Menu
What's new
By:
Filters Better Search

Suricata Suricata - IDS on AsusWRT Merlin

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Wondering how don’t check the status ,see if it’s running ?
 
rgnldo said:
It's a great idea. Many desire ease. The problem is to maintain. My suggestion is to integrate Skynet, as an addon or even a Skynet+Suricata merger, fully maintained by Adamm. I don't want to interfere with the script. I help where possible, testing and suggesting. I am an admirer of the works of @Adamm. My influence.
Click to expand...
Agreed, an integration with Skynet would be awesome. I have a question in regards to maintaining Suricata and keeping up with their latest release. Did you do any testing with version 5.03?
 
New2This said:
Wondering how don’t check the status ,see if it’s running ?
Click to expand...
Check the stats.log file, it's updated every 8sec. \var\log\suricata\stats.log
If the values increase it is working. Here is a link to the users guide:
 
Mutzli said:
Check the stats.log file, it's updated every 8sec. \var\log\suricata\stats.log
If the values increase it is working. Here is a link to the users guide:
Click to expand...
also just do a

ps w
should see this somewhere

16315 admin 784m S {Suricata-Main} suricata -c /opt/etc/suricata/suricata.yaml --af-packet
 
ttgapers said:
@rgnldo is there proper rotation of the stats.log file?
Click to expand...
I was wondering the same thing. The manual says to create a rotation file with these parameters:
Code: 
/var/log/suricata/stats.log /var/log/suricata/statslog.json
{
    rotate 3
    missingok
    nocompress
    create
    sharedscripts
    postrotate
            /bin/kill -HUP `cat /var/run/suricata.pid 2>/dev/null` 2>/dev/null || true
    endscript
}
 
Mutzli said:
I was wondering the same thing. The manual says to create a rotation file with these parameters:
Code: 
/var/log/suricata/stats.log /var/log/suricata/statslog.json
{
    rotate 3
    missingok
    nocompress
    create
    sharedscripts
    postrotate
            /bin/kill -HUP `cat /var/run/suricata.pid 2>/dev/null` 2>/dev/null || true
    endscript
}
Click to expand...

Nice to be done after work!
 
rgnldo said:
Yes. Excellent. New rules. Liked it.
Click to expand...
Did you decide on how to run future updates and who will maintain them? Will you keep updating this, @ttgapers or someone else?
 
We depend on entware packages. Is safer. The rest is easy. Any of you can help.
 
For the logging/loggers out there, here's what I have in my yaml file.

Code: 
  - stats:
      enabled: no
      filename: stats.log
      interval: 10
      append: no

  - syslog:
      enabled: yes
      identity: suricata
      facility: local1
      level: notice

I want to know about errors and what it's doing and care less about stats every x mins, so I changed this to send to syslog instead.

Code: 
# Logging configuration.  This is not about logging IDS alerts, but
# IDS output about what its doing, errors, etc.
logging:

  # This value is overriden by the SC_LOG_LEVEL env var.
  default-log-level: info

  # Define your logging outputs.
  outputs:
  - console:
      enabled: no
  - file:
      enabled: no
      filename: /opt/var/log/suricata/suricata.log
  - syslog:
      enabled: yes
      facility: off

For those using scribe/logrotate, I've added the two files to @cmkelley gamma master branch and therefore available if you are running the latest versions in your respective *.share folder.
It gives me a nice pipe and shows....

Code: 
Jun 19 08:38:12 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 20 14:05:56 myrouter suricata[2780]: [1:2017919:2] ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03 [Classification: Attempted Denial of Service] [Priority: 2] {UDP} 193.29.15.169:47346 -> aaa.zzz.yyy.xxx:123
Jun 22 12:35:07 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 17:57:59 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 17:58:12 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:03:52 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:22 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:34 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:36 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Notice> - This is Suricata version 4.1.8 RELEASE
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - CPUs/cores online: 2
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - Found an MTU of 1500 for 'eth0'
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - Found an MTU of 1500 for 'eth0'
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Warning> - [ERRCODE: SC_WARN_DEFAULT_WILL_CHANGE(317)] - in 5.0 the default for decoder event stats will go from 'decoder.<proto>.<event>' to 'decoder.event.<proto>.<event>'. See ticket #2225. To suppress this message, set stats.decoder-events-prefix in the yaml.
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - fast output device (regular) initialized: fast.log
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - stats output device (regular) initialized: stats.log
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - Syslog output initialized
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - 17 rule files processed. 2323 rules successfully loaded, 0 rules failed
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - Threshold config parsed: 0 rule(s) found
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - 2323 signatures processed. 208 are IP-only rules, 440 are inspecting packet payload, 1751 inspect application layer, 0 are decoder event only
Jun 22 18:12:41 myrouter suricata[8631]: 22/6/2020 -- 18:12:41 - <Info> - Going to use 2 thread(s)
Jun 22 18:12:41 myrouter suricata[8631]: 22/6/2020 -- 18:12:41 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.
Jun 22 18:12:42 myrouter suricata[8631]: 22/6/2020 -- 18:12:42 - <Info> - All AFP capture threads are running.
Jun 22 18:15:02 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:15:02 myrouter suricata[8631]: 22/6/2020 -- 18:15:02 - <Notice> - Signal Received.  Stopping engine.
Jun 22 18:15:02 myrouter suricata[8631]: 22/6/2020 -- 18:15:02 - <Info> - time elapsed 140.501s
Jun 22 18:15:04 myrouter suricata[8631]: 22/6/2020 -- 18:15:04 - <Info> - Alerts: 0
Jun 22 18:15:04 myrouter suricata[8631]: 22/6/2020 -- 18:15:04 - <Info> - cleaning up signature grouping structure... complete
Jun 22 18:15:04 myrouter suricata[8631]: 22/6/2020 -- 18:15:04 - <Notice> - Stats for 'eth0':  pkts: 41926, drop: 0 (0.00%), invalid chksum: 0

