---
title: "Suricata & Snort — IDS/IPS Configuration"
domain: monitoring
subdomain: suricata
type: snippet
tags: [suricata, snort, ids, ips, nids, detection, network]
difficulty: intermediate
status: stable
updated: "Sat May 30 2026 00:00:00 GMT+0000 (Coordinated Universal Time)"
---
## Suricata — Installation

```bash
# Ubuntu/Debian
add-apt-repository ppa:oisf/suricata-stable
apt update && apt install -y suricata

# Vérification
suricata --version
suricata-update  # MAJ des règles Emerging Threats
```

### Docker
```yaml
# docker-compose.yml
services:
  suricata:
    image: jasonish/suricata:latest
    network_mode: host
    cap_add:
      - NET_ADMIN
      - NET_RAW
      - SYS_NICE
    volumes:
      - ./suricata.yaml:/etc/suricata/suricata.yaml
      - ./rules:/var/lib/suricata/rules
      - ./logs:/var/log/suricata
    command: -i eth0
```

---

## Configuration suricata.yaml

```yaml
# /etc/suricata/suricata.yaml

# Réseau local
vars:
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
    EXTERNAL_NET: "!$HOME_NET"
  port-groups:
    HTTP_PORTS: "80,8080,8443"
    SHELLCODE_PORTS: "!80"

# Outputs
outputs:
  - eve-log:
      enabled: yes
      filetype: regular
      filename: eve.json
      types:
        - alert
        - http
        - dns
        - tls
        - flow
        - ssh

# Interface
af-packet:
  - interface: eth0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

# Règles
rule-files:
  - suricata.rules
  - /var/lib/suricata/rules/emerging-threats.rules
```

---

## Syntaxe des règles

### Structure
```
action proto src_ip src_port direction dst_ip dst_port (options)
```

### Exemples de règles

```bash
# Détection scan nmap SYN
alert tcp $EXTERNAL_NET any -> $HOME_NET any \
  (msg:"SCAN nmap SYN Stealth"; flags:S,12; \
  threshold:type threshold,track by_src,count 20,seconds 1; \
  sid:1000001; rev:1;)

# Détection SQLi basique
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS \
  (msg:"SQL Injection attempt"; \
  content:"' OR"; http_uri; nocase; \
  sid:1000002; rev:1;)

# Détection shell inverse
alert tcp $HOME_NET any -> $EXTERNAL_NET any \
  (msg:"Possible Reverse Shell - /bin/bash"; \
  content:"/bin/bash"; \
  sid:1000003; rev:1;)

# Exfiltration DNS (requêtes longues suspectes)
alert dns any any -> any 53 \
  (msg:"DNS exfiltration - long subdomain"; \
  dns.query; content:"."; \
  byte_test:1,>,50,0,string,dec; \
  sid:1000004; rev:1;)

# Détection Mimikatz via SMB
alert smb any any -> $HOME_NET any \
  (msg:"Possible Mimikatz - lsass dump via SMB"; \
  content:"lsass"; nocase; \
  sid:1000005; rev:1;)
```

### Options clés

| Option | Description |
|--------|-------------|
| `msg` | Message d'alerte |
| `content` | Correspondance chaîne |
| `pcre` | Regex Perl |
| `threshold` | Limitation alertes |
| `sid` | ID unique règle |
| `rev` | Révision |
| `classtype` | Catégorie (trojan-activity, etc.) |
| `priority` | 1 (haute) à 255 |

---

## Mode IPS (inline)

```bash
# Activer NFQueue
suricata -c /etc/suricata/suricata.yaml -q 0

# iptables pour rediriger le trafic
iptables -I FORWARD -j NFQUEUE --queue-num 0
iptables -I INPUT -j NFQUEUE --queue-num 0
iptables -I OUTPUT -j NFQUEUE --queue-num 0

# Dans suricata.yaml : mode = repeat (drop le trafic)
nfq:
  mode: repeat
  repeat-mark: 1
  repeat-mask: 1
  bypass-mark: 1
  bypass-mask: 1
```

---

## Snort — Comparaison et config rapide

```bash
# Installation Snort 3
apt install -y snort3

# Configuration /etc/snort/snort.lua
HOME_NET = "192.168.0.0/16"
EXTERNAL_NET = "!$HOME_NET"

# Règle Snort 3
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 \
  (msg:"SSH Brute Force"; \
  detection_filter:track by_src, count 5, seconds 60; \
  sid:2000001;)

# Lancement
snort -c /etc/snort/snort.lua -i eth0 -A alert_fast
```

### Suricata vs Snort

| | Suricata | Snort 3 |
|---|---|---|
| Multi-thread | Oui (natif) | Oui (v3) |
| Protocoles | HTTP2, TLS, QUIC | HTTP, TLS |
| Output | EVE JSON | Unified2, JSON |
| Performance | Très haute | Haute |
| Règles | ET + Snort compat | Snort native |
| IPS inline | NFQueue, AF_PACKET | NFQueue |

---

## Intégration ELK (EVE JSON → Elasticsearch)

```yaml
# Filebeat module suricata
filebeat.modules:
  - module: suricata
    eve:
      enabled: true
      var.paths: ["/var/log/suricata/eve.json"]

output.elasticsearch:
  hosts: ["localhost:9200"]
  index: "suricata-%{+yyyy.MM.dd}"
```

### Dashboards Kibana
```bash
# Importer dashboards Suricata
filebeat setup --dashboards

# Index pattern : suricata-*
# Champs clés : alert.signature, src_ip, dest_ip, proto
```

---

## Mise à jour des règles

```bash
# suricata-update (Emerging Threats)
suricata-update list-sources
suricata-update enable-source et/open
suricata-update

# Cron quotidien
0 3 * * * /usr/bin/suricata-update && systemctl reload suricata
```