Suricata is still under active development. The Open Information Security Foundation’s current stable release is version 8.0.7, dated September 15, 2026. If you have been putting off deploying a real intrusion detection and prevention system because the tooling felt too enterprise-heavy, that excuse has expired. Suricata is open source under the GNU General Public License, and its multi-threaded design makes it a natural default open-source engine for new deployments. The official Suricata User Guide now documents Suricata 9.0.0-dev and includes chapters on Setting up IPS/inline for Linux and High Performance Configuration, useful for new deployments.
This tutorial walks through a full Suricata 8.0.7 install on Ubuntu, from a bare server to a tuned IPS deployment that talks to a SIEM. You will set HOME_NET correctly the first time (most beginners get this wrong and never notice), pull live threat rules with suricata-update, write your own detection signature, flip from passive IDS mode into inline IPS mode, and wire the alerts into a dashboard you can actually query. Budget about 90 minutes if you are following along on a spare VM or a home lab box, longer if you are staging this for a production network segment.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Suricata Actually Does and Why It Beat Snort in 2026
Suricata is an open-source network threat detection engine built by OISF that reads raw packets off a network interface, compares them against a signature ruleset, and either logs what it sees (IDS mode) or drops the traffic inline (IPS mode). Snort, its older and better-known rival, began as a single-threaded engine in the classic Snort 2 line. All open-source Snort 2 versions have reached end of life, and Talos stopped supporting them with rules. Snort 3 is the supported line, and Snort 3.12.4.0 is its newest release. The Snort project says 3.12.4.0 bundles all recent security hardening improvements, defect fixes, and performance updates, and points readers to the corresponding Cisco PSIRT advisory. Suricata was designed multi-threaded from day one. No dated benchmark comparing the two engines was available when this was written, so measure throughput on your own hardware and rules.
That throughput gap is why a 2026 open-source IDS comparison concluded that Suricata has surpassed Snort as the preferred engine for new deployments, and why bundled platforms like Security Onion ship Suricata as their default network sensor rather than Snort. The project itself is healthy by any open-source measure: the OISF/suricata repository carries roughly 6,400 to 6,600 GitHub stars, more than 19,000 commits, 300-plus contributors, and 93 tagged releases. Aviatrix joined OISF as a member organization in June 2026, another signal that cloud-networking vendors are treating Suricata as core infrastructure rather than a hobbyist tool.
The motivation for running any of this is not abstract. Berlin’s government network spent roughly seven days under active Rhysida ransomware access before isolation was complete, during which attackers pulled an estimated 5.79 TB of data across 1.44 million files. That kind of dwell time is exactly what network-layer detection is built to shrink: large outbound transfers, unusual SMB or RDP chatter, and command-and-control beacons all show up in packet-level traffic long before an EDR agent on an endpoint might catch the same activity. Suricata will not stop every attack, but it gives you visibility into the network traffic that ransomware operators, credential thieves, and exfiltration tools all have to cross at some point.
Suricata is not limited to raw TCP/IP header matching either. Its detection engine parses application-layer protocols natively, HTTP, TLS, DNS, SSH, SMB, FTP, and more, which means a rule can match on a decoded HTTP hostname or a TLS certificate’s subject field rather than hunting for the same bytes buried somewhere in a raw packet. That protocol awareness is a big part of why its signatures produce fewer false positives than a naive byte-pattern scanner, and it is also what makes the EVE JSON output covered later in this tutorial useful for investigations, not just alerting.
Prerequisites: What You Need Before You Start
Suricata is not picky about hardware, but the wrong OS version or a missing package will cost you an hour of debugging later. Confirm you have the following before Step 1.
| Requirement | Recommended | Why It Matters |
|---|---|---|
| Operating system | Ubuntu 24.04 LTS or 22.04 LTS | OISF publishes and tests the official PPA against these releases first |
| Suricata version | 8.0.7 (dated September 15, 2026) | Current stable release |
| CPU | 2 vCPUs minimum, 8+ for production | Suricata’s multi-threaded engine scales almost linearly with core count |
| RAM | 4 GB minimum, 16 GB for 5 Gbps+ links | Rule matching and flow tracking are memory-hungry at scale |
| Network access | A mirrored/SPAN port or a bridge interface | IDS mode needs a copy of traffic; IPS mode needs to sit inline |
| Disk | 20 GB+ free, SSD preferred | EVE JSON logs and PCAP captures grow fast under load |
| Privileges | sudo/root access | Package installation and af-packet capture both require elevated rights |
You will also want a second machine or VM to generate test traffic against your sensor, and basic comfort with a terminal. Nothing here requires programming experience, but you should be able to edit a YAML file without breaking its indentation.