@rgnldo - so with that I get alerts (from fast.log) as well core system suricata info to syslog. Hope others find it helpful. This also will address the log rotation questions....

Also @Adamm here is a sample Suricata detection that I was thinking can be "read/parsed" and block the offending IP if only temporarily until next router reboot (for example).

Code: 
Jun 20 14:05:56 myrouter suricata[2780]: [1:2017919:2] ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03 [Classification: Attempted Denial of Service] [Priority: 2] {UDP} 193.29.15.169:47346 -> aaa.zzz.yyy.xxx:123
 
Last edited:
ttgapers said:
For the logging/loggers out there, here's what I have in my yaml file.

Code: 
  - stats:
      enabled: no
      filename: stats.log
      interval: 10
      append: no

  - syslog:
      enabled: yes
      identity: suricata
      facility: local1
      level: notice

I want to know about errors and what it's doing and care less about stats every x mins, so I changed this to send to syslog instead.

Code: 
# Logging configuration.  This is not about logging IDS alerts, but
# IDS output about what its doing, errors, etc.
logging:

  # This value is overriden by the SC_LOG_LEVEL env var.
  default-log-level: info

  # Define your logging outputs.
  outputs:
  - console:
      enabled: no
  - file:
      enabled: no
      filename: /opt/var/log/suricata/suricata.log
  - syslog:
      enabled: yes
      facility: off

For those using scribe/logrotate, I've added the two files to @cmkelley gamma branch:

It gives me a nice pipe and shows....

Code: 
Jun 19 08:38:12 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 20 14:05:56 myrouter suricata[2780]: [1:2017919:2] ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03 [Classification: Attempted Denial of Service] [Priority: 2] {UDP} 193.29.15.169:47346 -> aaa.zzz.yyy.xxx:123
Jun 22 12:35:07 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 17:57:59 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 17:58:12 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:03:52 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:22 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:34 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:36 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Notice> - This is Suricata version 4.1.8 RELEASE
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - CPUs/cores online: 2
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - Found an MTU of 1500 for 'eth0'
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - Found an MTU of 1500 for 'eth0'
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Warning> - [ERRCODE: SC_WARN_DEFAULT_WILL_CHANGE(317)] - in 5.0 the default for decoder event stats will go from 'decoder.<proto>.<event>' to 'decoder.event.<proto>.<event>'. See ticket #2225. To suppress this message, set stats.decoder-events-prefix in the yaml.
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - fast output device (regular) initialized: fast.log
Jun 22 18:12:38 myrouter suricata: 22/6/2020 -- 18:12:38 - <Info> - stats output device (regular) initialized: stats.log
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - Syslog output initialized
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - 17 rule files processed. 2323 rules successfully loaded, 0 rules failed
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - Threshold config parsed: 0 rule(s) found
Jun 22 18:12:38 myrouter suricata[8631]: 22/6/2020 -- 18:12:38 - <Info> - 2323 signatures processed. 208 are IP-only rules, 440 are inspecting packet payload, 1751 inspect application layer, 0 are decoder event only
Jun 22 18:12:41 myrouter suricata[8631]: 22/6/2020 -- 18:12:41 - <Info> - Going to use 2 thread(s)
Jun 22 18:12:41 myrouter suricata[8631]: 22/6/2020 -- 18:12:41 - <Notice> - all 2 packet processing threads, 4 management threads initialized, engine started.
Jun 22 18:12:42 myrouter suricata[8631]: 22/6/2020 -- 18:12:42 - <Info> - All AFP capture threads are running.
Jun 22 18:15:02 myrouter S82suricata: Starting Suricata IDS/IPS /opt/etc/init.d/S82suricata
Jun 22 18:15:02 myrouter suricata[8631]: 22/6/2020 -- 18:15:02 - <Notice> - Signal Received.  Stopping engine.
Jun 22 18:15:02 myrouter suricata[8631]: 22/6/2020 -- 18:15:02 - <Info> - time elapsed 140.501s
Jun 22 18:15:04 myrouter suricata[8631]: 22/6/2020 -- 18:15:04 - <Info> - Alerts: 0
Jun 22 18:15:04 myrouter suricata[8631]: 22/6/2020 -- 18:15:04 - <Info> - cleaning up signature grouping structure... complete
Jun 22 18:15:04 myrouter suricata[8631]: 22/6/2020 -- 18:15:04 - <Notice> - Stats for 'eth0':  pkts: 41926, drop: 0 (0.00%), invalid chksum: 0

