Suricata as IPS

JJJCR · 11-13-2018, 09:55 PM

Hi guys, anyone tried using suricata for IPS?

In a local LAN and with unmanaged switches, Suricata can just be installed on any PCs and it's able to detect the activity for the whole network?

or it has to be located on an a location were all traffic will pass through?

Thanks.

RickDeckard · 11-16-2018, 05:59 PM

An IDPS like Suricata should always be installed inline for best results. Do you want it to detect attacks as they are happening? Or do you want it to detect copied attack traffic?

JJJCR · 11-18-2018, 07:33 PM

- Copied attack traffic

For detect attacks as they are happening, I have to connect it like some sort a proxy connection? In which all the traffic will pass through Suricata.

////// · 11-19-2018, 07:55 AM

Quote:

Originally Posted by JJJCR

- Copied attack traffic

For detect attacks as they are happening, I have to connect it like some sort a proxy connection? In which all the traffic will pass through Suricata.

use network bridge.
thats what i am using.

|internet|-----------------|bridge(openbsd or linux)|------------|private network|

one thing that you could use is pfsense firewall, when i used it it had snort and suricata available for users.

JJJCR · 11-21-2018, 07:16 PM

Thanks buddy! Cheers!