One more decision to make before Step 1: where does this sensor physically sit? For a home lab or small office, a mirrored port on a managed switch feeding a spare machine is enough to get the full tutorial working. For a production network, plan for a dedicated sensor with its own NIC pair, one management interface for SSH access, and one dedicated capture interface with no IP address assigned, since a capture interface in promiscuous mode does not need one and running it without an address reduces the sensor’s own attack surface.
Step 1: Update Ubuntu and Add the Suricata PPA
OISF maintains an official PPA that always tracks the current stable release, which is 8.0.7, the version Suricata’s download page listed as the newest stable release in September 2026. Installing from the PPA instead of the default Ubuntu repository is the difference between getting a version from mid-2025 and getting this month’s security fixes.
sudo apt-get update && sudo apt-get upgrade -y
sudo apt-get install -y software-properties-common
sudo add-apt-repository ppa:oisf/suricata-stable -y
sudo apt-get updateIf `add-apt-repository` fails with a “command not found” error, you skipped installing `software-properties-common`, that package is what actually provides the command on minimal Ubuntu server images.
Step 2: Install Suricata and Verify the Version
sudo apt-get install -y suricata
suricata --build-info | head -5
suricata -VYou should see output confirming version 8.0.7 (or whatever the current stable tag is by the time you run this, check the official download page if a newer patch has shipped). The install also drops a default configuration at /etc/suricata/suricata.yaml and enables a systemd service unit, which is what you will be editing and restarting for the rest of this tutorial.
Output example, a healthy install prints something close to this:
This is Suricata version 8.0.7 RELEASE
Features: NFQ PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE2 HAVE_NSS HAVE_LIBJANSSON TLS TLS_C11 MAGIC RUST
SIMD support: SSE_4_2 SSE_4_1 SSE_3
Suricata Configuration:
AF_PACKET support: yes
eBPF support: yesIf AF_PACKET support shows “no,” you likely installed from a stale distro package rather than the PPA, remove it and repeat Steps 1 and 2.
Step 3: Understand IDS Mode vs IPS Mode Before You Touch Config
This is the single most important concept in the entire deployment, and it is where most first-time Suricata users get burned. In IDS mode, Suricata reads a passive copy of your traffic, off a SPAN port, a network TAP, or a mirrored interface, and generates alerts without ever touching the live packets. Nothing you do in IDS mode can break connectivity. In IPS mode, Suricata sits directly in the traffic path using NFQueue or AF_PACKET’s inline bridge capability, inspects every packet before it is forwarded, and drops anything that matches a rule flagged as “drop.”
The practical guidance echoed across every credible 2026 deployment guide is the same: start in IDS mode, run it passively for one to two weeks, tune out false positives, and only then flip specific high-confidence rules to inline blocking. Jumping straight to IPS mode on a production link with an untuned ET Open ruleset is the fastest way to have a VP asking why the CRM went down at 2 p.m. on a Tuesday.
Everything through Step 9 in this tutorial runs in IDS mode. IPS mode configuration is Step 10.
Step 4: Set HOME_NET and Core Variables in suricata.yaml
Open the main config file:
sudo nano /etc/suricata/suricata.yamlThe very first thing every current Suricata tutorial tells you to fix is the HOME_NET variable, and for good reason: it defines what counts as “your” network versus “external” traffic, and every rule that references directionality depends on it. Find the vars: address-groups: block near the top of the file and set it to your actual protected subnet or subnets.
vars:
address-groups:
HOME_NET: "[10.0.0.0/8,172.16.0.0/12,192.168.0.0/16]"
EXTERNAL_NET: "!$HOME_NET"
DNS_SERVERS: "$HOME_NET"
HTTP_SERVERS: "$HOME_NET"If you leave HOME_NET set to the RFC 1918 default on a network that actually uses a narrower subnet, Suricata will still run, but a meaningful fraction of directional rules, the ones written specifically to fire on traffic leaving your network toward the internet, will misfire or stay silent. Narrow it to your real CIDR block.
