Setting Up Suricata 7 as a Passive Network Tap in a Linux Homelab
Deploying an open-source Network Intrusion Detection System (NIDS) in your home laboratory provides irreplaceable insight into background network telemetry, IoT chatter, and suspicious outbound beacons.
In this guide, we configure Suricata 7 on an Ubuntu 24.04 node using a dedicated monitoring interface receiving mirrored traffic from a managed switch.
Install System Prerequisites & Suricata 7
Add the official OISF Suricata Stable PPA to get version 7.x with modern multi-threading and protocol inspection improvements:
`bash
sudo add-apt-repository ppa:oisf/suricata-stable
sudo apt-get update
sudo apt-get install -y suricata jq ethtool
`
Disable Hardware Offloading on the capture interface (e.g. eth1):
`bash
sudo ethtool -K eth1 rx off tx off gso off gro off
`
Configure the Suricata YAML Core Engine
Open /etc/suricata/suricata.yaml and configure your home network variable and capture interface:
`yaml
vars:
address-groups:
HOME_NET: "[192.168.1.0/24,10.0.4.0/24]"
EXTERNAL_NET: "!$HOME_NET"
af-packet:
- interface: eth1
cluster-id: 99
cluster-type: cluster_flow
defrag: yes
threads: auto
`
Ensure eve-log is enabled in JSON format for easy ingestion into SIEM tools like Elastic or Wazuh:
`yaml
outputs:
- eve-log:
enabled: yes
type: file
filename: eve.json
types:
- alert:
payload: yes
packet: yes
- dns
- tls
`
Update Community Threat Signatures
Suricata comes with the suricata-update utility to automatically pull and assemble the Emerging Threats (ET) Open ruleset:
`bash
sudo suricata-update
sudo suricata-update list-sources
`
Verify that signature syntax passes internal validation:
`bash
sudo suricata -T -c /etc/suricata/suricata.yaml -v
`
Verify Alerts with a Trigger Signature
Enable and start the Suricata daemon:
`bash
sudo systemctl enable --now suricata
`
In a separate terminal on a machine within $HOME_NET, test rule triggering using a harmless test query or curl request:
`bash
curl -A "BlackSun" http://testmyids.com
`
Monitor alerts in real time:
`bash
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert") | {timestamp, src_ip, dst_ip, alert: .alert.signature}'
`
Conclusion
With Suricata streaming structured JSON telemetry to /var/log/suricata/eve.json, you now have an enterprise-grade sensor capturing DNS queries, TLS handshakes, and signature alerts across your entire home infrastructure.