Suricata IDS/IPS Configuration and Rules Deployment

Suricata inspects traffic at line rate with multi-threading, making it the default open-source choice for an IDS sensor, an inline IPS or a network security monitor feed. The configuration file is long, but only a handful of sections decide whether the sensor drops packets, misses alerts or pegs a single CPU core. This guide covers the settings that matter, how to load rule sets, and the safe path from IDS to IPS with correct thread and affinity configuration.

Install and First Run

sudo apt install suricata suricata-update
sudo suricata-update

# packet-capture smoke test, no interface change
sudo suricata -T -c /etc/suricata/suricata.yaml -v
sudo suricata -c /etc/suricata/suricata.yaml -i eth0 -l /var/log/suricata-logs/

-T validates the YAML and rule set before you commit a change to a production sensor. Output — alerts and per-protocol events — lands in the directory named by default-log-dir (or the -l override shown above).

suricata.yaml Settings That Actually Matter

%YAML 1.1
---
vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8,192.168.0.0/16]"
    EXTERNAL_NET: "!$HOME_NET"

default-log-dir: /var/log/suricata
default-packet-size: 1514
max-pending-packets: 2048

outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types: [alert, http, dns, tls, flow, ssh, stats]
  - fast:
      enabled: yes
      filename: fast.log
      append: yes

action-order:
  - pass
  - drop
  - reject
  - alert

• HOME_NET is the single most important variable: every signature that references it silently fails to alert if it is wrong.
• action-order decides rule precedence — pass rules are evaluated before drop, drop before reject, and alert last. Misordering here is why "the drop rule did not stop the traffic" tickets exist.
• eve-log with typed metadata is what makes the sensor useful downstream: Zeek-style flow records plus protocol parsers feed SIEM correlation without decoding raw pcaps.

Rules: Sources and Local Overrides

sudo suricata-update list-sources
sudo suricata-update enable-source et/open
sudo suricata-update enable-source tgreen/hunting
sudo suricata-update

ls /var/lib/suricata/rules/*.rules
cat /etc/suricata/disable.conf      # suppress noisy SIDs
cat /etc/suricata/modify.conf       # rewrite or threshold signatures

Keep local signatures in /etc/suricata/rules/local.rules and reference that path in rule-files so updates never overwrite your own detections. Threshold and suppress entries belong in threshold.config; tuning noise there is cheaper than disabling a whole ruleset.

Performance: Threads, Affinity and Capture Mode

af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 200000
    threads: 4
    copy-mode: none

# IDS mode: reserve cores for the kernel and management
threading:
  set-cpu-affinity: yes
  cpu-affinity:
    - management-cpu-set:
        cpu: [ 0 ]
    - receive-cpu-set:
        cpu: [ 1 ]
    - worker-cpu-set:
        cpu: [ 2-5 ]
        mode: "balanced"

Start with one worker per receive queue, pin management to a dedicated core, and check stats.log for kernel_drops. Any non-zero drop counter means the ring buffer filled — increase ring-size and threads, or switch to AFPv3 with zero-copy.

Moving from IDS to IPS

1. Run in IDS mode for at least a week and triage false positives; add suppresses before enforcing.
2. Move the sensor inline using AF_PACKET IPS mode between two interfaces (af-packet: - interface: eth1 copy-mode: ips with a paired eth2, or the --af-packet=eth1 pair syntax).
3. Validate that pass rules protect critical management traffic — an inline sensor can block your own SSH session if a rule is too broad.
4. Re-run suricata -T, then confirm drops appear in eve.json as event_type: drop before enabling more signatures.

Related reading: tshark command-line pcap analysis, Linux auditd rules and ausearch, and Nmap discovery and port scanning.

原文链接：https://docs.suricata.io/en/suricata-8.0.6/configuration/suricata-yaml.html