Can Suricata track TCP sessions

Rules
1

Can Suricata track the TCP sessions between two hosts if it is deployed in a router ?

As per my understanding it is needed to enforce strict TCP handshake and other mitigate other TCP related attacks.

Thanks.

2

Are you asking if Suricata keeps track of TCP sessions when it observes traffic between host1 and host2?

If that’s the question, the answer is yes (provided Suricata observes the bidirectional traffic).

3

Thanks Jeff for the response.

I was asking about the scenario in which a networking device, specifically a router running Suricata, is positioned between host1 and host2.

If Suricata maintains the state of a TCP session, can it mitigate all TCP session attacks, such as TCP RST attacks and strict TCP handshake issues?

Are there any predefined rules available to mitigate these attacks?

Thanks in advance.

4

It sounds like you’re asking whether

  • Suricata works on an inline device at layer 3. Suricata would function as an IPS for an inline device (IDS if not inline with the packet flow).
  • Proofpoint publishes 50,000+ rules for Suricata and they’ve likely covered the scenarios that you’re concerned with. Proofpoint has free (ET/Open) and paid (ET/Pro) rulesets available.
5

Thank you for your prompt response, Jeff. I greatly appreciate it.