Testing Suricata w/ BlackSun now fails

I have Suricata v6.0.8 running as an IDS on a VM which is receiving traffic from my router via IPTables rules. The IDS is running, with eve.json and stats.log being populated. I am however testing the IDS with curl -A “BlackSun” www.google.com – previously this worked when I attempted the curl inside my VM (but not my main laptop), but I changed my .yaml to:

address-groups:

HOME_NET: “[192.168.0.0/24]”

Now no new alerts appear in fast.log… Why would this have changed my ability to trigger an alert? I read that making the home net the actual size in .yaml will make the IDS more accurate.

I am wondering if the issue may also be different interfaces.

The network interface for my VM shown in ifconfig is enp0s3, The interface shown for my laptop in ifconfig is en0.

Events for the curl do appear in eve.json:

eve.json:{“timestamp”:“2023-07-08T12:05:09.301862-0400”,“flow_id”:86039086832770,“in_iface”:“enp0s3”,“event_type”:“http”,“src_ip”:“192.168.1.156”,“src_port”:33318,“dest_ip”:“142.250.65.196”,“dest_port”:80,“proto”:“TCP”,“tx_id”:0,“http”:{“hostname”:“www.google.com”,“url”:“/”,“http_user_agent”:“BlackSun”,“http_content_type”:“text/html”,“http_method”:“GET”,“protocol”:“HTTP/1.1”,“status”:200,“length”:18084}}

eve.json:{“timestamp”:“2023-07-08T12:05:09.310598-0400”,“flow_id”:86039086832770,“in_iface”:“enp0s3”,“event_type”:“fileinfo”,“src_ip”:“142.250.65.196”,“src_port”:80,“dest_ip”:“192.168.1.156”,“dest_port”:33318,“proto”:“TCP”,“http”:{“hostname”:“www.google.com”,“url”:“/”,“http_user_agent”:“BlackSun”,“http_content_type”:“text/html”,“http_method”:“GET”,“protocol”:“HTTP/1.1”,“status”:200,“length”:18084},“app_proto”:“http”,“fileinfo”:{“filename”:“/”,“sid”:,“gaps”:false,“state”:“CLOSED”,“stored”:false,“size”:18058,“tx_id”:0}}

eve.json:{“timestamp”:“2023-07-08T12:05:54.514218-0400”,“flow_id”:1119472645731255,“in_iface”:“enp0s3”,“event_type”:“http”,“src_ip”:“192.168.1.156”,“src_port”:39688,“dest_ip”:“142.250.65.196”,“dest_port”:80,“proto”:“TCP”,“tx_id”:0,“http”:{“hostname”:“www.google.com”,“url”:“/”,“http_user_agent”:“BlackSun”,“http_content_type”:“text/html”,“http_method”:“GET”,“protocol”:“HTTP/1.1”,“status”:200,“length”:18025}}

eve.json:{“timestamp”:“2023-07-08T12:05:54.525767-0400”,“flow_id”:1119472645731255,“in_iface”:“enp0s3”,“event_type”:“fileinfo”,“src_ip”:“142.250.65.196”,“src_port”:80,“dest_ip”:“192.168.1.156”,“dest_port”:39688,“proto”:“TCP”,“http”:{“hostname”:“www.google.com”,“url”:“/”,“http_user_agent”:“BlackSun”,“http_content_type”:“text/html”,“http_method”:“GET”,“protocol”:“HTTP/1.1”,“status”:200,“length”:18025},“app_proto”:“http”,“fileinfo”:{“filename”:“/”,“sid”:,“gaps”:false,“state”:“CLOSED”,“stored”:false,“size”:18000,“tx_id”:0}}

Here are the first 750 lines of my .yaml, the only thing I changed from default are the HOME_NET and interface:

# Suricata configuration file. In addition to the comments describing all
# options in this file, full documentation can be found at:
# https://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html
#
# This configuration file generated by:
#     Suricata 6.0.8

##
## Step 1: Inform Suricata about your network
##

vars:
  # more specific is better for alert accuracy and performance
  address-groups:
    HOME_NET: "[192.168.0.0/24]"
    #HOME_NET: "[192.168.0.0/16]"
    #HOME_NET: "[10.0.0.0/8]"
    #HOME_NET: "[172.16.0.0/12]"
    #HOME_NET: "any"

    EXTERNAL_NET: "!$HOME_NET"
    #EXTERNAL_NET: "any"

