Hello friends,
I am running Suricata on IDS mode in my production environment. At the moment, we don’t have so much traffics from customers/clients. We have hosted few websites and one app. So in the future, our clients might grow and so does the network traffic. Suricata is running on a VM which has apache and postfix installed. Apps are running on different VM’s which are accessed by reverse proxy from Suricata installed machine. Suricata VM’s is monitored by Zabbix and wazuh(running on top of ELK stack). This Zabbix and ELK stack is hosted on a different server which is virtualized further but it connects with Suricata VM’s and generates traffic’s via Zabbix and wazuh agents.
Suricata VM’s Service Details:
- apache (port 80, 443).
- postfix (port 25)
- Zabbix agent (port 10050)
- wazuh agent connects to wazuh server (port 1514)
- Suricata
Also, there will be some ssh traffic, as files are being replicated using lsyncd(live sync daemon).
Suricata VM’s Hardware specs:
RAM: 6 GB,
Swap mem is not created.
This lscpu stats of my server:
Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Byte Order: Little Endian
CPU(s): 2
On-line CPU(s) list: 0,1
Thread(s) per core: 1
Core(s) per socket: 1
Socket(s): 2
NUMA node(s): 1
Vendor ID: GenuineIntel
CPU family: 6
Model: 158
Model name: Intel® Xeon® E-2124 CPU @ 3.30GHz
Stepping: 10
CPU MHz: 3312.691
BogoMIPS: 6625.14
Hypervisor vendor: Xen
Virtualization type: full
L1d cache: 32K
L1i cache: 32K
L2 cache: 256K
L3 cache: 8192K
NUMA node0 CPU(s): 0,1
Now, I am planning to run Suricata on IPS mode. So, I would like to know if my above hardware specs are good enough to run Suricata on IPS mode. What kind of tweaks I can do as I am running it on VM? Maybe increase RAM, CPU? What about the NIC card?
Please help me with this and if more information is needed let me know. I will provide the necessary info.
Thank You