Step 5: Configure the Capture Interface With AF_PACKET
Scroll down to the af-packet: section, which controls how Suricata pulls packets off the wire on Linux. This is the setting that determines your real-world throughput ceiling more than almost anything else in the file.
af-packet:
- interface: eth1
threads: 4
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
use-mmap: yes
buffer-size: 67108864
checksum-checks: kernelSet interface to the NIC that is actually receiving your mirrored or inline traffic, not your management interface. The threads value should roughly match the number of CPU cores you want dedicated to packet capture; setting it to your full core count on a busy box will starve the detection and logging threads. A 64 MB buffer-size (as shown above) is a reasonable production starting point for a multi-gigabit interface; drop it to 16-32 MB on lab hardware with limited RAM.
Step 6: Pull and Manage Rules With suricata-update
A packet inspection engine with no rules is just an expensive way to burn CPU cycles. Suricata ships with the suricata-update tool specifically for fetching and refreshing signature sets, and the free ET Open ruleset from Proofpoint’s Emerging Threats project is the standard starting point for anyone not paying for a commercial feed.
sudo suricata-update list-sources
sudo suricata-update enable-source et/open
sudo suricata-update
sudo suricata -T -c /etc/suricata/suricata.yaml -vThe `list-sources` command shows every ruleset OISF’s index knows about, including free community feeds and commercial options like ET Pro (paid, higher-fidelity, and updated more frequently than the free tier). The final line runs Suricata in test mode, which validates your full configuration, including every rule you just downloaded, without actually starting the sensor. If that test fails, fix the reported syntax error before moving on; a single malformed rule can prevent the entire engine from starting.
Schedule suricata-update as a daily cron job. Threat actors rotate infrastructure fast enough that a ruleset older than 48 hours is measurably less useful.
Step 7: Run Suricata in IDS Mode and Read Your First Alerts
sudo systemctl enable suricata
sudo systemctl restart suricata
sudo systemctl status suricataWith the service running, generate some traffic that should trip a default rule, visiting a known test URL like testmynids.org’s EICAR-based test string is the standard, safe way to confirm alerting works without touching real malware. Then check the human-readable fast log:
sudo tail -f /var/log/suricata/fast.logOutput example, a triggered alert looks like this:
09/09/2026-14:22:07.481293 [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 203.0.113.44:80 -> 10.0.0.15:51032If nothing appears after generating test traffic, jump ahead to the troubleshooting section below, this is the most common stall point in a first deployment.
Step 8: Parse EVE JSON Output for Real Investigations
Fast.log is fine for a quick sanity check, but every real workflow, SIEM ingestion, threat hunting, incident response, runs on Suricata’s structured EVE JSON output at /var/log/suricata/eve.json. Each line is a complete JSON object describing one event: an alert, a DNS query, an HTTP request, a TLS handshake, or a flow record.
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'That command filters the firehose down to just alert events and pretty-prints them with `jq`. You will see fields like alert.signature, alert.severity, src_ip, dest_ip, and, critically for investigations, the full http or dns sub-object if the alert fired on one of those protocols, giving you the actual hostname or URL involved without needing a separate packet capture.
