--- title: "Configuring Suricata as an Intrusion Prevention System (IPS)" description: "Learn how to configure Suricata IPS to detect and prevent suspicious activities on your network with this step-by-step tutorial!" canonical: "https://adamtheautomator.com/suricata/" --- # Configuring Suricata as an Intrusion Prevention System (IPS) > Learn how to configure Suricata IPS to detect and prevent suspicious activities on your network with this step-by-step tutorial! Source: https://adamtheautomator.com/suricata/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Configuring Suricata as an Intrusion Prevention System (IPS)](https://adamtheautomator.com/wp-content/uploads/2022/01/Configuring-Suricata-as-an-Intrusion-Prevention-System-IPS.jpg) # Configuring Suricata as an Intrusion Prevention System (IPS) [![](https://secure.gravatar.com/avatar/2788bb1a3f735603f81eca51d68daec56a9d97e805a10268fb2c20afcc76b81b?s=192&d=mm&r=g)Nicholas Xuan Nguyen](https://adamtheautomator.com/author/nicholas-xuan-nguyen/)11 January 20228 min. read Categories: [Information Security](/category/infosec/) Tags:[Command Line](/tag/command-line/)[Linux](/tag/linux/)[Security](/tag/security/) Table of Contents * [Prerequisites](#prerequisites) * [Installing Suricata and Adding PPA Repository](#installing-suricata-and-adding-ppa-repository) * [Configuring Suricata](#configuring-suricata) * [Setting up the Live Rule Reloading Feature](#setting-up-the-live-rule-reloading-feature) * [Updating Suricata Rulesets](#updating-suricata-rulesets) * [Validating the Suricata Configuration](#validating-the-suricata-configuration) * [Testing the Suricata Rules](#testing-the-suricata-rules) * [Conclusion](#conclusion) With the increasing popularity of cybercrime, there is an urgent need for businesses to have better protection against hackers. An [Intrusion Prevention System (IPS)](https://www.barracuda.com/glossary/intrusion-prevention-system#:~:text=An%20intrusion%20prevention%20system%20\(IPS,threats%20by%20examining%20network%20traffic.&text=IPS's%20include%20firewalls%2C%20anti-virus,%2C%20and%20anti-spoofing%20software) is one of the best ways to defend against computer attacks. But before scouring the internet for an IPS, give [Suricata](https://suricata.io/) a try. In this tutorial, you will learn how to configure a fully-functional Suricata IPS on a Linux server to protect your network against online threats. Ready? Read on and start protecting your network! ## Prerequisites This tutorial will be a hands-on demonstration. If you’d like to follow along, be sure you have the following: * A Linux server – This demo uses Ubuntu 20.04 LTS, but any Linux distribution will work. * A non-root user with [sudo](https://www.liquidweb.com/kb/how-to-set-up-and-manage-sudo-permissions/) privileges. * Depending on your network configuration and how you intend to use Suricata, you may need more or less CPU and RAM for your server. Generally, the more traffic you plan to inspect, the more resources you’ll allocate to Suricata. In a developer environment, plan to use at least 2 CPUs and 8GB of RAM to start with so that Suricata can perform its tasks without compromising the quality of service for all users. Related:[How to Install Ubuntu 20.04 \[Step-by-Step\]](https://adamtheautomator.com/install-ubuntu/) ## **Installing Suricata and Adding** PPA Repository Suricata doesn’t come installed by default on Ubuntu, but installing Suricata is similar to how you install other packages on your system. 1\. Run the [`apt update`](https://linuxize.com/post/how-to-use-apt-command/) command to update the available packages in your system. ```bash sudo apt update -y ``` ![Updating the list of available packages](https://adamtheautomator.com/wp-content/uploads/2022/01/image-93.png) Updating the list of available packages 2\. Next, run the [`add-apt-repository`](https://manpages.ubuntu.com/manpages/trusty/man1/add-apt-repository.1.html) command to add the PPA repository maintained by the [Open Information Security Foundation (OISF)](https://oisf.net/). By adding the PPA repository, you will get the latest and stable version of Suricata (`ppa:oisf/suricata-stable`). ```bash sudo add-apt-repository ppa:oisf/suricata-stable ``` ![Adding the PPA repository for Suricata](https://adamtheautomator.com/wp-content/uploads/2022/01/image-94.png) Adding the PPA repository for Suricata 3\. Rerun the `sudo apt update` command to load the newly added Suricata repository to your system’s package index. ```bash sudo apt update -y ``` 4\. Now, run the [`sudo apt policy`](https://serverok.in/apt-policy) command to verify that you’ve added the Suricata PPA correctly. Ensure that you see Suricata PPA in the