Suricata në Praktikë

Suricata is a high-performance, open-source IDS/IPS developed by the Open Information Security Foundation (OISF).

Suricata reads traffic from a network interface (using AF_PACKET, PF_RING or DPDK on Linux) and evaluates each packet against a set of rules written in a syntax inherited from Snort. Rules look like: alert http any any -> any any (msg:"Possible SQLi"; content:"UNION SELECT"; nocase; sid:1000001;). The sid is a unique rule identifier; sid ranges above 1,000,000 are reserved for local rules. Beyond pattern matching, Suricata also does protocol parsing (HTTP, TLS, DNS, SMB, SSH) and writes structured event logs in EVE JSON format that you can feed into Elastic, Splunk, or an open-source stack like Security Onion. Its multi-threaded design lets it handle 10+ Gbps on modern servers, which was historically Snort's weakness. For a learning lab, install Suricata on a Linux VM, set it to listen on a span port in front of your test environment, load the Emerging Threats Open ruleset, and generate traffic with Kali tools like nmap, sqlmap and nikto. Watch the alerts stream in and learn to read each event: flow, signature, severity, http metadata. This hands-on loop is the fastest way to build detection intuition.

Mjetet shoqëruese:

• suricata-update — menaxhimi i rule sets.
• evebox, Kibana + Elastic — UI për alarme.
• tcpdump, tshark — për capture manual.

Ekzekutim në modalitet offline mbi një PCAP dhe shikim i rezultatit në JSON:

suricata -r sample.pcap -l /tmp/suri/
jq '.alert.signature' /tmp/suri/eve.json | sort | uniq -c

Aktivizim i rregullave ET Open:

suricata-update enable-source et/open
suricata-update
systemctl reload suricata

1. Shkarko një PCAP nga malware-traffic-analysis.net dhe ekzekuto Suricata kundër tij.
2. Identifiko rregullin që u aktivizua dhe shpjego pse alarmoi.

• Suricata User Guide (GitBook).
• OISF (Open Information Security Foundation) community forum.