    HTTP_SERVERS: "$HOME_NET"
    SMTP_SERVERS: "$HOME_NET"
    SQL_SERVERS: "$HOME_NET"
    DNS_SERVERS: "$HOME_NET"
    TELNET_SERVERS: "$HOME_NET"
    AIM_SERVERS: "$EXTERNAL_NET"
    DC_SERVERS: "$HOME_NET"
    DNP3_SERVER: "$HOME_NET"
    DNP3_CLIENT: "$HOME_NET"
    MODBUS_CLIENT: "$HOME_NET"
    MODBUS_SERVER: "$HOME_NET"
    ENIP_CLIENT: "$HOME_NET"
    ENIP_SERVER: "$HOME_NET"

  port-groups:
    HTTP_PORTS: "80"
    SHELLCODE_PORTS: "!80"
    ORACLE_PORTS: 1521
    SSH_PORTS: 22
    DNP3_PORTS: 20000
    MODBUS_PORTS: 502
    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
    FTP_PORTS: 21
    GENEVE_PORTS: 6081
    VXLAN_PORTS: 4789
    TEREDO_PORTS: 3544

##
## Step 2: Select outputs to enable
##

# The default logging directory.  Any log or output file will be
# placed here if it's not specified with a full path name. This can be
# overridden with the -l command line parameter.
default-log-dir: /var/log/suricata/

# Global stats configuration
stats:
  enabled: yes
  # The interval field (in seconds) controls the interval at
  # which stats are updated in the log.
  interval: 8
  # Add decode events to stats.
  #decoder-events: true
  # Decoder event prefix in stats. Has been 'decoder' before, but that leads
  # to missing events in the eve.stats records. See issue #2225.
  #decoder-events-prefix: "decoder.event"
  # Add stream events as stats.
  #stream-events: false

# Configure the type of alert (and other) logging you would like.
outputs:
  # a line based alerts log similar to Snort's fast.log
  - fast:
      enabled: yes
      filename: fast.log
      append: yes
      #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

  # Extensible Event Format (nicknamed EVE) event log in JSON format
  - eve-log:
      enabled: yes
      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
      filename: eve.json
      # Enable for multi-threaded eve.json output; output files are amended with
      # with an identifier, e.g., eve.9.json
      #threaded: false
      #prefix: "@cee: " # prefix to prepend to each log entry
      # the following are valid when type: syslog above
      #identity: "suricata"
      #facility: local5
      #level: Info ## possible levels: Emergency, Alert, Critical,
                   ## Error, Warning, Notice, Info, Debug
      #ethernet: no  # log ethernet header in events when available
      #redis:
      #  server: 127.0.0.1
      #  port: 6379
      #  async: true ## if redis replies are read asynchronously
      #  mode: list ## possible values: list|lpush (default), rpush, channel|publish
      #             ## lpush and rpush are using a Redis list. "list" is an alias for lpush
      #             ## publish is using a Redis channel. "channel" is an alias for publish
      #  key: suricata ## key or channel to use (default to suricata)
      # Redis pipelining set up. This will enable to only do a query every
      # 'batch-size' events. This should lower the latency induced by network
      # connection at the cost of some memory. There is no flushing implemented
      # so this setting should be reserved to high traffic Suricata deployments.
      #  pipelining:
      #    enabled: yes ## set enable to yes to enable query pipelining
      #    batch-size: 10 ## number of entries to keep in buffer

      # Include top level metadata. Default yes.
      #metadata: no

      # include the name of the input pcap file in pcap file processing mode
      pcap-file: false

      # Community Flow ID
      # Adds a 'community_id' field to EVE records. These are meant to give
      # records a predictable flow ID that can be used to match records to
      # output of other tools such as Zeek (Bro).
      #
      # Takes a 'seed' that needs to be same across sensors and tools
      # to make the id less predictable.

      # enable/disable the community id feature.
      community-id: false
      # Seed value for the ID output. Valid values are 0-65535.
      community-id-seed: 0

      # HTTP X-Forwarded-For support by adding an extra field or overwriting
      # the source or destination IP address (depending on flow direction)
      # with the one reported in the X-Forwarded-For HTTP header. This is
      # helpful when reviewing alerts for traffic that is being reverse
      # or forward proxied.
      xff:
        enabled: no
        # Two operation modes are available: "extra-data" and "overwrite".
        mode: extra-data
        # Two proxy deployments are supported: "reverse" and "forward". In
        # a "reverse" deployment the IP address used is the last one, in a
        # "forward" deployment the first IP address is used.
        deployment: reverse
        # Header name where the actual IP address will be reported. If more
        # than one IP address is present, the last IP address will be the
        # one taken into consideration.
        header: X-Forwarded-For

      types:
        - alert:
            # payload: yes             # enable dumping payload in Base64
            # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log
            # payload-printable: yes   # enable dumping payload in printable (lossy) format
            # packet: yes              # enable dumping of packet (without stream segments)
            # metadata: no             # enable inclusion of app layer metadata with alert. Default yes
            # http-body: yes           # Requires metadata; enable dumping of HTTP body in Base64
            # http-body-printable: yes # Requires metadata; enable dumping of HTTP body in printable format