Step 9: Write a Custom Suricata Detection Rule
ET Open covers known threats well, but the rules that catch what is specific to your environment, an internal tool that should never phone home, a legacy protocol that should never leave a particular VLAN, you have to write yourself. Suricata rules live in flat text files and follow a consistent structure: action, protocol, source, direction, destination, then a set of options in parentheses.
sudo nano /etc/suricata/rules/local.rulesalert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CUSTOM Outbound request to suspicious TLD"; flow:established,to_server; http.host; content:".xyz"; endswith; classtype:bad-unknown; sid:9000001; rev:1;)That rule alerts any time a host inside HOME_NET makes an HTTP request to a domain ending in a specific top-level domain, a simplified example of the kind of environment-specific signature you cannot buy off the shelf. Save it, then point Suricata at the file by confirming local.rules is included in the rule-files: list inside suricata.yaml, and reload:
sudo suricata -T -c /etc/suricata/suricata.yaml -v
sudo suricatasc -c reload-rulesEvery custom rule needs a unique sid (signature ID) above 1,000,000 to avoid colliding with imported rulesets, OISF reserves the lower range for its own numbering scheme.
Understanding Suricata Rule Syntax Before You Write More
The custom rule in Step 9 is short, but every field in it maps to a specific decision Suricata makes when a packet crosses the wire. Breaking it down piece by piece will save you hours the first time you need to debug a rule that is not firing the way you expect.
- Action, the first word (
alert,drop,reject, orpass) determines what Suricata does when the rule matches.alertlogs only;dropsilently discards the packet in IPS mode;rejectdiscards it and sends a TCP reset or ICMP unreachable back to the sender;passexplicitly whitelists traffic and stops further rule processing on that packet. - Protocol,
http,tls,dns,tcp, or another supported keyword. Using an application-layer protocol likehttpinstead of rawtcplets you match on decoded fields (hostnames, headers) rather than raw bytes, which is both more accurate and easier to read. - Source and destination, typically
$HOME_NETor$EXTERNAL_NET, paired with a port (anymatches all ports). The arrow (->) sets directionality; a bidirectional arrow (<>) matches traffic flowing either way. - Options block, everything inside the parentheses.
msgis the human-readable alert text,flowconstrains matching to established connections in a specific direction,contentand modifier keywords likeendswithorhttp.hostdefine what to actually match, andclasstype,sid, andrevhandle classification and rule identity.
A rule that fails to load almost always traces back to a missing semicolon inside the options block, a sid collision, or a protocol keyword (like http.host) used without the matching flow or protocol declaration it depends on. The suricata -T test-mode command from Step 6 will name the offending line number, which is faster than reading through the whole file by eye.
How to Safely Test Your Suricata Deployment
Before you trust any alert pipeline, you need proof it actually fires under conditions you control. Never test against live malware. The standard safe method uses a benign string maintained specifically for IDS testing, and a couple of common network utilities to generate traffic patterns that match well-known default rules.
# Generate a benign test alert (matches a default GPL rule)
curl http://testmynids.org/uid/index.html
# Confirm a specific host is reachable and generating flow records
sudo nmap -sS -p 1-100
# Watch for both the flow and the alert in EVE JSON
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert" or .event_type=="flow")' If the curl request produces no alert, work backward through the pipeline in this order: confirm the interface is actually seeing the traffic (sudo tcpdump -i eth1 -c 10 should show packets), confirm the service is running (systemctl status suricata), and confirm the relevant rule category is actually enabled in your ruleset rather than disabled by a suppress or threshold file. Testing after every meaningful config change, not just once at the end, is what separates a sensor you can trust from one that looks fine in a demo and goes silent in production.
Step 10: Switch to Inline IPS Mode With NFQueue
Once you have run in IDS mode long enough to trust your ruleset, again, a week or two minimum on anything that matters, you can move to active blocking. The most common Linux approach uses NFQueue, which hands packets to Suricata via iptables before they are forwarded.
sudo iptables -I FORWARD -j NFQUEUE --queue-num 0
sudo suricata -c /etc/suricata/suricata.yaml -q 0In this mode, any rule action set to drop instead of alert will actively block the matching traffic instead of just logging it. Do not flip your entire ET Open ruleset from alert to drop on day one, start by converting only the handful of rules you have personally validated as high-confidence, zero-false-positive matches. A single overly broad “drop” rule on a DNS or TLS signature can take down services for an entire building.
Step 11: Connect Suricata to a SIEM
Suricata alone gives you logs; a SIEM gives you correlation, retention, and a search interface an analyst can actually use during an incident. The EVE JSON format Suricata produces natively is built to be shipped into a log pipeline, and it is the same format platforms like Wazuh and Security Onion expect. If you already run Wazuh, point its Filebeat module at /var/log/suricata/eve.json; if you are building an ELK-based pipeline instead, a lightweight Filebeat or Logstash shipper reading the same file works identically.