list like shown below before installing Suricata ```bash sudo apt policy ``` ![ Running the sudo apt policy](https://adamtheautomator.com/wp-content/uploads/2022/01/image-95.png) Running the sudo apt policy 5\. Run the following command to `install suricata` on your system. ```bash sudo apt install suricata -y ``` ![Installing Suricata on your system](https://adamtheautomator.com/wp-content/uploads/2022/01/image-96.png) Installing Suricata on your system 6\. Once the installation completes, run the `systemctl status` command below to check the `suricata` service `status`. ```bash sudo systemctl status suricata ``` Related:[Controlling Systemd services with Ubuntu systemctl](https://adamtheautomator.com/ubuntu-systemctl/) Below, you can see that the Suricata service is **active (running).** ![Checking the Suricata service status](https://adamtheautomator.com/wp-content/uploads/2022/01/image-97.png) Checking the Suricata service status ## Configuring Suricata The Suricata package ships with a configuration file named _suricata.yaml_ located at _/etc/suricata_ directory. This configuration file has many different settings for many other use cases. But mind you that there are a few settings in the default configuration file you need to tweak before using Suricata. > _The default mode for Suricata is Intrusion Detection (IDS) mode, which logs, but doesn’t drop any traffic. This mode is used when configuring and getting acquainted with Suricata. Once you’re more comfortable with Suricata and better understand the types of traffic Suricata will alert you about, you can opt to turn on IPS mode._ Suricata appends a field in its JSON format ([community flow ID](https://github.com/corelight/community-id-spec)). The community flow ID is an 8-byte field that allows you to correlate records generated by other tools. This feature is handy when using Suricata in conjunction with other tools like [Bro](https://bricata.com/blog/what-is-bro-ids/) or [Elasticsearch](https://www.elastic.co/). 1\. Open the _/etc/suricata/suricata.yaml_ file in your favorite text editor. 2\. Find a line that reads **community-id: false** and change it to **community-id: true**. Save the changes and exit from the text editor. Each time you examine events, you’ll see the community flow ID in their JSON output. ![Enabling Community ID](https://adamtheautomator.com/wp-content/uploads/2022/01/image-98.png) Enabling Community ID Next, run the following command to find a device with a default route on your system (`route show default`). The `-p` flag tells the `ip` command to print the device in a human-readable way, while the `-j` flag prints the JSON output. > _Suricata is configured to sniff packets from any available network interface by default. But you can change this behavior and specify an interface for Suricata to listen to when it starts._ ```bash ip -p -j route show default ``` As you see below, the **dev** parameter specifies the interface that Suricata will use for sniffing packets. In this demo, the interface is **eth0**, but your interface may be different, like tun0, wlan0, and so on. ![Previewing the Network Interface](https://adamtheautomator.com/wp-content/uploads/2022/01/image-99.png) Previewing the Network Interface 4\. Finally, open the _/etc/suricata/suricata.yaml_ configuration file, locate the **interface** parameter under the **af-packet** section and modify it accordingly. In this demo, **eth0** is used as the interface for sniffing packets. Save the changes, but keep your text editor open for now. ![Editing the /etc/suricata/suricata.yaml configuration file](https://adamtheautomator.com/wp-content/uploads/2022/01/image-100.png) Editing the /etc/suricata/suricata.yaml configuration file ## Setting up the Live Rule Reloading Feature You’ve now configured Suricata, but that’s just the beginning of protecting your network. Typically, you’d want to add rules on the spot and automatically reload the rules. How? Suricata’s live rule reloading feature allows you to update rules on the fly. As a result, you don’t have to restart Suricata manually so that the new rules will take effect. Open the _/etc/suricata/suricata.yaml_ file, copy/paste the following directives to the bottom of the file’s content, and save the changes. These directives let you enable the live rule reloading feature. With this setting in place, when you edit/update your rule sets, changes will take effect without restarting your Suricata service. ```bash detect-engine: - rule-reload: true ``` ![Setting up the Live Rule Reloading](https://adamtheautomator.com/wp-content/uploads/2022/01/image-101.png) Setting up the Live Rule Reloading Now run the `kill` command below to