic is not analyzed.

**Diagnostics:**
```
# Check the interface
show interfaces

# Check the capture mode
cat /etc/suricata/suricata.yaml | grep af-packet

# Statistics
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats")'
```

**Solution:**
```
# Make sure the interface is in promiscuous mode
ip link set eth0 promisc on

# Verify the correct interface
show service suricata
```

### Too Many False Positives

**Problem**: Suricata generates too many false alerts.

**Solution:**

1. **Tune the rules** - disable overly noisy ones:
```bash
# Edit /etc/suricata/threshold.config
suppress gen_id 1, sig_id 2100498
threshold gen_id 1, sig_id 2013028, type both, track by_src, count 5, seconds 60
```

2. **Whitelist known hosts**:
```bash
# Add exceptions in the rules
pass ip 192.168.1.50 any -> any any (msg:"Whitelist monitoring server"; sid:1000001; rev:1;)
```

3. **Configure address groups** - exclude internal traffic from certain rules

### High CPU Load

**Problem**: Suricata consumes a lot of CPU.

**Diagnostics:**
```
show system processes
top
```

**Solution:**

1. **Optimize workers**:
```yaml
# /etc/suricata/suricata.yaml
threading:
  set-cpu-affinity: yes
  cpu-affinity:
    - management-cpu-set:
        cpu: [ 0 ]
    - receive-cpu-set:
        cpu: [ 1, 2 ]
    - worker-cpu-set:
        cpu: [ 3, 4 ]
```

2. **Disable unnecessary logging**:
```
delete service suricata log eve flow
delete service suricata log eve stats
commit
```

3. **Limit the rules** - use only the necessary categories

### Logs Fill Up the Disk

**Problem**: `/var/log/suricata/` takes up a lot of space.

**Solution:**

1. **Log rotation**:
```bash
# /etc/logrotate.d/suricata
/var/log/suricata/*.log /var/log/suricata/*.json {
    daily
    rotate 7
    missingok
    compress
    delaycompress
    notifempty
    create 0640 root root
    sharedscripts
    postrotate
        /bin/kill -HUP `cat /var/run/suricata.pid 2>/dev/null` 2>/dev/null || true
    endscript
}
```

2. **Send to a SIEM** - instead of local storage

3. **Filter events** - log only alerts

## Security and Best Practices

### Deployment Recommendations

1. **Start in IDS mode**:
   - Monitor traffic without blocking
   - Study the alerts
   - Tune the rules before switching to IPS

2. **Regular rule updates**:
```bash
# Cron job for automatic updates
# In VyOS via the task scheduler
set system task-scheduler task update-suricata executable path '/opt/vyatta/bin/vyatta-op-cmd-wrapper update suricata'
set system task-scheduler task update-suricata interval '1d'
commit
```

3. **Performance monitoring**:
```
# Packet drop statistics
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="stats") | .stats.capture'
```

4. **Whitelist legitimate traffic**:
   - Scanning tools
   - Monitoring systems
   - Backup servers

5. **Network segmentation**:
   - Different rules for different segments
   - Stricter rules for the DMZ
   - LAN with a focus on lateral movement

6. **Integration with the firewall**:
   - Suricata for detection
   - Firewall for enforcement
   - Automated blocking

7. **Resource reservation**:
   - CPU: at least 2 cores for Suricata
   - RAM: 2-4 GB depending on traffic
   - Disk: a fast SSD for logs

8. **Configuration backup**:
```
save /config/backup-suricata-$(date +%Y%m%d).config
```

### Compliance Requirements

Suricata helps meet:
- **PCI DSS** - network security monitoring
- **HIPAA** - detection of unauthorized access
- **GDPR** - detection of data breaches
- **SOC 2** - continuous monitoring

## Performance

### Recommended Specifications

**Small network (< 100 Mbps)**:
- CPU: 2 cores
- RAM: 2 GB
- Disk: SSD

**Medium network (100-500 Mbps)**:
- CPU: 4 cores
- RAM: 4 GB
- Disk: Fast SSD

**Large network (> 500 Mbps)**:
- CPU: 8+ cores
- RAM: 8+ GB
- Disk: NVMe SSD
- Consider a dedicated IDS/IPS appliance

### Optimization

Configuration for high performance:

```yaml
# /etc/suricata/suricata.yaml (approximate)
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 2048
    block-size: 32768

threading:
  set-cpu-affinity: yes
  detect-thread-ratio: 1.5
```

## Conclusion

Suricata on VyOS provides enterprise-grade protection:

- **Comprehensive detection** - a broad range of threats
- **Multi-protocol** - support for all major protocols
- **Real-time analysis** - analysis in real time
- **Flexible rules** - a flexible rule system
- **Rich logging** - detailed logging in JSON
- **SIEM integration** - integration with monitoring systems

Main use cases:
- Network perimeter protection
- DMZ monitoring
- Detection of advanced threats
- Compliance and audit
- Incident response
- Threat hunting

Properly configuring and tuning Suricata delivers:
- Early threat detection
- Prevention of successful attacks
- Visibility into network activity
- Compliance with security requirements
- Incident forensics

Suricata is an essential component of a defense-in-depth strategy for VyOS routers in cloud and enterprise environments.

## Related material

- [Firewall on VyOS](/en/docs/vyos/firewall/vyos-firewall/) - nftables firewall
- [VyOS monitoring](/en/docs/vyos/services/vyos-monitoring/) - metrics collection and observability
- [Suricata on pfSense](/en/docs/pfsense/packages/pfsense-suricata/) - IDS/IPS on the pfSense platform