@rgnldo - so with that I get alerts (from fast.log) as well core system suricata info to syslog. Hope others find it helpful. This also will address the log rotation questions....

Also @Adamm here is a sample Suricata detection that I was thinking can be "read/parsed" and block the offending IP if only temporarily until next router reboot (for example).

Code: 
Jun 20 14:05:56 myrouter suricata[2780]: [1:2017919:2] ET DOS Possible NTP DDoS Inbound Frequent Un-Authed MON_LIST Requests IMPL 0x03 [Classification: Attempted Denial of Service] [Priority: 2] {UDP} 193.29.15.169:47346 -> aaa.zzz.yyy.xxx:123
Click to expand...


I have found that 99% of the DDoS attempted denial of service IP Addresses detected by Suricata have already been blocked by Skynet. A good percentage of these are RIPE Database service addresses.
 
rgnldo said:
We depend on entware packages. Is safer. The rest is easy. Any of you can help.
Click to expand...

FWIW, I put in an enhancement request to the Entware Git and was told V5.0 Suricata is dependent on Rust and will not be considered for future updates.

Seems like we're out of luck on the entware front that way.....
 
vdemarco said:
also just do a

ps w
should see this somewhere

16315 admin 784m S {Suricata-Main} suricata -c /opt/etc/suricata/suricata.yaml --af-packet
Click to expand...

Yes I see that line also....Means its running

9246 admin 562m S {Suricata-Main} suricata -c /opt/etc/suricata/suricata.yaml --af-packet
 
You must log in or register to reply here.

Similar threads

HELLO_wORLD
One mirroring solution for IDS (my approach and solution)
Replies
5
Views
1K
HELLO_wORLD
HELLO_wORLD
garycnew
Entware [SOLUTION] Cross-Compile xxHash Entware Package via Debian Live DVD
Replies
0
Views
2K
garycnew
garycnew
garycnew
Entware [SOLUTION] Cross-Compile ProxyChains-NG Entware Package via Debian Live DVD
Replies
2
Views
2K
garycnew
garycnew
garycnew
Entware [SOLUTION] Cross-Compile Nyx (Tor Command-Line Monitor) Entware Package via Debian Live DVD
Replies
0
Views
1K
garycnew
garycnew
P
USBIP host on TUF-AX5400
Replies
2
Views
1K
Jarp
J
Similar threads
Thread starter Title Forum Replies Date
thelonelycoder scMerlin scMerlin 2.5.1 - Service and script control menu for Asuswrt-Merlin, March 13, 2024 Asuswrt-Merlin AddOns 34
JGrana uKasa uKasa - A utility script that manages Kasa smart outlets and switches with Asuswrt-Merlin routers Asuswrt-Merlin AddOns 29
JGrana Updated Hue Utility - huetil Control and manage your Hue system from Asuswrt-Merlin or Raspbian Asuswrt-Merlin AddOns 1
8 ASUS RT-AX58U (F/W Ver.:V3.0.0.4.384.8601) with Asuswrt-Merlin 3004.388.5 - Transmission: "Could not connect to the server. You may need to reload" Asuswrt-Merlin AddOns 2
SomeWhereOverTheRainBow DNScrypt Dnscrypt Proxy Installer For Asuswrt-Merlin late 2023 Releases Asuswrt-Merlin AddOns 8
fanasus AdGuardHome Help for beginner with AdGuardHome Asuswrt-Merlin Asuswrt-Merlin AddOns 26
W Scribe Asuswrt-Merlin 388.2 is now available for select models Asuswrt-Merlin AddOns 10

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 792 (members: 18, guests: 774)
Top