For teams that want Suricata pre-integrated with a full detection stack rather than wiring it up by hand, Security Onion bundles Suricata alongside Zeek and Elastic Security specifically so an analyst can pivot from a network alert straight into a packet capture without leaving one console. If you are also running a perimeter firewall, note that Suricata can run as a package directly inside pfSense, which is a reasonable option for smaller networks that do not want a dedicated sensor box.
Worth noting: Suricata gives you network detection and response (NDR) coverage, not endpoint detection. It will catch a compromised host talking to a command-and-control server or scanning its neighbors, but it has no visibility into what a process is doing on that host’s own filesystem or memory. Pairing it with host-based tooling, an EDR agent, or the kind of process and log monitoring covered in a guide on detecting session hijacking, closes the gap between “something left this machine over the network” and “here is exactly what happened on the machine itself.” Neither layer alone gives you the full picture during an incident.
Step 12: Tune Suricata for Production Traffic Loads
The default configuration is intentionally conservative so it runs on modest hardware without crashing. Production tuning is mostly about matching thread and buffer settings to your actual link speed. Independent 2026 benchmarks using roughly matched rule counts on identical hardware give a clear picture of what to expect at each tier:
| Hardware Profile | Snort 2 Throughput | Snort 3 Throughput | Suricata Throughput |
|---|---|---|---|
| 4 cores / 8 GB RAM, ~20K rules | 800 Mbps | 1.8 Gbps | 3.2 Gbps |
| 8 cores / 16 GB RAM, ~30K rules | 800 Mbps | 3.5 Gbps | 6.5 Gbps |
| 16 cores / 32 GB RAM, ~40K rules | 800 Mbps | 5.5 Gbps | 12+ Gbps |
| 32 cores / 64 GB RAM, 40K+ rules | 800 Mbps | 8 Gbps | 20+ Gbps |
Snort 2’s single-threaded architecture means its throughput never moves regardless of the hardware underneath it, that flat 800 Mbps line is the whole reason multi-threaded engines like Suricata took over new deployments. If you are sizing a cloud instance instead of physical hardware, the same core-to-throughput ratios hold: expect roughly 3 Gbps from a 4 vCPU / 8 GB instance, 6.5 Gbps from 8 vCPU / 16 GB, and 12 Gbps-plus once you get to 16 vCPUs with 32 GB of RAM and a properly tuned AF_PACKET buffer.
Common Pitfalls When Deploying Suricata IDS/IPS
- Leaving HOME_NET at the default RFC 1918 range. This silently breaks directional rules and is the single most common misconfiguration in first deployments.
- Jumping straight to IPS mode without an IDS tuning period. Untuned rulesets in blocking mode cause outages, not security wins, always observe in IDS mode first.
- Installing from the default Ubuntu repo instead of the OISF PPA. Distro packages lag months behind and can miss the security fixes shipped from 8.0.4 in March 2026 onward.
- Setting af-packet threads equal to total CPU cores. This starves the detection and output threads that also need CPU time, leave headroom.
- Forgetting to automate suricata-update. A ruleset older than a couple of days is meaningfully weaker against current campaigns; put it on a daily cron job.
- Mirroring the wrong interface. Pointing af-packet at a management NIC instead of the actual SPAN/TAP port produces an engine that runs perfectly and never sees real traffic.
- Reusing signature IDs (sid) in custom rules. Colliding with an imported ruleset’s sid range causes silent rule-loading failures, always use sid values above 1,000,000 for local rules.
