How to Detect Network Attacks With Suricata IDS on a Mirror Port

Step by step

1. Mirror the right traffic

   Mirror the gateway uplink or server VLAN to the sensor's second port. The sensor's capture port needs no IP address.

2. Install Suricata

   Use the distribution package (or the OISF PPA on Ubuntu for newer versions).

   sudo apt update && sudo apt install -y suricata
   

3. Set the capture interface and home network

   In /etc/suricata/suricata.yaml set HOME_NET to your internal ranges and the af-packet interface to the mirror port.

   vars:
     address-groups:
       HOME_NET: "[10.0.0.0/8,192.168.0.0/16]"
   af-packet:
     - interface: eth1
   

4. Download rules

   suricata-update fetches the free Emerging Threats Open rule set.

   sudo suricata-update
   sudo systemctl enable --now suricata
   

5. Test detection

   From a test machine, request a page that triggers a well-known test rule, then check the alert log.

   curl http://testmynids.org/uid/index.html
   sudo tail -f /var/log/suricata/fast.log
   

6. Send alerts to your SIEM

   Suricata writes JSON events to eve.json. Ship that file to your SIEM (Wazuh agent or log shipper) to correlate alerts with server logs.

7. Tune

   Disable rules for protocols you do not use and suppress known false positives, so the remaining alerts are worth investigating.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.