Suricata: Network Intrusion Detection and Prevention
Suricata watches network traffic and matches it against rules describing known attacks. It can run passively, alerting on what it sees, or inline, dropping traffic that matches.
IDS or IPS
Detection mode takes a copy of traffic from a mirror port or a tap. It sees everything and affects nothing, so a false positive costs you an alert rather than an outage.
Prevention mode sits in the path and drops matching traffic. More protective and considerably higher stakes, since a bad rule now breaks your network.
Start in detection mode. Move to prevention only once you know what your normal traffic looks like and have tuned out the noise.
More than signature matching
Suricata does protocol analysis rather than just pattern matching on bytes. It understands HTTP, DNS, TLS, SMB, and others, which means rules can be written against protocol semantics rather than raw content.
It logs rich metadata as a side effect, which is often more useful day to day than the alerts. Every DNS query, every TLS handshake with its SNI and certificate details, every HTTP request. That record answers questions like which device contacted an unfamiliar domain, and it does so without decrypting anything.
File extraction pulls files out of the traffic stream for separate analysis.
Rules
The Emerging Threats open ruleset is the usual starting point, managed with suricata-update. Commercial rulesets exist with better coverage.
Tuning is the actual work. Default rules generate substantial noise on a normal network, and an alert stream nobody reads is worth nothing. Expect to spend real time suppressing rules that do not apply to you.
The encryption reality
Most traffic is TLS encrypted, so Suricata sees the metadata and not the content. That is still valuable, since destination, timing, certificate details, and JA3 fingerprints reveal a great deal, but it is not the deep inspection people sometimes imagine.
Where it fits
A homelab with a mirror port, where you want to know what your devices talk to. Pair it with Arkime for full packet capture or Zeek for richer connection logs.
Not a single server. Host-based tools like Wazuh or CrowdSec give more value there.
License
Suricata is released under the GPL-2.0 License.