            # Enable the logging of tagged packets for rules using the
            # "tag" keyword.
            tagged-packets: yes
        - anomaly:
            # Anomaly log records describe unexpected conditions such
            # as truncated packets, packets with invalid IP/UDP/TCP
            # length values, and other events that render the packet
            # invalid for further processing or describe unexpected
            # behavior on an established stream. Networks which
            # experience high occurrences of anomalies may experience
            # packet processing degradation.
            #
            # Anomalies are reported for the following:
            # 1. Decode: Values and conditions that are detected while
            # decoding individual packets. This includes invalid or
            # unexpected values for low-level protocol lengths as well
            # as stream related events (TCP 3-way handshake issues,
            # unexpected sequence number, etc).
            # 2. Stream: This includes stream related events (TCP
            # 3-way handshake issues, unexpected sequence number,
            # etc).
            # 3. Application layer: These denote application layer
            # specific conditions that are unexpected, invalid or are
            # unexpected given the application monitoring state.
            #
            # By default, anomaly logging is enabled. When anomaly
            # logging is enabled, applayer anomaly reporting is
            # also enabled.
            enabled: yes
            #
            # Choose one or more types of anomaly logging and whether to enable
            # logging of the packet header for packet anomalies.
            types:
              # decode: no
              # stream: no
              # applayer: yes
            #packethdr: no
        - http:
            extended: yes     # enable this for extended logging information
            # custom allows additional HTTP fields to be included in eve-log.
            # the example below adds three additional fields when uncommented
            #custom: [Accept-Encoding, Accept-Language, Authorization]
            # set this value to one and only one from {both, request, response}
            # to dump all HTTP headers for every HTTP request and/or response
            # dump-all-headers: none
        - dns:
            # This configuration uses the new DNS logging format,
            # the old configuration is still available:
            # https://suricata.readthedocs.io/en/latest/output/eve/eve-json-output.html#dns-v1-format

            # As of Suricata 5.0, version 2 of the eve dns output
            # format is the default.
            #version: 2

            # Enable/disable this logger. Default: enabled.
            #enabled: yes

            # Control logging of requests and responses:
            # - requests: enable logging of DNS queries
            # - responses: enable logging of DNS answers
            # By default both requests and responses are logged.
            #requests: no
            #responses: no

            # Format of answer logging:
            # - detailed: array item per answer
            # - grouped: answers aggregated by type
            # Default: all
            #formats: [detailed, grouped]

            # DNS record types to log, based on the query type.
            # Default: all.
            #types: [a, aaaa, cname, mx, ns, ptr, txt]
        - tls:
            extended: yes     # enable this for extended logging information
            # output TLS transaction where the session is resumed using a
            # session id
            #session-resumption: no
            # custom controls which TLS fields that are included in eve-log
            #custom: [subject, issuer, session_resumed, serial, fingerprint, sni, version, not_before, not_after, certificate, chain, ja3, ja3s]
        - files:
            force-magic: no   # force logging magic on all logged files
            # force logging of checksums, available hash functions are md5,
            # sha1 and sha256
            #force-hash: [md5]
        #- drop:
        #    alerts: yes      # log alerts that caused drops
        #    flows: all       # start or all: 'start' logs only a single drop
        #                     # per flow direction. All logs each dropped pkt.
        - smtp:
            #extended: yes # enable this for extended logging information
            # this includes: bcc, message-id, subject, x_mailer, user-agent
            # custom fields logging from the list:
            #  reply-to, bcc, message-id, subject, x-mailer, user-agent, received,
            #  x-originating-ip, in-reply-to, references, importance, priority,
            #  sensitivity, organization, content-md5, date
            #custom: [received, x-mailer, x-originating-ip, relays, reply-to, bcc]
            # output md5 of fields: body, subject
            # for the body you need to set app-layer.protocols.smtp.mime.body-md5
            # to yes
            #md5: [body, subject]

