Suricata Suricata - IDS on AsusWRT Merlin

[XIII]

Might test a bit more later this weekend.

For now I’m glad I saw a “Drop” (which might be better than the “wDrop”?).

 

[Smokey613]

I have searched but not really found a clear explanation. Exactly what does the use-mmap: yes do?

 

[rgnldo]

Here is a draft suricata "drop" rule

DROP only INLINE mode
Suricata will REJECT according to the rules.

 

[rgnldo]

use-mmap: yes

nmap is network mapping and scanning software.

 

[rgnldo]

Let me warn you, Suricata is open source software, but to enjoy the benefits of the community you need to know network protocols. Specific rules and the software already configured are commercialized. I took time adjusting to the rules I have. I currently have a standard that makes it easy.

 

[mike37]

DROP only INLINE mode
Suricata will REJECT according to the rules.

.
Ahhh..... so the "drop" should be replaced with "REJECT"; good. Does the rule otherwise seem valid?

 

[Smokey613]

nmap is network mapping and scanning software.

I am very familiar with nmap, but not mmap as is used in suricata.

 

[Smokey613]

Found this on mmap.

mmap - Wikipedia

en.wikipedia.org

 

[Smokey613]

Suricata is a very good IPS/IDS but I do not think it is a good fit for our Asus routers. I have finally realized that I have spent way too much time on it, so I have removed it from my router. I wish the best for further endeavors on this project.

 

[Jack Yaz]

nmap is network mapping and scanning software.

And nothing to do with mmap which is the Suricata option.

Suricata - Suricata - IDS on AsusWRT Merlin

Might test a bit more later this weekend. For now I’m glad I saw a “Drop” (which might be better than the “wDrop”?).

www.snbforums.com

 

[Jack Yaz]

.
Ahhh..... so the "drop" should be replaced with "REJECT"; good. Does the rule otherwise seem valid?

Drop and reject in iptables both stop the packet, but diff in whether anything is sent back to the sending client. Drop does nothing, so the connection appears to timeout. Reject sends back that the packet is being rejected

 

[Milan]

Suricata in IPS mode is dropping Cisco VPN for me if running it cant be established
when stopped, the connection is established, so I started Suricata back. after 30 mins it was dropped again.

 

[rgnldo]

And nothing to do with mmap which is the Suricata option.

Suricata - Suricata - IDS on AsusWRT Merlin

Might test a bit more later this weekend. For now I’m glad I saw a “Drop” (which might be better than the “wDrop”?).

www.snbforums.com

Great I notice that they are studying.

 

[XIII]

For the second day in a row Suricata suddenly blocks all internet access from my PC to the outside world... (and even to my router)

(without any log, but if I kill Suricata I have access again)

 

[Mutzli]

For the second day in a row Suricata suddenly blocks all internet access from my PC to the outside world... (and even to my router)

(without any log, but if I kill Suricata I have access again)

Did you monitor your memory usage? wonder if you're running out of available memory for Suricata to work.

 

[XIII]

Did you monitor your memory usage? wonder if you're running out of available memory for Suricata to work.

No, I did not monitor that.

I did see a log that Suricata crashed (and restarted) around 3:00 though.

 

[juched]

Little easier to read:

 

[rgnldo]

Little easier to read:
View attachment 25280

Nice!

 

[rgnldo]

Suricata is a very good IPS/IDS but I do not think it is a good fit for our Asus routers. I have finally realized that I have spent way too much time on it, so I have removed it from my router. I wish the best for further endeavors on this project.

in the beginning it is like that. Watching your enthusiasm, you will be back soon. Puzzles are addictive.

 

[Jack Yaz]

Little easier to read:
View attachment 25280

I took a look through your github commit and there's room for some performance gains. I'd recommend using d3 to load the csv for chartjs rather than writing it directly to a js file in the shell script for both the chart and table.

You may also wish to use group by for running the sql query rather than looping over it for set intervals.