# I cannot confirm whether Suricata is intercepting malicious traffic as an IPS

**URL:** <https://forum.suricata.io/t/i-cannot-confirm-whether-suricata-is-intercepting-malicious-traffic-as-an-ips/4823>\
**Category:** Help\
**Tags:** ips\
**Created:** [August 23, 2024, 5:46am UTC](https://forum.suricata.io/t/i-cannot-confirm-whether-suricata-is-intercepting-malicious-traffic-as-an-ips/4823 "2024-08-23T05:46:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Frank\_Lee](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/frank_lee/32/3097_2.png) [@Frank\_Lee](https://forum.suricata.io/u/Frank_Lee)\
**Post date:** [August 23, 2024, 5:46am UTC](https://forum.suricata.io/t/i-cannot-confirm-whether-suricata-is-intercepting-malicious-traffic-as-an-ips/4823/1 "2024-08-23T05:46:58Z")

</div>

Hello everyone, I am a beginner, and I hope to run Suricata as an IPS to intercept malicious traffic. My deployment method is as follows:

```auto
apt-get -y install suricata jq
modprobe nfnetlink_queue
echo "nfnetlink_queue" > /etc/modules-load.d/nfnetlink_queue.conf

sed -i 's/interface: eth0/interface: vmbr0/g' /etc/suricata/suricata.yaml
sed -i 's/community-id: false/community-id: true/' /etc/suricata/suricata.yaml
echo "detect-engine:" >> /etc/suricata/suricata.yaml
echo " - rule-reload: true" >> /etc/suricata/suricata.yaml

suricata-update update-sources
suricata-update enable-source et/open
suricata-update -o /etc/suricata/rules

suricata -T -c /etc/suricata/suricata.yaml -v

edit /etc/systemd/system/multi-user.target.wants/suricata.service change "ExecStart" to:
ExecStart=/usr/bin/suricata -D -c /etc/suricata/suricata.yaml --pidfile /run/suricata.pid -q 0

iptables -A INPUT -j NFQUEUE --queue-num 0 --queue-bypass
iptables -A FORWARD -j NFQUEUE --queue-num 0 --queue-bypass
iptables -A OUTPUT -j NFQUEUE --queue-num 0 --queue-bypass

systemctl daemon-reload
systemctl restart suricata

```

I know that Suricata has started running normally, but I can see the ips.blocked statistics in stats.log, yet I cannot find the blocked records in eve.json.

```auto
~# tail -f /var/log/suricata/stats.log | grep ips
ips.accepted | Total | 70435244
ips.blocked | Total | 9544226
ips.accepted | Total | 70443407
ips.blocked | Total | 9545082
~# 
~# jq 'select(.alert.action == "blocked")' /var/log/suricata/eve.json

```

So I don’t know if Suricata has already intercepted malicious traffic based on rules like et/open. Now that Suricata is running as an IPS and blocking malicious traffic, why can’t I see the blocked records?

Thanks for your help.

suricata.yaml

```auto
~# grep -v '^\s*#' /etc/suricata/suricata.yaml
%YAML 1.1
---
vars:
  address-groups:
    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"

    EXTERNAL_NET: "!$HOME_NET"

    HTTP_SERVERS: "$HOME_NET"
    SMTP_SERVERS: "$HOME_NET"
    SQL_SERVERS: "$HOME_NET"
    DNS_SERVERS: "$HOME_NET"
    TELNET_SERVERS: "$HOME_NET"
    AIM_SERVERS: "$EXTERNAL_NET"
    DC_SERVERS: "$HOME_NET"
    DNP3_SERVER: "$HOME_NET"
    DNP3_CLIENT: "$HOME_NET"
    MODBUS_CLIENT: "$HOME_NET"
    MODBUS_SERVER: "$HOME_NET"
    ENIP_CLIENT: "$HOME_NET"
    ENIP_SERVER: "$HOME_NET"

  port-groups:
    HTTP_PORTS: "80"
    SHELLCODE_PORTS: "!80"
    ORACLE_PORTS: 1521
    SSH_PORTS: 22
    DNP3_PORTS: 20000
    MODBUS_PORTS: 502
    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
    FTP_PORTS: 21
    GENEVE_PORTS: 6081
    VXLAN_PORTS: 4789
    TEREDO_PORTS: 3544

default-log-dir: /var/log/suricata/

stats:
  enabled: yes
  interval: 8

outputs:
  - fast:
      enabled: yes
      filename: fast.log
      append: yes

  - eve-log:
      enabled: yes
      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
      filename: eve.json

      pcap-file: false

      community-id: true
      community-id-seed: 0

      xff:
        enabled: no
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For

      types:
        - alert:

            tagged-packets: yes
        - anomaly:
            enabled: yes
            types:
        - http:
            extended: yes # enable this for extended logging information
        - dns:
        - tls:
            extended: yes # enable this for extended logging information
        - files:
            force-magic: no # force logging magic on all logged files
        - smtp:

        - ftp
        - rdp
        - nfs
        - smb
        - tftp
        - ikev2
        - dcerpc
        - krb5
        - snmp
        - rfb
        - sip
        - dhcp:
            enabled: yes
            extended: no
        - ssh
        - mqtt:
        - stats:
            totals: yes # stats for all threads merged together
            threads: no # per thread stats
            deltas: no # include delta values
        - flow

  - http-log:
      enabled: no
      filename: http.log
      append: yes

  - tls-log:
      enabled: no # Log TLS connections.
      filename: tls.log # File to store TLS logs.
      append: yes

  - tls-store:
      enabled: no

  - pcap-log:
      enabled: no
      filename: log.pcap

      limit: 1000mb

      max-files: 2000

      compression: none

      mode: normal # normal, multi or sguil.

      use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
      honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stop being logged.

  - alert-debug:
      enabled: no
      filename: alert-debug.log
      append: yes

  - alert-prelude:
      enabled: no
      profile: suricata
      log-packet-content: no
      log-packet-header: yes

  - stats:
      enabled: yes
      filename: stats.log
      append: yes # append to file (yes) or overwrite it (no)
      totals: yes # stats for all threads merged together
      threads: no # per thread stats

  - syslog:
      enabled: no
      facility: local5

  - file-store:
      version: 2
      enabled: no

      xff:
        enabled: no
        mode: extra-data
        deployment: reverse
        header: X-Forwarded-For

  - tcp-data:
      enabled: no
      type: file
      filename: tcp-data.log

  - http-body-data:
      enabled: no
      type: file
      filename: http-data.log

  - lua:
      enabled: no
      scripts:

logging:
  default-log-level: notice

  default-output-filter:

  outputs:
  - console:
      enabled: yes
  - file:
      enabled: yes
      level: info
      filename: suricata.log
  - syslog:
      enabled: no
      facility: local5
      format: "[%i] <%d> -- "

af-packet:
  - interface: vmbr0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes

  - interface: default

pcap:
  - interface: vmbr0
  - interface: default

pcap-file:
  checksum-checks: auto

app-layer:
  protocols:
    rfb:
      enabled: yes
      detection-ports:
        dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
    mqtt:
      enabled: yes
    krb5:
      enabled: yes
    snmp:
      enabled: yes
    ikev2:
      enabled: yes
    tls:
      enabled: yes
      detection-ports:
        dp: 443

    dcerpc:
      enabled: yes
    ftp:
      enabled: yes
    rdp:
      enabled: yes
    ssh:
      enabled: yes
    http2:
      enabled: no
      http1-rules: no
    smtp:
      enabled: yes
      raw-extraction: no
      mime:
        decode-mime: yes

        decode-base64: yes
        decode-quoted-printable: yes

        header-value-depth: 2000

        extract-urls: yes
        body-md5: no
      inspected-tracker:
        content-limit: 100000
        content-inspect-min-size: 32768
        content-inspect-window: 4096
    imap:
      enabled: detection-only
    smb:
      enabled: yes
      detection-ports:
        dp: 139, 445

    nfs:
      enabled: yes
    tftp:
      enabled: yes
    dns:
      tcp:
        enabled: yes
        detection-ports:
          dp: 53
      udp:
        enabled: yes
        detection-ports:
          dp: 53
    http:
      enabled: yes

      libhtp:
         default-config:
           personality: IDS

           request-body-limit: 100kb
           response-body-limit: 100kb

           request-body-minimal-inspect-size: 32kb
           request-body-inspect-window: 4kb
           response-body-minimal-inspect-size: 40kb
           response-body-inspect-window: 16kb

           response-body-decompress-layer-limit: 2

           http-body-inline: auto

           swf-decompression:
             enabled: yes
             type: both
             compress-depth: 100kb
             decompress-depth: 100kb

           double-decode-path: no
           double-decode-query: no

         server-config:

    modbus:

      enabled: no
      detection-ports:
        dp: 502

      stream-depth: 0

    dnp3:
      enabled: no
      detection-ports:
        dp: 20000

    enip:
      enabled: no
      detection-ports:
        dp: 44818
        sp: 44818

    ntp:
      enabled: yes

    dhcp:
      enabled: yes

    sip:
      enabled: yes

asn1-max-frames: 256

coredump:
  max-dump: unlimited

host-mode: auto

unix-command:
  enabled: yes
  filename: /var/run/suricata-command.socket

legacy:
  uricontent: enabled

engine-analysis:
  rules-fast-pattern: yes
  rules: yes

pcre:
  match-limit: 3500
  match-limit-recursion: 1500

host-os-policy:
  windows: [0.0.0.0/0]
  bsd: []
  bsd-right: []
  old-linux: []
  linux: []
  old-solaris: []
  solaris: []
  hpux10: []
  hpux11: []
  irix: []
  macos: []
  vista: []
  windows2k3: []

defrag:
  memcap: 32mb
  hash-size: 65536
  trackers: 65535 # number of defragmented flows to follow
  max-frags: 65535 # number of fragments to keep (higher than trackers)
  prealloc: yes
  timeout: 60

flow:
  memcap: 128mb
  hash-size: 65536
  prealloc: 10000
  emergency-recovery: 30

vlan:
  use-for-tracking: true

flow-timeouts:

  default:
    new: 30
    established: 300
    closed: 0
    bypassed: 100
    emergency-new: 10
    emergency-established: 100
    emergency-closed: 0
    emergency-bypassed: 50
  tcp:
    new: 60
    established: 600
    closed: 60
    bypassed: 100
    emergency-new: 5
    emergency-established: 100
    emergency-closed: 10
    emergency-bypassed: 50
  udp:
    new: 30
    established: 300
    bypassed: 100
    emergency-new: 10
    emergency-established: 100
    emergency-bypassed: 50
  icmp:
    new: 30
    established: 300
    bypassed: 100
    emergency-new: 10
    emergency-established: 100
    emergency-bypassed: 50

stream:
  memcap: 64mb
  checksum-validation: yes # reject incorrect csums
  inline: auto # auto will use inline mode in IPS mode, yes or no set it statically
  reassembly:
    memcap: 256mb
    depth: 1mb # reassemble 1mb into a stream
    toserver-chunk-size: 2560
    toclient-chunk-size: 2560
    randomize-chunk-size: yes

host:
  hash-size: 4096
  prealloc: 1000
  memcap: 32mb

decoder:
  teredo:
    enabled: true
    ports: $TEREDO_PORTS # syntax: '[3544, 1234]' or '3533' or 'any'.

  vxlan:
    enabled: true
    ports: $VXLAN_PORTS # syntax: '[8472, 4789]' or '4789'.

  vntag:
    enabled: false

  geneve:
    enabled: true
    ports: $GENEVE_PORTS # syntax: '[6081, 1234]' or '6081'.

detect:
  profile: medium
  custom-values:
    toclient-groups: 3
    toserver-groups: 25
  sgh-mpm-context: auto
  inspection-recursion-limit: 3000

  prefilter:
    default: mpm

  grouping:

  profiling:
    grouping:
      dump-to-disk: false
      include-rules: false # very verbose
      include-mpm-stats: false

mpm-algo: auto

spm-algo: auto

threading:
  set-cpu-affinity: no
  cpu-affinity:
    - management-cpu-set:
        cpu: [0] # include only these CPUs in affinity settings
    - receive-cpu-set:
        cpu: [0] # include only these CPUs in affinity settings
    - worker-cpu-set:
        cpu: ["all"]
        mode: "exclusive"
        prio:
          low: [0]
          medium: ["1-2"]
          high: [3]
          default: "medium"
  detect-thread-ratio: 1.0

luajit:
  states: 128

profiling:

  rules:

    enabled: yes
    filename: rule_perf.log
    append: yes

    limit: 10

    json: yes

  keywords:
    enabled: yes
    filename: keyword_perf.log
    append: yes

  prefilter:
    enabled: yes
    filename: prefilter_perf.log
    append: yes

  rulegroups:
    enabled: yes
    filename: rule_group_perf.log
    append: yes

  packets:

    enabled: yes
    filename: packet_stats.log
    append: yes

    csv:

      enabled: no
      filename: packet_stats.csv

  locks:
    enabled: no
    filename: lock_stats.log
    append: yes

  pcap-log:
    enabled: no
    filename: pcaplog_stats.log
    append: yes

nfq:

nflog:
  - group: 2
    buffer-size: 18432
  - group: default
    qthreshold: 1
    qtimeout: 100
    max-size: 20000

capture:

netmap:
 - interface: eth2
 - interface: default

pfring:
  - interface: vmbr0
    threads: auto

    cluster-id: 99

    cluster-type: cluster_flow

  - interface: default

ipfw:

napatech:

    streams: ["0-3"]

    enable-stream-stats: no

    auto-config: yes

    hardware-bypass: yes

    inline: no

    ports: [0-1,2-3]

    hashmode: hash5tuplesorted

default-rule-path: /etc/suricata/rules

rule-files:
  - suricata.rules

classification-file: /etc/suricata/classification.config
reference-config-file: /etc/suricata/reference.config

detect-engine:

```

---

<div class="post-metadata">

**Author:** ![jufajardini](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/jufajardini/32/896_2.png) [@jufajardini](https://forum.suricata.io/u/jufajardini)\
**Post date:** [August 23, 2024, 6:48pm UTC](https://forum.suricata.io/t/i-cannot-confirm-whether-suricata-is-intercepting-malicious-traffic-as-an-ips/4823/2 "2024-08-23T18:48:44Z")

</div>

Hi there,

to enable logging of blocked packets and to see which alerts are leading to packets being blocked, you can:

- enable drop events ([17.1.1. Eve JSON Output — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/output/eve/eve-json-output.html#drops))
- enable the `verdict` field in the [alert events](https://docs.suricata.io/en/latest/output/eve/eve-json-output.html#alerts) (about the verdict field: [17.1.2. Eve JSON Format — Suricata 8.0.0-dev documentation](https://docs.suricata.io/en/latest/output/eve/eve-json-format.html#verdict))

Depending on the version you’re running, it may also be worth checking what’s the configuration for your exception policies ([My traffic gets blocked after upgrading to Suricata 7](https://forum.suricata.io/t/my-traffic-gets-blocked-after-upgrading-to-suricata-7/3745)).

Aside from those notes, alerts and blocks will always require some refining when you install a network monitoring tool in a new environment, to understand what alerts and blocks make sense based on the traffic, and which don’t…

I hope that helps!

---

<div class="post-metadata">

**Author:** ![Frank\_Lee](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/frank_lee/32/3097_2.png) [@Frank\_Lee](https://forum.suricata.io/u/Frank_Lee)\
**Post date:** [August 24, 2024, 12:57pm UTC](https://forum.suricata.io/t/i-cannot-confirm-whether-suricata-is-intercepting-malicious-traffic-as-an-ips/4823/3 "2024-08-24T12:57:29Z")

</div>

Thank you so much for your info.