        #- dnp3
        - ftp
        - rdp
        - nfs
        - smb
        - tftp
        - ikev2
        - dcerpc
        - krb5
        - snmp
        - rfb
        - sip
        - dhcp:
            enabled: yes
            # When extended mode is on, all DHCP messages are logged
            # with full detail. When extended mode is off (the
            # default), just enough information to map a MAC address
            # to an IP address is logged.
            extended: no
        - ssh
        - mqtt:
            # passwords: yes           # enable output of passwords
        # HTTP2 logging. HTTP2 support is currently experimental and
        # disabled by default. To enable, uncomment the following line
        # and be sure to enable http2 in the app-layer section.
        #- http2
        - stats:
            totals: yes       # stats for all threads merged together
            threads: no       # per thread stats
            deltas: no        # include delta values
        # bi-directional flows
        - flow
        # uni-directional flows
        #- netflow

        # Metadata event type. Triggered whenever a pktvar is saved
        # and will include the pktvars, flowvars, flowbits and
        # flowints.
        #- metadata

  # a line based log of HTTP requests (no alerts)
  - http-log:
      enabled: no
      filename: http.log
      append: yes
      #extended: yes     # enable this for extended logging information
      #custom: yes       # enable the custom logging format (defined by customformat)
      #customformat: "%{%D-%H:%M:%S}t.%z %{X-Forwarded-For}i %H %m %h %u %s %B %a:%p -> %A:%P"
      #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

  # a line based log of TLS handshake parameters (no alerts)
  - tls-log:
      enabled: no  # Log TLS connections.
      filename: tls.log # File to store TLS logs.
      append: yes
      #extended: yes     # Log extended information like fingerprint
      #custom: yes       # enabled the custom logging format (defined by customformat)
      #customformat: "%{%D-%H:%M:%S}t.%z %a:%p -> %A:%P %v %n %d %D"
      #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'
      # output TLS transaction where the session is resumed using a
      # session id
      #session-resumption: no

  # output module to store certificates chain to disk
  - tls-store:
      enabled: no
      #certs-log-dir: certs # directory to store the certificates files

  # Packet log... log packets in pcap format. 3 modes of operation: "normal"
  # "multi" and "sguil".
  #
  # In normal mode a pcap file "filename" is created in the default-log-dir,
  # or as specified by "dir".
  # In multi mode, a file is created per thread. This will perform much
  # better, but will create multiple files where 'normal' would create one.
  # In multi mode the filename takes a few special variables:
  # - %n -- thread number
  # - %i -- thread id
  # - %t -- timestamp (secs or secs.usecs based on 'ts-format'
  # E.g. filename: pcap.%n.%t
  #
  # Note that it's possible to use directories, but the directories are not
  # created by Suricata. E.g. filename: pcaps/%n/log.%s will log into the
  # per thread directory.
  #
  # Also note that the limit and max-files settings are enforced per thread.
  # So the size limit when using 8 threads with 1000mb files and 2000 files
  # is: 8*1000*2000 ~ 16TiB.
  #
  # In Sguil mode "dir" indicates the base directory. In this base dir the
  # pcaps are created in the directory structure Sguil expects:
  #
  # $sguil-base-dir/YYYY-MM-DD/$filename.<timestamp>
  #
  # By default all packets are logged except:
  # - TCP streams beyond stream.reassembly.depth
  # - encrypted streams after the key exchange
  #
  - pcap-log:
      enabled: no
      filename: log.pcap

      # File size limit.  Can be specified in kb, mb, gb.  Just a number
      # is parsed as bytes.
      limit: 1000mb

      # If set to a value, ring buffer mode is enabled. Will keep maximum of
      # "max-files" of size "limit"
      max-files: 2000

      # Compression algorithm for pcap files. Possible values: none, lz4.
      # Enabling compression is incompatible with the sguil mode. Note also
      # that on Windows, enabling compression will *increase* disk I/O.
      compression: none

      # Further options for lz4 compression. The compression level can be set
      # to a value between 0 and 16, where higher values result in higher
      # compression.
      #lz4-checksum: no
      #lz4-level: 0

      mode: normal # normal, multi or sguil.

      # Directory to place pcap files. If not provided the default log
      # directory will be used. Required for "sguil" mode.
      #dir: /nsm_data/

      #ts-format: usec # sec or usec second format (default) is filename.sec usec is filename.sec.usec
      use-stream-depth: no #If set to "yes" packets seen after reaching stream inspection depth are ignored. "no" logs all packets
      honor-pass-rules: no # If set to "yes", flows in which a pass rule matched will stop being logged.