notify your Suricata process (`$(pidof suricata)`) to update the rules without restarting. The command sends a user-defined signal (`-usr2`) to the specified process ID, then Suricata performs the following automatically: * Load new config to update rule variables and values. * Load new rules * Construct new detection engine * Swap old and new detection engines * Make sure all threads are updated * Free up old detection engine ```bash sudo kill -usr2 $(pidof suricata) ``` ## Updating Suricata Rulesets The live rule reloading feature is ready, but it won’t serve a purpose unless you update your rulesets. By default, the Suricata package has a limited ruleset that only detects the most common Internet Protocols located in the _/etc/suricata/rules_ directory. At this point, you will get a **No rule files match the pattern** error message, like the one below, whenever you try to start and use your Suricata service. This error message indicates that there are no rulesets for Suricata to use. ![Previewing Error Message when No Rulesets Exist](https://adamtheautomator.com/wp-content/uploads/2022/01/image-102.png) Previewing Error Message when No Rulesets Exist To fix this error, provide ruleset files to your Suricata instance. Luckily, Suricata has a tool named [`suricata-update`](https://github.com/OISF/suricata-update) that will assist you in fetching more rulesets from third-party providers. 1\. Run the command below to get an update for your Suricata instance. ```bash sudo suricata-update ``` As you can see below, the output indicates that the `suricata-update` command fetched the rules by connecting to _https://rules.emergingthreats.net/open/. The command then saves the new rules to the /var/lib/suricata/rules/ directory_. The output also prints out the following: * The total number(**31737**) of rulesets * The number of rules that are enabled (**24355**) * The number of how many are added(**31737**)/removed(**0**). ![Updating Your Suricata Rulesets](https://adamtheautomator.com/wp-content/uploads/2022/01/image-103.png) Updating Your Suricata Rulesets Next, run the command below to list all ruleset providers (`list-sources`). > _The `suricata-update` command fetches rulesets from many providers, including free and commercial providers._ ```bash sudo suricata-update list-sources ``` Below, you can see a small part of the list. Note a ruleset name you want Suricata to fetch rulesets from specifically. This tutorial fetches **et/open** rulesets for demonstration (step three). ![Listing all ruleset providers](https://adamtheautomator.com/wp-content/uploads/2022/01/image-104.png) Listing all ruleset providers 3\. Run the command below to fetch and include (`enable-source`) the `et/open` rulesets to your Suricata rules. ```bash sudo suricata-update enable-source et/open ``` ![Fetching the et/open rulesets](https://adamtheautomator.com/wp-content/uploads/2022/01/image-105.png) Fetching the et/open rulesets Finally, rerun the `suricata-update` command to load the newly picked ruleset. ```bash sudo suricata-update ``` ## Validating the Suricata Configuration You’ve configured Suricata and even added rulesets, so it’s time to validate your changes and ensure everything works as expected. The Suricata package has a built-in validation service that allows you to see any deviations from the current configuration. Run the `suricata` command below to validate the changes in the Suricata configuration file (`-c /etc/suricata/suricata.yaml`). The command also displays all validation messages (`-v`). The `-T` flag tells Suricata to run in “test mode” and “top down” mode. Both modes have more strict rules for matching packets and are less likely to make a false positive. ```powershell sudo suricata -T -c /etc/suricata/suricata.yaml -v ``` Since Suricata is a highly configurable firewall, the test may take several minutes to complete. If there are no errors, you’ll see an output similar to the one below that shows a **complete** message. ![Validating Your Suricata Configuration: complete](https://adamtheautomator.com/wp-content/uploads/2022/01/image-106.png) Validating Your Suricata Configuration: complete If your configuration file has errors similar to the one below, Suricata will print out each error, indicating specific lines causing problems. If you get these errors, fix each configuration issue one by one until the validation is successful. ![Validating Your Suricata Configuration: errors](https://adamtheautomator.com/wp-content/uploads/2022/01/image-107.png) Validating Your Suricata Configuration: errors ## Testing the Suricata Rules Now that your Suricata configuration files are validated, you can run Suricata to see they are working