/* Suricata thread model */
Receive threads (RX):
Read packets from NIC (AF_PACKET, AF_XDP, DPDK, PCAP)
Decode: Ethernet → IP → TCP/UDP → application headers
Distribute to worker threads (via flow hash for ordering)
Worker threads (decode + detect):
Each thread handles a subset of flows
Per-flow state: conntrack + app-layer parsers + detect engine
Hyperscan/AC for payload inspection
Produces: alert events, flow records, file extracts
Output threads:
Write alerts: EVE JSON, Unified2 (for Snort-compatible output)
Write flow records: NetFlow-like summaries
Write extracted files: malware samples, documents from HTTP/SMTP
/* Suricata packet flow */
Packet → RX Thread → Flow Hash → Worker Thread:

IP defragmentation (reassemble fragments)
Stream tracking (TCP segment reassembly)
App-layer detection (HTTP, TLS, DNS, SMTP, SMB parsers)
Rule detection (Hyperscan + keyword matching)
Action (alert/drop/pass)
Logging (EVE JSON)

/* Suricata AF_XDP mode (high performance) */
suricata:
af-xdp:
interface: eth0
threads: 4
xdp-mode: driver
use-mmap: yes
ring-size: 2048
/* Suricata IPS mode (inline with NFQUEUE or AF_PACKET) */
NFQUEUE mode: Netfilter sends packets to Suricata for verdict#
iptables -A FORWARD -j NFQUEUE —queue-num 0
suricata:
nfq:
mode: accept
fail-open: yes   /* pass traffic if Suricata crashes */
AF_PACKET IPS mode (bypass when possible)#
suricata:
af-packet:
- interface: eth0
cluster-id: 99
cluster-type: cluster_flow
copy-mode: ips
copy-iface: eth1   /* forward to eth1 if not dropped */
/* Suricata EVE JSON output — structured logging */
{
“timestamp”: “2024-01-15T10:23:45.123456+0000”,
“flow_id”: 123456789,
“event_type”: “alert”,
“src_ip”: “192.168.1.50”,
“src_port”: 54321,
“dest_ip”: “198.51.100.5”,
“dest_port”: 443,
“proto”: “TCP”,
“alert”: {
“action”: “blocked”,
“gid”: 1,
“signature_id”: 2019401,
“rev”: 4,
“signature”: “ET CNC Feodo Tracker Reported C2 in Use”,
“category”: “A Network Trojan was Detected”,
“severity”: 1
},
“tls”: {
“sni”: “malicious.example.com”,
“version”: “TLS 1.3”,
“ja3”: { “hash”: “51c64c77e60f3980eea90869b68c58a8” }
},
“app_proto”: “tls”
}

/* The false positive problem */
/* A well-tuned IPS might have 0.01% false positive rate */
/* At 10 Gbps with 64-byte packets: 19.5 Mpps */
/* 0.01% = 1950 false blocks per second → completely unusable */
/* Tuning is as important as detection capability */
/* Step 1: Profile your traffic before enabling IPS /
/ Run in IDS mode for 2 weeks. Collect EVE JSON. Analyse alerts. /
/ Key question: which rules fire most? Are those FPs or TPs? */
/* Alert classification /
/ TP (True Positive):  Real attack. Alert is correct. /
/ FP (False Positive): Legitimate traffic wrongly alerted. /
/ FN (False Negative): Real attack missed (no alert). /
/ TN (True Negative):  Legitimate traffic, no alert. */
/* Tuning approaches */


Threshold tuning:
/* Rule fires every packet — add threshold to reduce noise /
alert:threshold:type limit,track by_src,count 1,seconds 300;
/ Only alert once per source per 5 minutes */


Suppress rules for known-good sources:
suppress gen_id 1, sig_id 2001219, track by_src, ip 10.1.0.0/24;
/* Suppress SSH brute force rule for internal hosts */


Pass rules (whitelist before detect):
pass tcp $TRUSTED_SCANNERS any ->$HOME_NET any
/* Vulnerability scanner — don’t alert on its port scans */


Score-based alerting:
/* Don’t block on single rule match /
/ Accumulate score across multiple correlated events /
/ Block only when score > threshold */


typedef struct {
uint32_t src_ip;
uint32_t score;          /* accumulated threat score /
uint64_t reset_time_ns;  / when to reset score /
char     events[16][64]; / last 16 contributing events */
} threat_score_t;
void threat_score_update(threat_score_t *ts, const char sig, uint32_t weight) {
ts->score += weight;
/ Log contributing event */
snprintf(ts->events[ts->score % 16], 64, “%s”, sig);
if (ts->score >= 100) {
    quarantine_host(ts->src_ip);   /* automatic response */
    ts->score = 0;
}
}
/* Score weights /
/ JA3 matches known malware:  30 points /
/ DNS query to known-bad domain: 40 points /
/ Port scan (>50 ports/min):  20 points /
/ Connection to C2 IP:         70 points /
/ Lateral movement (SMB spray): 50 points */
/* 5. Exception list maintenance /
/ Keep a structured exception database /
/ Every exception needs: justification, owner, expiry date /
/ Exceptions without expiry become permanent security holes */
/* 6. Rule set management /
/ Emerging Threats Pro rules: ~40,000 rules /
/ Typical production deployment: enable 20% of rules /
/ Categories to always enable: malware, c2, exploit /
/ Categories to carefully evaluate: policy, info, dos */