Configuring Suricata for Network Monitoring

When to Use

• Deploying a high-performance IDS/IPS capable of multi-threaded packet processing for 10+ Gbps network links
• Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols
• Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers
• Running in inline (IPS) mode to actively block malicious traffic at network choke points
• Combining signature-based detection with protocol anomaly detection and file extraction

Do not use as a standalone security solution without complementary controls, for encrypted traffic inspection without TLS decryption capabilities, or on systems with insufficient CPU/memory for the expected traffic volume.

Prerequisites

• Suricata 7.0+ installed from PPA or source (suricata --build-info)
• Network interface on a span port, tap, or inline bridge for traffic capture
• AF_PACKET or DPDK support for high-performance packet capture
• Emerging Threats Open or Pro ruleset subscription (or Snort Talos rules via oinkcode)
• suricata-update tool for automated rule management
• Elasticsearch/Kibana or Splunk for log analysis and visualization

Workflow

Step 1: Install Suricata and Dependencies

# Install from PPA (Ubuntu/Debian)
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install -y suricata suricata-update jq

# Verify installation
suricata --build-info | grep -E "Version|AF_PACKET|NFQueue"