GROUP PRESENTATION

Suricata
Open Source Network Security Engine
IDS · IPS · NSM

CENG 431 (1) Information Security | Asst. Prof. Dr. Nergiz Khankishiyeva Hati
Nazlıcan Soyer 220201008 · Taha Kılınçarslan 220201025 · Elif Aysel Yıldırım 220201046 · Nehir Aktaş 230201026 · Yiğit Kaan Ünal 230201400

Open Information Security Foundation (OISF)

TABLE OF CONTENTS

Presentation Outline

01 Introduction & Core Concepts

Slides 3-6

IDS / IPS / NSM / Suricata / OISF / Snort comparison

02 Architecture & Working Principle

Slides 7-10

Multi-thread, packet capture, Layer 7 analysis, IDS vs IPS

Slides 11-
03 Rule Writing (Rules) 14
Rule anatomy, action types, examples, ET Open

Slides 15-
04 Installation & Configuration 17
Installation, [Link], operation modes, live stats

Slides 18-
05 Logging & Integration 21
EVE JSON, ELK Stack, Kibana dashboard, real scenario
Introduction & Core Concepts

What Are IDS, IPS, and NSM?

🔍 IDS ️ IPS 📡 NSM

Intrusion Detection System Intrusion Prevention System Network Security Monitoring

Passively monitors network traffic. The active version of IDS. When it Not just attack detection; it involves
When it detects a suspicious situation, it detects a suspicious packet, it can block, recording, analyzing, and providing
generates an alarm but does not drop, or reject it. It is positioned inline visibility of all network traffic. It
interfere with the traffic. Think of it like in the middle of the traffic flow. answers questions like who connected
a building alarm system: it sees the to what and which protocol was used.
attack and reports it.

⚡ Suricata can operate simultaneously as IDS, IPS, and NSM.

Introduction & Core Concepts

What is Suricata?
🏢 Developer: OISF ⚡ Multi-Thread Architecture

Launched in 2009 by the Open Information Security Foundation,

Uses all cores of modern processors. This is the key difference
it is an open-source and community-supported project. Non-
from Snort: it performs much better at high bandwidth.
profit.

🔓 Open Source & Free 🌐 Multi-Protocol

Distributed under GPL-2 license. Full access to source code, Analyzes HTTP, DNS, TLS, SMB, FTP, SMTP, SSH and more with
community support, and active development available. Layer 7 deep understanding.

📦 Rule Compatibility 🔗 Integration

Largely compatible with Snort rule format. Existing Snort rules Easily integrates with security tools such as ELK Stack, Splunk,
can also be used in Suricata. Grafana, TheHive, and MISP.
Introduction & Core Concepts

Suricata vs Snort
Feature Suricata Snort 3

Architecture Multi-thread (multi-core) Multi-thread (added in Snort 3)

Performance Optimized for high traffic Medium — improved with Snort 3

Protocol Support HTTP, DNS, TLS, SMB, FTP… More limited

Rule Format Snort compatible + extensions Original Snort format

EVE JSON Output Built-in, rich Plugin required

License GPL-2 (OISF) GPL-2 (Cisco Talos)

Ready Rule Set ET Open / Pro Talos Rules

Introduction & Core Concepts

Where is Suricata Used?

SOC (Security Operations Center) CERT / CSIRT Teams

Used as the primary tool in enterprise security operations centers

Cyber security incident response teams use Suricata logs in
for real-time network monitoring and incident detection.
network forensics for post-incident analysis.
Provides alert streams to analysts.

Enterprise Network Security ISP / Cloud Providers

Large enterprises and public institutions run Suricata in IPS mode Internet service providers and cloud platforms use high-
on edge and core networks to protect critical infrastructure. bandwidth Suricata deployments to protect customer traffic.

Academic & Research Honeypot & Threat Intelligence

Suricata is used in honeypot systems to monitor attacker

Universities, cybersecurity researchers, and CTF players use it in
behavior; collected data is analyzed to generate threat
protocol analysis and intrusion detection research.
intelligence.
Architecture & Working Principle

How Does Suricata Work?

Packet Flow Detection

Decoder Output
Capture Engine Engine
→ → → →
AF_PACKET IP/TCP/UDP Flow tracking Rule matching EVE JSON
PCAP / DPDK protocol decode reassembly signature analysis [Link] / drop

Multi-Thread Advantage Layer 7 Application Detection Flow Engine

This is Suricata's most critical Suricata doesn't just inspect packets at

Tracks network traffic on a connection
architectural feature. Each CPU core runs IP/port level; it understands the
basis (flow). Reassembles TCP streams
as a separate thread; thus on an 8-core application inside. It decodes HTTP, DNS,
and provides stateful analysis. Correctly
server, theoretically 8x performance is TLS, SMB, FTP, SMTP, SSH protocols and
processes fragmented packets.
achieved. Snort (v2) lacked this feature. performs rule matching.
Architecture & Working Principle

Packet Capture Methods

PCAP < 1 Gbps AF_PACKET 1–10 Gbps

Test / Development Production (Linux)

The simplest capture method. Uses libpcap library. Can read Linux kernel's high-performance packet capture interface.
from a network interface or .pcap file. Not used in production Reduces copies between user space and kernel using kernel
environments due to low performance. ring buffer.