  # a full alert log containing much information for signature writers
  # or for investigating suspected false positives.
  - alert-debug:
      enabled: no
      filename: alert-debug.log
      append: yes
      #filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'

  # alert output to prelude (https://www.prelude-siem.org/) only
  # available if Suricata has been compiled with --enable-prelude
  - alert-prelude:
      enabled: no
      profile: suricata
      log-packet-content: no
      log-packet-header: yes

  # Stats.log contains data from various counters of the Suricata engine.
  - stats:
      enabled: yes
      filename: stats.log
      append: yes       # append to file (yes) or overwrite it (no)
      totals: yes       # stats for all threads merged together
      threads: no       # per thread stats
      #null-values: yes  # print counters that have value 0. Default: no

  # a line based alerts log similar to fast.log into syslog
  - syslog:
      enabled: no
      # reported identity to syslog. If omitted the program name (usually
      # suricata) will be used.
      #identity: "suricata"
      facility: local5
      #level: Info ## possible levels: Emergency, Alert, Critical,
                   ## Error, Warning, Notice, Info, Debug

  # Output module for storing files on disk. Files are stored in
  # directory names consisting of the first 2 characters of the
  # SHA256 of the file. Each file is given its SHA256 as a filename.
  #
  # When a duplicate file is found, the timestamps on the existing file
  # are updated.
  #
  # Unlike the older filestore, metadata is not written by default
  # as each file should already have a "fileinfo" record in the
  # eve-log. If write-fileinfo is set to yes, then each file will have
  # one more associated .json files that consist of the fileinfo
  # record. A fileinfo file will be written for each occurrence of the
  # file seen using a filename suffix to ensure uniqueness.
  #
  # To prune the filestore directory see the "suricatactl filestore
  # prune" command which can delete files over a certain age.
  - file-store:
      version: 2
      enabled: no

      # Set the directory for the filestore. Relative pathnames
      # are contained within the "default-log-dir".
      #dir: filestore

      # Write out a fileinfo record for each occurrence of a file.
      # Disabled by default as each occurrence is already logged
      # as a fileinfo record to the main eve-log.
      #write-fileinfo: yes

      # Force storing of all files. Default: no.
      #force-filestore: yes

      # Override the global stream-depth for sessions in which we want
      # to perform file extraction. Set to 0 for unlimited; otherwise,
      # must be greater than the global stream-depth value to be used.
      #stream-depth: 0

      # Uncomment the following variable to define how many files can
      # remain open for filestore by Suricata. Default value is 0 which
      # means files get closed after each write to the file.
      #max-open-files: 1000

      # Force logging of checksums: available hash functions are md5,
      # sha1 and sha256. Note that SHA256 is automatically forced by
      # the use of this output module as it uses the SHA256 as the
      # file naming scheme.
      #force-hash: [sha1, md5]
      # NOTE: X-Forwarded configuration is ignored if write-fileinfo is disabled
      # HTTP X-Forwarded-For support by adding an extra field or overwriting
      # the source or destination IP address (depending on flow direction)
      # with the one reported in the X-Forwarded-For HTTP header. This is
      # helpful when reviewing alerts for traffic that is being reverse
      # or forward proxied.
      xff:
        enabled: no
        # Two operation modes are available, "extra-data" and "overwrite".
        mode: extra-data
        # Two proxy deployments are supported, "reverse" and "forward". In
        # a "reverse" deployment the IP address used is the last one, in a
        # "forward" deployment the first IP address is used.
        deployment: reverse
        # Header name where the actual IP address will be reported. If more
        # than one IP address is present, the last IP address will be the
        # one taken into consideration.
        header: X-Forwarded-For

  # Log TCP data after stream normalization
  # Two types: file or dir:
  #     - file logs into a single logfile.
  #     - dir creates 2 files per TCP session and stores the raw TCP
  #            data into them.
  # Use 'both' to enable both file and dir modes.
  #
  # Note: limited by "stream.reassembly.depth"
  - tcp-data:
      enabled: no
      type: file
      filename: tcp-data.log

  # Log HTTP body data after normalization, de-chunking and unzipping.
  # Two types: file or dir.
  #     - file logs into a single logfile.
  #     - dir creates 2 files per HTTP session and stores the
  #           normalized data into them.
  # Use 'both' to enable both file and dir modes.
  #
  # Note: limited by the body limit settings
  - http-body-data:
      enabled: no
      type: file
      filename: http-data.log

