Home Intrusion Detection System with Suricata
Watch a copy of your network traffic for malware callbacks, scans and known exploits, using thousands of free community rules.
Suricata is a high-performance open-source IDS. A managed switch mirrors your router's port to a second Ethernet port on the Pi, so Suricata sees everything without sitting in the path of your traffic.
Mission steps
Set up port mirroring
On the managed switch, mirror the port that goes to your router to the port connected to the Pi's USB Ethernet adapter.
Install Suricata
Install suricata, suricata-update and jq from the OS packages.
Configure it
In /etc/suricata/suricata.yaml set HOME_NET to your LAN range and the af-packet interface to the mirror port (for example eth1).
Load rules
Run suricata-update to download the free Emerging Threats Open rules, then test the config and restart the service.
Read the alerts
Watch fast.log for live alerts and summarize eve.json with jq to see which rules fire most.
Tune the noise
Disable rules that only flag your own normal traffic so real alerts stand out.
Code
sudo apt install suricata suricata-update jq
sudo nano /etc/suricata/suricata.yaml # HOME_NET and af-packet interface: eth1
sudo suricata-update
sudo suricata -T -c /etc/suricata/suricata.yaml # test config
sudo systemctl restart suricata
sudo tail -f /var/log/suricata/fast.log
# top alerts
sudo jq -r 'select(.event_type=="alert") | .alert.signature' /var/log/suricata/eve.json | sort | uniq -c | sort -rn | head -20Tip: test every script on the bench before installing it in a moving machine.
Questions
Will it slow down my internet?
No. With port mirroring Suricata only receives a copy of the traffic. It detects and alerts but does not block — that's the job of a firewall.
Can I see the alerts in a dashboard?
Yes. Ship eve.json to Grafana with Loki, or to an OpenSearch stack on a bigger machine.