Configuring Suricata for Network Monitoring

When to Use

• Deploying a high-performance IDS/IPS capable of multi-threaded packet processing for 10+ Gbps network links
• Monitoring network traffic with protocol-aware inspection for HTTP, TLS, DNS, SMB, and other protocols
• Generating structured EVE JSON logs for direct SIEM ingestion without custom parsers
• Running in inline (IPS) mode to actively block malicious traffic at network choke points
• Combining signature-based detection with protocol anomaly detection and file extraction

Do not use as a standalone security solution without complementary controls, for encrypted traffic inspection without TLS decryption capabilities, or on systems with insufficient CPU/memory for the expected traffic volume.

Prerequisites

• Suricata 7.0+ installed from PPA or source (suricata --build-info)
• Network interface on a span port, tap, or inline bridge for traffic capture
• AF_PACKET or DPDK support for high-performance packet capture
• Emerging Threats Open or Pro ruleset subscription (or Snort Talos rules via oinkcode)
• suricata-update tool for automated rule management
• Elasticsearch/Kibana or Splunk for log analysis and visualization

Workflow

Step 1: Install Suricata and Dependencies

# Install from PPA (Ubuntu/Debian)
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt update
sudo apt install -y suricata suricata-update jq

# Verify installation
suricata --build-info | grep -E "Version|AF_PACKET|NFQueue"

# Or install from source for latest features
sudo apt install -y libpcre2-dev build-essential autoconf automake libtool \
  libpcap-dev libnet1-dev libyaml-dev libjansson-dev libcap-ng-dev \
  libmagic-dev libnetfilter-queue-dev libhiredis-dev rustc cargo cbindgen
git clone https://github.com/OISF/suricata.git
cd suricata && git clone https://github.com/OISF/libhtp.git -b 0.5.x
./autogen.sh && ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var \
  --enable-nfqueue --enable-af-packet
make -j$(nproc) && sudo make install install-conf

Step 2: Configure Network Interfaces

# Disable NIC offloading features
sudo ethtool -K eth1 gro off lro off tso off gso off rx off tx off sg off

# Set interface to promiscuous mode
sudo ip link set eth1 promisc on

# For high-performance deployments, configure AF_PACKET with multiple threads
# Edit /etc/suricata/suricata.yaml

Step 3: Configure suricata.yaml

# /etc/suricata/suricata.yaml (key sections)

# Network variables
vars:
  address-groups:
    HOME_NET: "[10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16]"
    EXTERNAL_NET: "!$HOME_NET"
    HTTP_SERVERS: "$HOME_NET"
    DNS_SERVERS: "$HOME_NET"
    SMTP_SERVERS: "$HOME_NET"

# Default rule path
default-rule-path: /var/lib/suricata/rules
rule-files:
  - suricata.rules

# AF_PACKET configuration for high performance
af-packet:
  - interface: eth1
    threads: auto
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    ring-size: 200000
    buffer-size: 262144

# EVE JSON logging (primary output format)
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      pcap-file: false
      community-id: true
      types:
        - alert:
            tagged-packets: yes
            payload: yes
            payload-printable: yes
            http-body: yes
            http-body-printable: yes
        - http:
            extended: yes
        - dns:
            query: yes
            answer: yes
        - tls:
            extended: yes
        - files:
            force-magic: yes
            force-hash: [md5, sha256]
        - smtp:
            extended: yes
        - flow
        - netflow
        - anomaly:
            enabled: yes
        - stats:
            totals: yes
            threads: yes

  # PCAP logging for captured packets that trigger alerts
  - pcap-log:
      enabled: yes
      filename: alert-%n.pcap
      limit: 100mb
      max-files: 50
      mode: normal
      use-stream-depth: no
      honor-pass-rules: no

# Stream engine settings
stream:
  memcap: 512mb
  checksum-validation: no
  reassembly:
    memcap: 1gb
    depth: 1mb
    toserver-chunk-size: 2560
    toclient-chunk-size: 2560

# Detection engine
detect:
  profile: high
  custom-values:
    toclient-groups: 200
    toserver-groups: 200
  sgh-mpm-context: auto
  inspection-recursion-limit: 3000

# Protocol detection and parsing
app-layer:
  protocols:
    http:

…