Menu
What's new
By:
Filters Better Search

Suricata Suricata - IDS on AsusWRT Merlin

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

here are my updated settings...please confirm ok.

Code: 
# If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: auto

# Linux high speed capture support
af-packet:
 - interface: br0

# IPS Mode Configuration
# PCAP
pcap:
  - interface: auto
    checksum-checks: auto
    promisc: yes

legacy:
  uricontent: enabled
 
ttgapers said:
here are my updated settings...please confirm ok.

Code: 
# If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: auto

# Linux high speed capture support
af-packet:
 - interface: br0

# IPS Mode Configuration
# PCAP
pcap:
  - interface: auto
    checksum-checks: auto
    promisc: yes

legacy:
  uricontent: enabled

# copy-mode: ips
# copy-iface: br0
# defrag: yes
# use-mmap: yes

# netmap:
# - interface: br0
Click to expand...
Code: 
If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: auto

# Linux high speed capture support
af-packet:
 - interface: eth0
 - interface: br0

# IPS Mode Configuration
# PCAP
pcap:
  - interface: auto
    checksum-checks: auto
    promisc: yes

legacy:
  uricontent: enabled
Use both
 
rgnldo said:
Code: 
If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: auto

# Linux high speed capture support
af-packet:
 - interface: eth0
 - interface: br0

# IPS Mode Configuration
# PCAP
pcap:
  - interface: auto
    checksum-checks: auto
    promisc: yes

legacy:
  uricontent: enabled
Use both
Click to expand...

Thanks, logs are much busier since adding br0 to the setup. Wondering why that traffic wouldn't be caught leaving eth0 @rgnldo? There are some that go to internally (site to site VPN) so that's expected.....

Sample logs:

Code: 
07/06/2020-18:47:28.334783  [**] [1:2016870:13] ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} xxx.xxx.xxxxxx:11106 -> xxx.xxx.xxx.xxx:80
07/06/2020-18:47:28.515450  [**] [1:2016870:13] ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} xxx.xxx.xxxxxx:28486 -> xxx.xxx.xxx.xxx:80
07/06/2020-18:52:28.888456  [**] [1:2016870:13] ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} xxx.xxx.xxxxxx:11466 -> xxx.xxx.xxx.xxx:80
07/06/2020-18:52:29.027591  [**] [1:2016870:13] ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} xxx.xxx.xxxxxx:28846 -> xxx.xxx.xxx.xxx:80
07/06/2020-18:53:31.576049  [**] [1:2014169:2] ET DNS Query for .su TLD (Soviet Union) Often Malware Related [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} xxx.xxx.xxx.243:38897 -> xxx.xxx.xxx.xxx:53
07/06/2020-18:56:13.474169  [**] [1:2014169:2] ET DNS Query for .su TLD (Soviet Union) Often Malware Related [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} xxx.xxx.xxx.243:55734 -> xxx.xxx.xxx.xxx:53
07/06/2020-18:58:18.516431  [**] [1:2012811:5] ET DNS Query to a .tk domain - Likely Hostile [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} xxx.xxx.xxx.243:44734 -> xxx.xxx.xxx.xxx:53
07/06/2020-18:58:18.516567  [**] [1:2012811:5] ET DNS Query to a .tk domain - Likely Hostile [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} xxx.xxx.xxx.243:44734 -> xxx.xxx.xxx.xxx:53
07/06/2020-19:07:41.441189  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:38186 -> 91.189.91.38:80
07/06/2020-19:07:41.479364  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:38186 -> 91.189.91.38:80
07/06/2020-19:07:41.624133  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:38186 -> 91.189.91.38:80
07/06/2020-19:07:41.695945  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:38186 -> 91.189.91.38:80
07/06/2020-19:07:41.815224  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:58198 -> 104.31.95.73:80
07/06/2020-19:07:42.019690  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:38186 -> 91.189.91.38:80
07/06/2020-19:07:42.073266  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:38186 -> 91.189.91.38:80
07/06/2020-19:07:42.115885  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:58198 -> 104.31.95.73:80
07/06/2020-19:09:01.683591  [**] [1:2014169:2] ET DNS Query for .su TLD (Soviet Union) Often Malware Related [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} xxx.xxx.xxx.243:35771 -> xxx.xxx.xxx.xxx:53
07/06/2020-19:09:38.636501  [**] [1:2014169:2] ET DNS Query for .su TLD (Soviet Union) Often Malware Related [**] [Classification: Potentially Bad Traffic] [Priority: 2] {UDP} xxx.xxx.xxx.243:36942 -> xxx.xxx.xxx.xxx:53
07/06/2020-19:09:55.247738  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:42618 -> 91.189.91.38:80
07/06/2020-19:09:55.292492  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:42618 -> 91.189.91.38:80
07/06/2020-19:09:55.347152  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:42618 -> 91.189.91.38:80
07/06/2020-19:09:55.376757  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:40250 -> 91.189.95.83:80
07/06/2020-19:09:55.435468  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:42618 -> 91.189.91.38:80
07/06/2020-19:09:55.562836  [**] [1:2013504:5] ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management [**] [Classification: Not Suspicious Traffic] [Priority: 3] {TCP} xxx.xxx.xxxxxx:40xxx -> 91.189.95.83:80
07/06/2020-19:23:57xxx437  [**] [1:2016870:13] ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} xxx.xxx.xxxxxx:30742 -> xxx.xxx.xxx.xxx:80
07/06/2020-19:23:57.370362  [**] [1:2016870:13] ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5. [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} xxx.xxx.xxxxxx:50328 -> xxx.xxx.xxx.xxx:80
 