✓ Easy setup, platform ✓ Good performance, kernel

✗ High CPU usage, packet loss ✗ Linux only
independent integration

PF_RING 10 Gbps+ DPDK 40–100 Gbps

High Traffic Data Center

Third-party kernel module. Bypasses the Linux network stack, Intel's Data Plane Development Kit. Completely bypasses the
receives packets directly from NIC. Used for high bandwidth in kernel. Optimized for data center level traffic. The highest
enterprise environments. performance option.

✓ Very high performance ✗ Additional setup required ✓ Maximum throughput ✗ Complex setup
Architecture & Working Principle

IDS Mode vs IPS Mode

IDS Mode (Passive) IPS Mode (Inline / Active)

Internet → Router → [SWITCH] → Server Internet → Router → [Suricata] → Server

↕ (mirror port / SPAN) Traffic PASSES through Suricata

Suricata Suricata
(listening mode) (inline mode)

→ Generates alert → DROPs suspicious packet

→ Does NOT touch traffic → REJECTs connection
→ Analyzes the copy → Clean traffic passes through

✓ Low risk — traffic unaffected ⚡ Active protection — blocks attacks

✓ Ideal for analysis and visibility ⚠ False positives may cut traffic
Architecture & Working Principle

Suricata Startup Output

📌 What does this output tell us?

All 4 cores of the CPU are used — proof of multi-

4 Threads: 32,847 Rules: ET Open rule set loaded, 0 errors — system ready
thread architecture

High-performance Linux kernel packet capture All events will be written to

AF_PACKET: EVE JSON:
active /var/log/suricata/[Link]
Rule Writing (Rules)

Rule Anatomy
A Suricata rule consists of 3 parts:

alert tcp $EXTERNAL_NET any → $HOME_NET 22 (msg:"SSH Scan"; sid:1001;

rev:1;)

1. ACTION 2. HEADER 3. OPTIONS

Specifies
what to do
Rule message (msg), content
when a
Protocol, source IP/port and destination IP/port matching (content),
match
information. Defines which traffic will be inspected. rule ID (sid) and other advanced
occurs.
settings.
alert, drop,
pass, reject

→ Works
Action Types: alert drop pass reject in IPS
mode
Rule Writing (Rules)

Rule Writing — Real Examples

📌 Rule descriptions:
Only check traffic going to the server (reduces Generate alarm if more than 5 attempts in 60
flow: to_server → threshold: →
unnecessary alerts) seconds (brute-force detection)
Look at HTTP User-Agent header — application Case-insensitive matching — python-Requests
http.user_agent → nocase; →
layer analysis also matches
Rule Writing (Rules)

Ready Rule Sets

Emerging Threats Open (ET Open) FREE

The most widely used open-source rule set. Updated daily. Provides comprehensive coverage for port scanning, exploit attempts, C2
communication, and malware traffic.

Emerging Threats Pro (ET Pro) PAID

The commercial version of ET Open. Includes 24-72 hour early access for new threats, fewer false positives, and support contract.

Talos Rules (Snort) PAID

Rule set developed by the Cisco Talos team. Comes in Snort format but is compatible with Suricata. Particularly strong for enterprise threats.

🔧 suricata-update
Suricata's official rule update tool. Automatically downloads, updates, and merges rule sets. All active rule sets are updated with the sudo
suricata-update command.
Rule set developed by the Cisco Talos team. Comes in Snort format but is compatible with Suricata. Particularly strong for enterprise threats.
Rule Writing (Rules)

Triggered Alert — [Link] Output

When a rule matches, [Link] looks like this:

📌 [Link] line structure:

[**] [SID:Rev] MESSAGE [**] | [Classification] | [Priority] | Timestamp | Src→Dst | Protocol info
Kurulum & Configuration

Suricata Installation (Ubuntu/Debian)

1 Add Repo & Update 2 Install Suricata

sudo add-apt-repository ppa:oisf/suricata-stable sudo apt-get install suricata -y

sudo apt-get update

To install the latest version from OISF's official PPA repository, we

Suricata and its dependencies are installed automatically.
first add the repository.