  # Lua Output Support - execute lua script to generate alert and event
  # output.
  # Documented at:
  # https://suricata.readthedocs.io/en/latest/output/lua-output.html
  - lua:
      enabled: no
      #scripts-dir: /etc/suricata/lua-output/
      scripts:
      #   - script1.lua

# Logging configuration.  This is not about logging IDS alerts/events, but
# output about what Suricata is doing, like startup messages, errors, etc.
logging:
  # The default log level: can be overridden in an output section.
  # Note that debug level logging will only be emitted if Suricata was
  # compiled with the --enable-debug configure option.
  #
  # This value is overridden by the SC_LOG_LEVEL env var.
  default-log-level: notice

  # The default output format.  Optional parameter, should default to
  # something reasonable if not provided.  Can be overridden in an
  # output section.  You can leave this out to get the default.
  #
  # This value is overridden by the SC_LOG_FORMAT env var.
  #default-log-format: "[%i] %t - (%f:%l) <%d> (%n) -- "

  # A regex to filter output.  Can be overridden in an output section.
  # Defaults to empty (no filter).
  #
  # This value is overridden by the SC_LOG_OP_FILTER env var.
  default-output-filter:

  # Requires libunwind to be available when Suricata is configured and built.
  # If a signal unexpectedly terminates Suricata, displays a brief diagnostic
  # message with the offending stacktrace if enabled.
  #stacktrace-on-signal: on

  # Define your logging outputs.  If none are defined, or they are all
  # disabled you will get the default: console output.
  outputs:
  - console:
      enabled: yes
      # type: json
  - file:
      enabled: yes
      level: info
      filename: suricata.log
      # type: json
  - syslog:
      enabled: no
      facility: local5
      format: "[%i] <%d> -- "
      # type: json


##
## Step 3: Configure common capture settings
##
## See "Advanced Capture Options" below for more options, including Netmap
## and PF_RING.
##

# Linux high speed capture support
af-packet:
  - interface: enp0s3
    # Number of receive threads. "auto" uses the number of cores
    #threads: auto
    # Default clusterid. AF_PACKET will load balance packets based on flow.
    cluster-id: 99
    # Default AF_PACKET cluster type. AF_PACKET can load balance per flow or per hash.
    # This is only supported for Linux kernel > 3.1
    # possible value are:
    #  * cluster_flow: all packets of a given flow are sent to the same socket
    #  * cluster_cpu: all packets treated in kernel by a CPU are sent to the same socket
    #  * cluster_qm: all packets linked by network card to a RSS queue are sent to the same
    #  socket. Requires at least Linux 3.14.
    #  * cluster_ebpf: eBPF file load balancing. See doc/userguide/capture-hardware/ebpf-xdp.rst for
    #  more info.
    # Recommended modes are cluster_flow on most boxes and cluster_cpu or cluster_qm on system
    # with capture card using RSS (requires cpu affinity tuning and system IRQ tuning)
    cluster-type: cluster_flow
    # In some fragmentation cases, the hash can not be computed. If "defrag" is set
    # to yes, the kernel will do the needed defragmentation before sending the packets.
    defrag: yes
    # To use the ring feature of AF_PACKET, set 'use-mmap' to yes
    #use-mmap: yes
    # Lock memory map to avoid it being swapped. Be careful that over
    # subscribing could lock your system
    #mmap-locked: yes
    # Use tpacket_v3 capture mode, only active if use-mmap is true
    # Don't use it in IPS or TAP mode as it causes severe latency
    #tpacket-v3: yes
    # Ring size will be computed with respect to "max-pending-packets" and number
    # of threads. You can set manually the ring size in number of packets by setting
    # the following value. If you are using flow "cluster-type" and have really network
    # intensive single-flow you may want to set the "ring-size" independently of the number
    # of threads:
    #ring-size: 2048
    # Block size is used by tpacket_v3 only. It should set to a value high enough to contain
    # a decent number of packets. Size is in bytes so please consider your MTU. It should be
    # a power of 2 and it must be multiple of page size (usually 4096).
    #block-size: 32768
    # tpacket_v3 block timeout: an open block is passed to userspace if it is not
    # filled after block-timeout milliseconds.
    #block-timeout: 10
    # On busy systems, set it to yes to help recover from a packet drop
    # phase. This will result in some packets (at max a ring flush) not being inspected.
    #use-emergency-flush: yes
    # recv buffer size, increased value could improve performance
    # buffer-size: 32768
    # Set to yes to disable promiscuous mode
    # disable-promisc: no
    # Choose checksum verification mode for the interface. At the moment
    # of the capture, some packets may have an invalid checksum due to
    # the checksum computation being offloaded to the network card.
    # Possible values are:
    #  - kernel: use indication sent by kernel for each packet (default)
    #  - yes: checksum validation is forced
    #  - no: checksum validation is disabled
    #  - auto: Suricata uses a statistical approach to detect when
    #  checksum off-loading is used.
    # Warning: 'capture.checksum-validation' must be set to yes to have any validation
    #checksum-checks: kernel
    # BPF filter to apply to this interface. The pcap filter syntax applies here.
    #bpf-filter: port 80 or udp
    # You can use the following variables to activate AF_PACKET tap or IPS mode.
    # If copy-mode is set to ips or tap, the traffic coming to the current
    # interface will be copied to the copy-iface interface. If 'tap' is set, the
    # copy is complete. If 'ips' is set, the packet matching a 'drop' action
    # will not be copied.
    #copy-mode: ips
    #copy-iface: eth1
    #  For eBPF and XDP setup including bypass, filter and load balancing, please
    #  see doc/userguide/capture-hardware/ebpf-xdp.rst for more info.

