10.4. Snort.conf to Suricata.yaml¶
This guide is meant for those who are familiar with Snort and the snort.conf configuration format. This guide will provide a 1:1 mapping between Snort and Suricata configuration wherever possible.
ipvar HOME_NET any ipvar EXTERNAL_NET any ... portvar HTTP_PORTS [80,81,311,591,593,901,1220,1414,1741,1830,2301,2381,2809,3128,3702,4343,4848,5250,7001,7145,7510,7777,7779,8000,8008,8014,8028,8080,8088,8090,8118,8123,8180,8181,8243,8280,8800,8888,8899,9000,9080,9090,9091,9443,9999,11371,55555] portvar SHELLCODE_PORTS !80 ...
vars: address-groups: HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" EXTERNAL_NET: "!$HOME_NET" port-groups: HTTP_PORTS: "80" SHELLCODE_PORTS: "!80"
Note that Suricata can automatically detect HTTP traffic regardless of the port it uses. So the HTTP_PORTS variable is not nearly as important as it is with Snort, if you use a Suricata enabled ruleset.
10.4.2. Decoder alerts¶
# Stop generic decode events: config disable_decode_alerts # Stop Alerts on experimental TCP options config disable_tcpopt_experimental_alerts # Stop Alerts on obsolete TCP options config disable_tcpopt_obsolete_alerts # Stop Alerts on T/TCP alerts config disable_tcpopt_ttcp_alerts # Stop Alerts on all other TCPOption type events: config disable_tcpopt_alerts # Stop Alerts on invalid ip options config disable_ipopt_alerts
Suricata has no specific decoder options. All decoder related alerts are controlled by rules. See #Rules below.
10.4.3. Checksum handling¶
config checksum_mode: all
Suricata’s checksum handling works on-demand. The stream engine checks TCP and IP checksum by default:
stream: checksum-validation: yes # reject wrong csums
Alerting on bad checksums can be done with normal rules. See #Rules, decoder-events.rules specifically.
10.4.4. Various configs¶
10.4.4.1. Active response¶
# Configure active response for non inline operation. For more information, see REAMDE.active # config response: eth0 attempts 2
Active responses are handled automatically w/o config if rules with the “reject” action are used.
10.4.4.2. Dropping privileges¶
# Configure specific UID and GID to run snort as after dropping privs. For more information see snort -h command line options # # config set_gid: # config set_uid:
To set the user and group use the –user <username> and –group <groupname> commandline options.
# Configure default snaplen. Snort defaults to MTU of in use interface. For more information see README # # config snaplen: #
Suricata always works at full snap length to provide full traffic visibility.
# Configure default bpf_file to use for filtering what traffic reaches snort. For more information see snort -h command line options (-F) # # config bpf_file: #
BPF filters can be set per packet acquisition method, with the “bpf-filter: <file>” yaml option and in a file using the -F command line option.
pcap: - interface: eth0 #buffer-size: 16777216 #bpf-filter: "tcp and port 25" #checksum-checks: auto #threads: 16 #promisc: no #snaplen: 1518
10.4.5. Log directory¶
# Configure default log directory for snort to log to. For more information see snort -h command line options (-l) # # config logdir:
This value is overridden by the -l commandline option.
10.4.6. Packet acquisition¶
# Configure DAQ related options for inline operation. For more information, see README.daq # # config daq: <type> # config daq_dir: <dir> # config daq_mode: <mode> # config daq_var: <var> # # <type> ::= pcap | afpacket | dump | nfq | ipq | ipfw # <mode> ::= read-file | passive | inline # <var> ::= arbitrary <name>=<value passed to DAQ # <dir> ::= path as to where to look for DAQ module so's
Suricata has all packet acquisition support built-in. It’s configuration format is very verbose.
pcap: - interface: eth0 #buffer-size: 16777216 #bpf-filter: "tcp and port 25" #checksum-checks: auto #threads: 16 #promisc: no #snaplen: 1518 pfring: afpacket: nfq: ipfw:
Passive vs inline vs reading files is determined by how Suricata is invoked on the command line.
In snort.conf a RULE_PATH variable is set, as well as variables for shared object (SO) rules and preprocessor rules.
var RULE_PATH ../rules var SO_RULE_PATH ../so_rules var PREPROC_RULE_PATH ../preproc_rules include $RULE_PATH/local.rules include $RULE_PATH/emerging-activex.rules ...
In the suricata.yaml the default rule path is set followed by a list of rule files. Suricata does not have a concept of shared object rules or preprocessor rules. Instead of preprocessor rules, Suricata has several rule files for events set by the decoders, stream engine, http parser etc.
default-rule-path: /etc/suricata/rules rule-files: - local.rules - emerging-activex.rules
The equivalent of preprocessor rules are loaded like normal rule files:
rule-files: - decoder-events.rules - stream-events.rules - http-events.rules - smtp-events.rules