3 Download Rule Set 4 Test & Start

sudo suricata-update sudo suricata -T -c /etc/suricata/[Link] -v

sudo suricata-update list-sources sudo systemctl start suricata

ET Open rule set is automatically downloaded. Additional sources

The -T flag tests the configuration. If no errors, we start the service.
can be viewed with list-sources.
Configuration

[Link] — Configuration File

HOME_NET
Your own network's IP block. Suricata uses this to
distinguish 'internal' and 'external' traffic. Wrong
setting → wrong alerts.

af-packet: interface
Which network interface to capture packets from.
Interface name is learned with the ip a command.

threads: auto
CPU core count is automatically detected. Can also be
set manually.

cluster-type
How traffic is distributed among threads. cluster_flow
keeps flows in the same thread.

outputs
Which log formats are active. eve-log and fast-log are
the most commonly used.
Configuration

Operation Modes & Live Statistics

📌 What do the important counters tell us?

Should be 0 — if packet loss exists, Total alerts generated — rule match

capture.kernel_drops [Link]
there is a performance issue tracking

Number of HTTP flows analyzed — Active flow counts — network load

app_layer.[Link] [Link] / [Link]
Layer 7 depth indicator
Log & Integration

EVE JSON — Suricata's Log Format

timestamp
Exact time of the event (ISO 8601 format)

flow_id
Links all events belonging to the same connection

event_type
alert, dns, http, tls, flow, fileinfo…

src_ip / dest_ip
Source and destination IP addresses

[Link]
Signature text of the triggered rule

[Link]
1=High, 2=Medium, 3=Low priority

💡 The Power of EVE JSON: [Link]

All event types in a single file. alert-DNS-HTTP records can be linked via flow_id. Can be analyzed from terminal
alert, with
drop, pass jq, or visually
— action taken with
ELK/Splunk/Grafana.
Log & Integration

ELK Stack Integration

Filebeat Logstash
Monitors Suricata's [Link] file and forwards it line by line to Parses JSON data, enriches it (adds IP geolocation), and formats it
Logstash. Lightweight, fast, and low resource usage. for sending to Elasticsearch.

Elasticsearch Kibana
Indexes logs for full-text search and analysis. Provides data to Visualizes Elasticsearch data. Dashboards, maps, time series
Kibana and other tools via API. charts, and alert lists can be created.
Log & Integration

Kibana Dashboard — Visual Analysis

The dashboard above: real-time alert counter • hourly alert graph • category distribution • detailed alert table
Log & Integration

Real Scenario: Nmap Port Scan Detection

1 Attacker Starts Scanning 2 Suricata Detects 3 Alert Generated ([Link])

Attacker runs: nmap -sS -O [Link]/24 ET SCAN Nmap Scripting Engine rule is [**] ET SCAN Nmap OS Detection...
command. Numerous TCP SYN packets triggered. The 'Nmap' User-Agent string [Priority: 1] [Link]:52341 →
are sent to different ports. inside the packet is recognized. [Link]:445

4 EVE JSON Recorded 5 Visible in Kibana 6 In IPS Mode: Blocked!

A complete record is created with Sudden spike in alerts peaks in the If a drop rule exists, SYN packets are
event_type: alert, src_ip, dest_ip, dashboard graph. SOC analyst receives dropped. The attacker cannot see any
signature, severity, flow_id. notification. open ports.
CON CL US ION

Why is Suricata Preferred?

🔓 Open Source & Free ⚡ High Performance 🎯 Versatile

No licensing cost, no need for enterprise Handles 10 Gbps+ traffic with multi-
IDS + IPS + NSM in a single installation.
support. thread.

🔬 Deep Analysis 🔗 Integration 🌍 Large Community

Compatible with ELK, Splunk, Grafana,

HTTP, DNS, TLS analysis up to Layer 7. OISF, Proofpoint ET rules, active forum.
MISP.

Thank you for listening

 REFERENCES

Sources & References

[1] OISF. (2024). Suricata User Guide. Open Information Security Foundation. [Link]
[2] Proofpoint / Emerging Threats. (2024). ET Open Ruleset. [Link]
[3] Roesch, M. (1999). Snort — Lightweight Intrusion Detection for Networks. USENIX LISA Conference Proceedings.
[4] Elastic N.V. (2024). ELK Stack Documentation: Elasticsearch, Logstash, Kibana. [Link]
[5] Intel Corporation. (2023). DPDK — Data Plane Development Kit Documentation. [Link]
[6] Cisco Talos Intelligence Group. (2024). Snort 3 Rule Writing Guide. [Link]
[7] Sanders, C., & Smith, J. (2014). Applied Network Security Monitoring. Syngress / Elsevier.