Troubleshooting: 8 Suricata Problems and Fixes
- Service fails to start after a config edit. Run
suricata -T -c /etc/suricata/suricata.yaml -vfirst, it validates the full config and rule set and will point to the exact line causing the failure. - No alerts appear despite generating test traffic. Confirm the af-packet
interfacevalue matches the NIC actually receiving mirrored traffic, and checkip link showto verify that interface is up. - “add-apt-repository: command not found.” Install
software-properties-commonbefore adding the PPA. - High packet drop percentage in stats.log. Increase
buffer-sizein the af-packet block, or reduce the ruleset size if the CPU is the actual bottleneck rather than the buffer. - suricata-update fails with a permissions error. Run it with sudo, it writes rule files to
/var/lib/suricata/rules/, which requires root. - EVE JSON file grows enormous within hours. Enable log rotation via logrotate on
/var/log/suricata/eve.json, and consider disabling high-volume event types likeflowif you only need alerts. - IPS mode drops legitimate traffic. Revert the offending rule from
dropback toalertimmediately, then investigate why it fired, a false positive in blocking mode is an outage, not a log entry. - CPU pegged at 100% with normal traffic volume. Check whether
checksum-checksis set tokernel(it should be, on most virtualized NICs) and confirm thread count is not oversubscribed relative to available cores.
Advanced Tips: Scaling Suricata to 10+ Gbps
Standard AF_PACKET capture tops out in the low double-digit Gbps range even with tuning, which is fine for most mid-size networks but insufficient for a carrier-scale or large enterprise link. For sustained 10 Gbps and above, deployments typically move to PF_RING or DPDK, both of which bypass the kernel’s networking stack to hand packets directly to Suricata’s worker threads, cutting the overhead that limits standard AF_PACKET. 2026 benchmarks describing Suricata sustaining 10-40 Gbps line-rate detection specifically cite DPDK or tuned AF_PACKET with proper NIC driver support as the deciding factor.
A few other production-grade tips worth building into your rollout plan:
- Run Suricata in
daqor bridge mode on dedicated bypass-capable NICs so the sensor fails open (traffic keeps flowing) rather than fails closed if the process crashes in IPS mode. - Separate your rule categories into distinct files by confidence tier, high-confidence rules eligible for drop, everything else alert-only, so a future rule update cannot silently promote a noisy signature into blocking mode.
- Use
cluster-type: cluster_flowin af-packet so that all packets from a single flow land on the same worker thread, which keeps stateful protocol detection (TLS, HTTP) accurate under multi-threaded load. - If you are running Suricata behind regular vulnerability scans and Suricata itself flags the scanner traffic constantly, add scanner source IPs to a suppression list rather than disabling the underlying rules, you still want them active against real attackers.
Suricata vs Snort vs Zeek: How They Actually Compare
These three tools get lumped together constantly, but they solve overlapping rather than identical problems. Suricata and Snort are both signature-matching IDS/IPS engines; Zeek is a network security monitor that focuses on rich protocol-level logging and behavioral analysis rather than signature matching, and is frequently run alongside Suricata rather than instead of it.
| Metric | Suricata | Snort | Zeek |
|---|---|---|---|
| Threading model | Multi-threaded (native) | Single-threaded (v2); partial multi-thread (v3) | Single-threaded per worker, cluster-scalable |
| Approximate GitHub stars | ~6,400-6,600 | ~3,300 | ~7,600 |
| Primary function | Signature-based IDS/IPS | Signature-based IDS/IPS | Protocol logging & behavioral analysis |
| Max realistic throughput (single box) | 10-40 Gbps (DPDK-tuned) | Not listed | Scales via worker clusters, not raw line-rate focused |
| Typical pairing | Bundled with Zeek in Security Onion | Standalone or pfSense package | Bundled with Suricata in Security Onion |
In practice, the strongest 2026 network detection stacks do not pick one of these three — they run Suricata for line-rate signature matching and inline blocking, and Zeek alongside it for the deep protocol metadata that makes post-incident investigation faster. Snort still has a place, particularly on Cisco-adjacent infrastructure with existing Snort rule licensing, but new open-source deployments increasingly default to Suricata for the throughput headroom alone.