me too. this stuff showed up now

07/06/2020-17:10:08.520020 [**] [1:2012647:5] ET POLICY Dropbox.com Offsite File Backup in Use [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 162.125.35.135:443 -> 10.0.0.155:55512
07/06/2020-17:11:23.364419 [**] [1:2001219:20] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 37.49.230.252:58572 -> 10.0.0.155:22
07/06/2020-17:11:43.208354 [**] [1:2001219:20] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 222.186.30.76:57387 -> 10.0.0.155:22
07/06/2020-17:13:37.244464 [**] [1:2001219:20] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 37.49.230.252:60008 -> 10.0.0.155:22
07/06/2020-17:21:03.488885 [**] [1:2001219:20] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 222.186.30.218:61909 -> 10.0.0.155:22
07/06/2020-17:36:54.693995 [**] [1:2012647:5] ET POLICY Dropbox.com Offsite File Backup in Use [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 162.125.35.136:443 -> 10.0.0.155:55519
07/06/2020-17:40:03.879449 [**] [1:2001219:20] ET SCAN Potential SSH Scan [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 222.186.30.218:10422 -> 10.0.0.155:22

I have an ssh server set up, and am using dropbox. So way more stuff now.
 
I will stop posting all of this after this last one, but it all is working quit well now

just got this one too.
07/06/2020-18:18:51.181747 [**] [1:2403359:58313] ET CINS Active Threat Intelligence Poor Reputation IP group 60 [**] [Classification: Misc Attack] [Priority: 2] {TCP} 65.49.20.90:39592 -> 10.0.0.155:22

THis is a attempt to log into the ssh server. my ssh server only accepts keys passwords will not work.
 
I have a feelings of both love and hate watching threads like this evolve: I love seeing progress in making things work better, but I hate having to play catch-up to wrap my head around making it work on my system.

Can it be as simple as just running an update script that’s built in?


Sent from my iPhone using Tapatalk
 
Ubimo said:
I'm new to this.
Is there an easier way to install suricata? Like unbound_manager?
Does this work with skynet?
Click to expand...
heysoundude said:
I have a feelings of both love and hate watching threads like this evolve: I love seeing progress in making things work better, but I hate having to play catch-up to wrap my head around making it work on my system.

Can it be as simple as just running an update script that’s built in?


Sent from my iPhone using Tapatalk
Click to expand...

Slowly but surely....just time is the killer right now....
 
Good to get the latest suricata.yaml file as I think it has changed a bit in the last couple of weeks. I have been following the thread but get confused when snippets of the yaml file are posted as I don't know if I need to remove stuff from it...
 
jata said:
Good to get the latest suricata.yaml file as I think it has changed a bit in the last couple of weeks. I have been following the thread but get confused when snippets of the yaml file are posted as I don't know if I need to remove stuff from it...
Click to expand...

Take a backup of existing and re-pull, do a diff compare and swap. Most of @rgnldo edits are at the top. My logging edits are a bit lower. Will eventually hopefully get to a place where script and supporting files are in one spot....

@rgnldo I have the latest config (with my additional special edits for logging), running for eth0/br0 using FlexQOS script without errors about buggy protocol that I previously had with FreshQoS. This is wicked if it is stable and performs as well!
 
It was not easy to adapt Suricata at FW Merlin. An ARM router has limitations. I don't have time to support this post. I am involved with my own system. I contribute here as much as possible. Organizing a user-friendly script takes incredible effort. If it is a script for Suricata, double the effort.

Whoever has ideas here can organize forks or even scripts. I help in any way possible.
I advance that it is that gratifying.
 
ttgapers said:
Take a backup of existing and re-pull, do a diff compare and swap. Most of @rgnldo edits are at the top. My logging edits are a bit lower. Will eventually hopefully get to a place where script and supporting files are in one spot....

