Suricata is a high-performance, open-source network threat detection engine. It inspects packets against thousands of rules describing known attacks, malware traffic, scans and policy violations, and logs what it finds. Running it on a server, or on a gateway in front of several servers, gives you visibility into what’s hitting the network and, importantly, into suspicious outbound traffic from a compromised host.

IDS vs IPS

  • IDS mode (intrusion detection) watches a copy of the traffic and alerts. There’s no risk of blocking legitimate traffic. Start here.
  • IPS mode (intrusion prevention) sits inline (via NFQUEUE or AF_PACKET bridging) and can drop matching packets. It’s more powerful, and riskier: a bad rule can cut off real users.

Requirements

Suricata is CPU- and memory-hungry relative to simple tools. For a single VPS with modest traffic, 2 vCPU and 2–4 GB of RAM for Suricata itself is a reasonable minimum, because rule sets take memory. On a busy server, run it on a separate gateway, or limit the rules.

Encrypted traffic (HTTPS, SSH) can’t be inspected in content, but Suricata still sees connection metadata, TLS SNI and certificates, JA3/JA4 fingerprints, DNS queries and flow patterns.

Install

Ubuntu (OISF PPA for current versions):

sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update && sudo apt install suricata jq

Debian: sudo apt install suricata (or backports). RHEL family: from EPEL or the OISF COPR repository.

suricata --build-info | head

Configure the interface and networks

Edit /etc/suricata/suricata.yaml:

vars:
  address-groups:
    HOME_NET: "[203.0.113.10/32,10.0.0.0/24]"      # your server's public IP and private networks
    EXTERNAL_NET: "!$HOME_NET"

af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

Find the interface name with ip -br link. Correct HOME_NET matters, because many rules depend on direction (external → home).

Load rules

suricata-update downloads and manages rule sets. The free Emerging Threats Open set is the default:

sudo suricata-update
sudo suricata-update list-sources        # other free and commercial sources
sudo suricata -T -c /etc/suricata/suricata.yaml -v     # test the config
sudo systemctl enable --now suricata

Run suricata-update daily (a timer or cron), followed by a rule reload: sudo suricatasc -c reload-rules.

Read the alerts

Suricata writes JSON events to /var/log/suricata/eve.json, covering alerts and protocol metadata (DNS, HTTP, TLS, flows):

sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert") | {time: .timestamp, src: .src_ip, dest: .dest_ip, sig: .alert.signature, sev: .alert.severity}'

Top alert signatures:

sudo jq -r 'select(.event_type=="alert") | .alert.signature' /var/log/suricata/eve.json | sort | uniq -c | sort -rn | head

A quick test that detection works:

curl http://testmynids.org/uid/index.html
grep -i 'GPL ATTACK_RESPONSE' /var/log/suricata/fast.log

What to look for

  • Inbound: exploitation attempts against your web apps and services, scans. These are mostly noise for a well-patched server, but they show trends.
  • Outbound, from your servers: connections to known command-and-control or mining infrastructure, unusual DNS lookups, cleartext credential leaks. These are high-priority, because they suggest a compromise. See detect a compromised server.

Tuning

Expect a lot of alerts initially.

  • Disable irrelevant rule categories in /etc/suricata/disable.conf (for example rules for protocols you don’t run), then rerun suricata-update.
  • Suppress specific noisy signatures for known-good hosts in threshold.config.
  • Keep HOME_NET accurate.
  • Rotate eve.json with logrotate, because it grows fast. See logrotate.

Visualise and alert

Ship eve.json to a central platform: Wazuh (which has a Suricata integration), Elasticsearch/OpenSearch, Grafana Loki, or a dedicated tool like EveBox. Alert on high-severity signatures and on any outbound alert from your servers. See Wazuh.

Suricata vs other tools

Tool Layer Strength
Suricata Network Signature-based detection of attacks and malware traffic
Zeek Network Rich traffic logs for analysis, less signature-focused
Wazuh / OSSEC Host Logs, file integrity, vulnerabilities
Fail2Ban / CrowdSec Host (logs) Blocking abusive IPs

Quick reference

Task Command
Test config suricata -T -c /etc/suricata/suricata.yaml
Update rules suricata-update
Reload rules suricatasc -c reload-rules
Alerts /var/log/suricata/eve.json, fast.log
Filter alerts jq 'select(.event_type=="alert")'

Related: tcpdump and server security monitoring.

  • Security
  • Networking
  • Monitoring