  # Put default values here. These will be used for an interface that is not
  # in the list above.
  - interface: default
    #threads: auto
    #use-mmap: no
    #tpacket-v3: yes

# Cross platform libpcap capture support
pcap:
  - interface: eth0
    # On Linux, pcap will try to use mmap'ed capture and will use "buffer-size"
    # as total memory used by the ring. So set this to something bigger
    # than 1% of your bandwidth.
    #buffer-size: 16777216
    #bpf-filter: "tcp and port 25"
    # Choose checksum verification mode for the interface. At the moment
    # of the capture, some packets may have an invalid checksum due to
    # the checksum computation being offloaded to the network card.
    # Possible values are:
    #  - yes: checksum validation is forced
    #  - no: checksum validation is disabled
    #  - auto: Suricata uses a statistical approach to detect when
    #  checksum off-loading is used. (default)
    # Warning: 'capture.checksum-validation' must be set to yes to have any validation
    #checksum-checks: auto
    # With some accelerator cards using a modified libpcap (like Myricom), you
    # may want to have the same number of capture threads as the number of capture
    # rings. In this case, set up the threads variable to N to start N threads
    # listening on the same interface.
    #threads: 16
    # set to no to disable promiscuous mode:
    #promisc: no
    # set snaplen, if not set it defaults to MTU if MTU can be known
    # via ioctl call and to full capture if not.
    #snaplen: 1518
  # Put default values here
  - interface: default
    #checksum-checks: auto

# Settings for reading pcap files
pcap-file:
  # Possible values are:
  #  - yes: checksum validation is forced
  #  - no: checksum validation is disabled
  #  - auto: Suricata uses a statistical approach to detect when
  #  checksum off-loading is used. (default)
  # Warning: 'checksum-validation' must be set to yes to have checksum tested
  checksum-checks: auto

# See "Advanced Capture Options" below for more options, including Netmap
# and PF_RING.


##
## Step 4: App Layer Protocol configuration
##

# Configure the app-layer parsers.
#
# The error-policy setting applies to all app-layer parsers. Values can be
# "drop-flow", "pass-flow", "bypass", "drop-packet", "pass-packet", "reject" or
# "ignore" (the default).
#
# The protocol's section details each protocol.
#
# The option "enabled" takes 3 values - "yes", "no", "detection-only".
# "yes" enables both detection and the parser, "no" disables both, and
# "detection-only" enables protocol detection only (parser disabled).
app-layer:
  # error-policy: ignore
  protocols:
    rfb:
      enabled: yes
      detection-ports:
        dp: 5900, 5901, 5902, 5903, 5904, 5905, 5906, 5907, 5908, 5909
    # MQTT, disabled by default.
    mqtt:
      # enabled: no
      # max-msg-length: 1mb
      # subscribe-topic-match-limit: 100
      # unsubscribe-topic-match-limit: 100
      # Maximum number of live MQTT transactions per flow
      # max-tx: 4096
    krb5:
      enabled: yes
    snmp:
      enabled: yes
    ikev2:
      enabled: yes
    tls:
      enabled: yes

That being said, testmyids.org is working for fast.log alerts:

07/08/2023-17:13:20.581733  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 108.138.128.66:80 -> 192.168.1.156:42618
07/08/2023-17:13:20.581733  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 108.138.128.66:80 -> 192.168.1.156:42618
07/08/2023-17:13:22.128780  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 108.138.128.66:80 -> 192.168.1.156:42620
07/08/2023-17:13:22.128780  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 108.138.128.66:80 -> 192.168.1.156:42620
07/08/2023-17:13:23.819242  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 108.138.128.128:80 -> 192.168.1.156:55908
07/08/2023-17:13:23.819242  [**] [1:2100498:7] GPL ATTACK_RESPONSE id check returned root [**] [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 108.138.128.128:80 -> 192.168.1.156:55908

Hi,

From what you posted, I think the BlackSun user-agent test might be failing to alert due to your HOME_NET variable setting.