@rgnldo I have the latest config (with my additional special edits for logging), running for eth0/br0 using FlexQOS script without errors about buggy protocol that I previously had with FreshQoS. This is wicked if it is stable and performs as well!
Click to expand...
Organizes the steps, detailed.
 
ttgapers said:
here are my updated settings...please confirm ok.

Code: 
# If set to auto, the variable is internally switched to 'router' in IPS
# mode and 'sniffer-only' in IDS mode.
host-mode: auto

# Linux high speed capture support
af-packet:
 - interface: br0

# IPS Mode Configuration
# PCAP
pcap:
  - interface: auto
    checksum-checks: auto
    promisc: yes

legacy:
  uricontent: enabled
Click to expand...
Wonder what this does to pixelserv-tls since it also uses br0? Do you have pixelserv running on your router and if so does fast.log report anything on its IP (192.168.1.2)?
 
quattr0 said:
Take a look at IP Reputation. You could also create a custom.rules file and indicates the IP range to pass using your own rule. Take a look at creating rule if you want to go this route.

https://suricata.readthedocs.io/en/suricata-5.0.2/reputation/index.html

https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Ignoring_Traffic
Click to expand...

It would be real nice if there was an easy way to create an allow list. I have a chatty IoT device and it is not a security threat but it fills the logs with:


User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:10024 -> 34.199.145.138:80
Jul 7 10:26:17 RT-AC86U suricata[31108]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:24265 -> 34.199.145.138:80
Jul 7 10:26:59 RT-AC86U suricata[31108]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:21566 -> 34.199.145.138:80
Jul 7 10:27:17 RT-AC86U suricata[31108]: [1:2013028:4] ET POLICY curl User-Agent Outbound [Classification: Attempted Information Leak] [Priority: 2] {TCP} 192.168.2.158:4273 -> 34.199.145.138:80
 
Mutzli said:
Wonder what this does to pixelserv-tls since it also uses br0? Do you have pixelserv running on your router and if so does fast.log report anything on its IP (192.168.1.2)?
Click to expand...

pixelserv just have the tls variant disabled. No issues....
 
ttgapers said:
@rgnldo I have the latest config (with my additional special edits for logging), running for eth0/br0 using FlexQOS script without errors about buggy protocol that I previously had with FreshQoS. This is wicked if it is stable and performs as well!
Click to expand...

Update, don't do it, it slows the router down to a halt. Had to remove Suricata on the RT-AC68U this morning :(

Gunning and running on the RT-AC86Us though! Perhaps time to upgrade the AC68U now.....get rid of any Trend Micro for GOOD!
 
You must log in or register to reply here.

Similar threads

RMerlin
  • Locked
Beta Asuswrt-Merlin 3006.102.1 Beta is now available for WIfi 7 devices
3 4 5
Replies
97
Views
13K
RMerlin
RMerlin
HELLO_wORLD
One mirroring solution for IDS (my approach and solution)
Replies
5
Views
1K
HELLO_wORLD
HELLO_wORLD
Kyjiep
SBS. Script for using sing-box on Asus routers with Merlin firmware.
2 3 4
Replies
75
Views
5K
Kyjiep
Kyjiep
garycnew
Entware [SOLUTION] Cross-Compile xxHash Entware Package via Debian Live DVD
Replies
0
Views
2K
garycnew
garycnew
garycnew
Entware [SOLUTION] Cross-Compile ProxyChains-NG Entware Package via Debian Live DVD
2
Replies
22
Views
3K
sfx2000
sfx2000
Similar threads
Thread starter Title Forum Replies Date
thelonelycoder amtm amtm 4.9.1 - the Asuswrt-Merlin Terminal Menu, August 17, 2024 Asuswrt-Merlin AddOns 14
J Entware Possible to install jdownloader on asuswrt-merlin router with entware?? Asuswrt-Merlin AddOns 9
W Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14 Asuswrt-Merlin AddOns 10
thelonelycoder scMerlin scMerlin 2.5.7 - Service and script control menu for Asuswrt-Merlin, September 23, 2024 Asuswrt-Merlin AddOns 68
JGrana uKasa uKasa - A utility script that manages Kasa smart outlets and switches with Asuswrt-Merlin routers Asuswrt-Merlin AddOns 29
JGrana Updated Hue Utility - huetil Control and manage your Hue system from Asuswrt-Merlin or Raspbian Asuswrt-Merlin AddOns 1
8 ASUS RT-AX58U (F/W Ver.:V3.0.0.4.384.8601) with Asuswrt-Merlin 3004.388.5 - Transmission: "Could not connect to the server. You may need to reload" Asuswrt-Merlin AddOns 2
SomeWhereOverTheRainBow DNScrypt Dnscrypt Proxy Installer For Asuswrt-Merlin late 2023 Releases Asuswrt-Merlin AddOns 8

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 1,095 (members: 24, guests: 1,071)
Top