correctly. You’ll use Suricata to test the ET Open ([2100498)](https://suricata.readthedocs.io/en/latest/quickstart.html#alerting) with the `curl` command to detect suspicious activity/traffic. > _Right now, your Suricata instance has over 30,000 rules that Suricata fetched from various rulesets. So a full test of all the rules with their explanation won’t fit in this tutorial._ 1\. Run the `curl` command below to generate some traffic/HTTP requests/activities from the [TestMyNIDS](https://github.com/3CORESec/testmynids.org) website. TestMyNIDS is an e-learning project dedicated to supporting NIDS tests, validation, and comparison. The website provides a unique platform for comparative analysis of NIDS and related tools. You can use this website to test any suspicious activity/traffic to see if your configured ruleset is working as expected. ```powershell curl http://testmynids.org/uid/index.html ``` The response data is designed to trigger a false alert pretending to be a Linux/Unix **root** user. And this **root** user is on a system that might be compromised. ![Testing Your Suricata Rules](https://adamtheautomator.com/wp-content/uploads/2022/01/image-108.png) Testing Your Suricata Rules Next, run the `grep` command below to examine the _`fast.log`_ file in the _/var/log/suricata/_ directory for a matching alert message [`2100498`](https://suricata.readthedocs.io/en/latest/quickstart.html#alerting). This command checks the log file for user alert. > _Apart from the fast.log file, another log file to look out for is the eve.log in the same directory._ ```bash grep 2100498 /var/log/suricata/fast.log ``` You’ll see an output similar to the one below that shows your system’s public IPv4 address. ![Examining the fast.log file](https://adamtheautomator.com/wp-content/uploads/2022/01/image-109.png) Examining the _fast.log_ file 3\. Now, run the `jq` command below to examine the _eve.log_ file. The _eve.log_ file is also used for logging events but in JSON format (`/var/log/suricata/eve.json`). It is the _eve.json_ and _fast.log_ files that you will reference for suspicious traffic and blocked attempts. Once found, take action as necessary. ```bash jq 'select(.alert .signature_id==2100498)' /var/log/suricata/eve.json ``` Below, you can see **“signature\_id”: 2100498** in the output, which is the alert signature ID you specified in the command. You can also see the **“community\_id”: “1:ETRbv54GHTVCayHTUR5OIovK4gh2=”** in the output, which is the Community Flow ID you set up in the _/etc/suricata/suricata.yaml_ file. This **community\_id** is handy when you use Suricata in conjunction with other tools like Elasticsearch to get a full “security monitoring stack” for a reasonably low cost. ![Examining the eve.log file](https://adamtheautomator.com/wp-content/uploads/2022/01/image-110.png) Examining the eve.log file ## Conclusion Throughout this tutorial, you’ve learned how to install and configure Suricata with rulesets to protect your network. You’ve also gone through testing if the rulesets are working by generating traffic on your network. At this point, Suricata is running perfectly with your custom ruleset to detect suspicious activities/traffic on your network. Now, why not build on this newfound knowledge? Perhaps begin with [installing and configuring Suricata, Zeek, the Elasticsearch stack](https://www.howtoforge.com/suricata-and-zeek-ids-with-elk-on-ubuntu-20-10/) to set up a full “security monitoring stack”? Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fsuricata%2F&text=Configuring%20Suricata%20as%20an%20Intrusion%20Prevention%20System%20\(IPS\))[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fsuricata%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fsuricata%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2022/02/How-to-Install-and-Configure-the-CSF-Firewall-for-Linux.jpg) ### [How to Install and Configure the CSF Firewall for Linux](/csf-firewall/) Learn how to install and configure the CSF firewall for Linux and secure your server in this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/01/How-to-Provision-a-Website-With-aaPanel-and-LetsEncrypt.jpg) ### [How to Provision a Website With aaPanel and LetsEncrypt](/aapanel/) Learn how to install aaPanel, provision a website, and secure the website with SSL using Let’s Encrypt in this step-by-step tutorial! ![](https://adamtheautomator.com/wp-content/uploads/2022/01/How-To-Set-Up-WireGuard-VPN-on-Linux.jpg) ### [How To Set Up WireGuard VPN on Linux](/wireguard-vpn/) Learn how to set up WireGuard VPN on Linux to securely connect and access your network, in this step-by-step tutorial! ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)