Cost is also part of that decision. These tools are open source at their core, which means the real budget line isn’t the software. It’s the engineering time to deploy, tune, and maintain them, plus the hardware or cloud instance sized to your traffic volume. A team already running Snort for compliance reasons (some regulated environments still reference specific Snort rule certifications) should plan its move to Snort 3, because all open-source Snort 2 versions reached end of life on October 21, 2026 and Talos no longer supports them. A team starting from zero in 2026 should not pick Snort 2 at all, and can choose between Suricata and Snort 3 on integration and tuning effort. Snort 3.12.4.0 bundles recent security hardening and defect fixes, and the Suricata User Guide has a section on Snort.conf to Suricata.yaml for teams switching engines.
Building a Complete Working Suricata Lab: End-to-End Example
To pull every step above into one working reference, here is a complete minimal deployment sequence for a single Ubuntu 24.04 sensor watching a mirrored interface, from bare install through a validated custom rule. This is also a solid starting point if you are building out a broader detection program alongside phishing-resistant MFA or other identity-layer controls, since Suricata fills the network-visibility gap those tools leave open:
# 1. Install
sudo apt-get update && sudo apt-get install -y software-properties-common
sudo add-apt-repository ppa:oisf/suricata-stable -y
sudo apt-get update && sudo apt-get install -y suricata jq
# 2. Configure HOME_NET and interface (edit /etc/suricata/suricata.yaml manually)
# 3. Pull rules
sudo suricata-update enable-source et/open
sudo suricata-update
# 4. Validate config
sudo suricata -T -c /etc/suricata/suricata.yaml -v
# 5. Start the sensor
sudo systemctl enable --now suricata
# 6. Confirm alerts are flowing
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'That sequence, followed in order, gets you from a clean Ubuntu box to a validated, alerting Suricata sensor in well under the 90-minute budget for this tutorial, the remaining time goes into rule tuning, SIEM integration, and the IDS-to-IPS transition period, which by design should take days rather than minutes.
Frequently Asked Questions
Is Suricata completely free?
Yes. Suricata itself is open source under the GPLv2 license, and the ET Open ruleset used throughout this tutorial is also free. The only paid component in most deployments is an optional commercial ruleset like ET Pro, which offers faster updates and broader coverage than the free tier.
Is Suricata better than Snort in 2026?
For most new deployments, yes, primarily due to throughput. Suricata’s native multi-threading lets it scale close to linearly with CPU cores, while Snort 2 is capped around 800 Mbps regardless of hardware. Snort 3 narrows the gap but still trails Suricata by roughly 2-3x on comparable hardware in independent 2026 benchmarks.
Can Suricata run on a Raspberry Pi?
It can run on a Raspberry Pi for low-traffic home-lab monitoring, but expect throughput in the tens to low hundreds of Mbps rather than the multi-gigabit numbers this tutorial covers on server-class hardware, the ARM cores and limited RAM become the bottleneck quickly under a full ET Open ruleset.
Does Suricata replace a firewall?
No. A firewall makes allow/deny decisions based on ports, addresses, and connection state; Suricata inspects the actual content of allowed traffic for known-malicious patterns. They are complementary layers, and Suricata can even run as a package inside a firewall like pfSense for combined deployments.
What’s the difference between ET Open and ET Pro rules?
ET Open is the free community ruleset maintained by Proofpoint’s Emerging Threats project and is what this tutorial uses via suricata-update. ET Pro is the paid tier with faster signature turnaround and broader threat coverage, aimed at organizations that need same-day coverage for new campaigns rather than the community update cadence.
How much traffic can one Suricata instance actually handle?
On an 8-core, 16 GB server with a tuned AF_PACKET configuration and roughly 30,000 active rules, expect around 6.5 Gbps. Scaling to 16 cores and 32 GB pushes that past 12 Gbps, and DPDK-tuned deployments on high-end hardware have demonstrated 10-40 Gbps line-rate detection.
Is running Suricata in IPS mode risky?
It carries real risk if you skip the IDS tuning period. A rule with a false-positive match set to “drop” instead of “alert” will silently block legitimate traffic. The safe path is to run passively in IDS mode for one to two weeks, then convert only rules you have personally validated to inline blocking.
Does Suricata work on Windows or macOS?
Suricata does have Windows builds available from the official download page, though the overwhelming majority of production deployments, and every example in this tutorial, run on Linux, where AF_PACKET, NFQueue, and the broader open-source security tooling ecosystem are best supported.
