How to Use Suricata for Network Intrusion Detection (Step-by-Step Guide)
Network security isn’t just about blocking traffic, it’s about seeing what’s happening on your network in real time. This is where Intrusion Detection Systems (IDS) come into play, and one of the most powerful open-source options available today is Suricata.
This guide walks through Policy Implementation and Compliance from a practical angle: installing Suricata, configuring it correctly, loading detection rules, and validating that it actually catches suspicious activity — all in a safe, controlled lab environment.
What Is Suricata?
Suricata is an open source security engine that is an Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). It watches network traffic in real time, flags suspicious behavior and logs it for review.
Suricata features:
Multi-threading – efficient handling of large traffic volumes
Automatic protocol detection — detects protocols regardless of the port they are running on
Rule compatibility — compatible with existing Snort rule sets, so you don’t have to start from scratch
Real-time alerting and logging - provides insight into attacks in progress.
Step-by-Step Suricata Setup
Step 1:
Install Suricata:
· Follow
the below Commands to install Suricata and Update the system.
Step 2:
Configure Suricata
·
Find the IP address: open
the terminal and identify the IP address
that you want to monitor using the below command:
Step 3:
Edit the Suricata Configuration File: in
the same terminal Open the main configuration file by following command:
Now Update network address in configuration file in the following lines of the file:
· HOME_NET:
Set the HOME_NET variable to define your network:
· HOME_NET: "[192.168.1.1/24]"
After updating the network address in the configuration file you will see exact as shown in the image below
Step 4: Suricata
uses rule files to detect threats. Download the latest Emerging Threats rules:
Step 5: Add
Ping Flood Rule
·
Create the file using the
following command:
·
Copy
and paste the following code into the file. Do not change the code.
NOTE: Each rule starts with alert. There are 2 rules. They should be in 2 long lines
·
When
you will copy it. It should be pasted in the file in two lines only for the
reference I have attached the image below.
- · After you paste the code in the file the Save the file.
Step 6: Edit the Configuration
File: now add ping-flood.rules file in configuration file. Follow the below command
to add the file:
- Use
CTRL-F to open the find dialog box at the bottom of the screen.
- Type
in rule-files → press Enter
- Find
the following section.
- Add the third line but replace the username with your machine user name.
Step 7: Test Configuration:
Verify the configuration file is error-free:
Step 8: Python Ping Flood Attack
(only for study purpose):
Now we will simulate a ping flood attack.
Ping Flood Attack:
·
A
ping flood attack, also known as an ICMP flood, is a type of denial-of-service
(DoS) attack that overwhelms a network device or service with ICMP data
packets:
·
The
attacker sends a large number of ICMP echo-request packets (pings) to the
target device. The target device responds with an equal number of reply
packets, making it inaccessible to normal traffic.
Ø Create a file with
extension .py then copy the below code and paste in the python file and save
it.
Ø Now This Python script
will simulate a ping flood attack.
Step 10: Now run the ping-flood.py program and then enter the victim’s machine ip address.
Step 11: now
open the new terminal in the another machine where you have run the Suricata then follow the below command and summarize the logs which
will shows the attack information.
After you run the above command you will see the output as shown in the image below:
