Suricata doesn't alert me on ping with basic configuration

[lolozen (Loris PISTILLI)]

I just installed suricata in a virtualbox lab using the documentation tutorial.

I have a VM that act as a router which is NAT and linked to the inet network, 2 client VM linked to the inet network and my IDS VM also linked to the inet network with the promiscuous mode on ‘allow all’.

After installation I wrote this simple rule:
alert icmp any any -> any any (msg:"PING detected"; sid:2; rev:1;)

but then when I run suricata -S testcimp.rules -i enp0s3 and ping my IDS VM using one of my client VM nothing shows up in the suricata terminal like if nothing happens.

Can you help me ?

[jmtaylor90 (jt)]

Hi,

There are a number of possible causes.

Do you have a Suricata EVE log entry or Suricata generated pcap file that shows the icmp traffic being seen by suricata?

Does the suricata.log show the rules file being successfully loaded? You could also check rules status with suricatasc.

JT

[lolozen (Loris PISTILLI)]

I’m running suricata using suricata -S testicmp.rules -i enp0s3 -v the verbose tells me that the file is successfully loaded, I don’t understood what you meant by eve log entry or suricata generated pcap file, where do I choose which one to use, and which one should I use ?

[Andreas_Herz]

Please share your suricata.yaml so we know where your logfiles should be located. This could be /usr/local/var/log/suricata or just in /var/log/suricata or somewhere else, depending on your build/config.