Your suricata.yaml snippet:

HOME_NET: “[192.168.0.0/24]”

Your eve.json log:
eve.json:{“timestamp”:“2023-07-08T12:05:09.301862-0400”,“flow_id”:86039086832770,“in_iface”:“enp0s3”,“event_type”:“http”,“src_ip”:“192.168.1.156”,“src_port”:33318,“dest_ip”:“142.250.65.196”,“dest_port”:80,“proto”:“TCP”,“tx_id”:0,“http”:{“hostname”:“www.google.com”,“url”:“/”,“http_user_agent”:“BlackSun ”,“http_content_type”:“text/html”,“http_method”:“GET”,“protocol”:“HTTP/1.1”,“status”:200,“length”:18084}}

The eve.json log indicates a src_ip of 192.168.1.156 which is not covered under your HOME_NET definition and would be recognized as EXTERNAL_NET by suricata.

To remedy this you could either go to a HOME_NET of [192.168.0.0/16] or
[192.168.0.0/24,192.168.1.0/24] or some other specification of HOME_NET that includes 192.168.1.156.

Hope that helps,

JT

I changed the suricata.yaml but nothing is alerting for BlackSun…

I still get alerts for Spotify for my .175 device though:

07/11/2023-00:01:21.255441 [] [1:2027397:1] ET POLICY Spotify P2P Client [] [Classification: Not Suspicious Traffic] [Priority: 3] {UDP} 192.168.1.175:57621 → 192.168.1.255:57621

These are my IPTables rules for mirroring the traffic:

iptables -t mangle -A PREROUTING -d 192.168.0.0/16 -j TEE --gateway 192.168.1.156
iptables -t mangle -A POSTROUTING ! -s 192.168.0.0/16 -j TEE --gateway 192.168.1.156

What do you have for your HOME_NET now?

JT

address-groups:
HOME_NET: “[192.168.0.0/16]”

Once you made the change did you reload/restart suricata so the new configuration is in effect?

Are you seeing flow records for the traffic?

JT

yes there are flow records.

From running tcpdump I’m not sure that my iptables rules are working, any suggestions on what to tweak?

Maybe try these instead? Port Mirroring with iptables [Trisul Network Analytics Developer Zone ]

I enabled promiscuous mode on my VM running Suricata, so I get a lot more traffic in TCPDUMP, but still cannot generate alerts from the BlackSun curl on my main laptop…

I also enabled http.log in suricata.yaml, and all of the http traffic is still only from the VM running Suricata -

07/13/2023-00:28:23.276257 security.ubuntu.com[]/ubuntu/dists/jammy-security/main/binary-i386/by-hash/SHA256/8b50400c72a98bcf1f3dc4717835733cc095b6e0251195e5c890d42267ecec03[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.301590 security.ubuntu.com[]/ubuntu/dists/jammy-security/main/dep11/by-hash/SHA256/5af8a1a918a8255d0a3984844270f1e71586d16cdca08c492f4f286cf558d862[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.301590 security.ubuntu.com[]/ubuntu/dists/jammy-security/main/dep11/by-hash/SHA256/5af8a1a918a8255d0a3984844270f1e71586d16cdca08c492f4f286cf558d862[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.313313 security.ubuntu.com[]/ubuntu/dists/jammy-security/main/cnf/by-hash/SHA256/9c1778263b6516f994b362fe6bc2b75a8afb9bbca30a56a358d55b6fe6bbcd7e[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.313313 security.ubuntu.com[]/ubuntu/dists/jammy-security/main/cnf/by-hash/SHA256/9c1778263b6516f994b362fe6bc2b75a8afb9bbca30a56a358d55b6fe6bbcd7e[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.330965 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/binary-amd64/by-hash/SHA256/952e74346a3041ecc3797429ac19d5c520c49bbf1a05a208760ceae3fa3e6ae1[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.330965 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/binary-amd64/by-hash/SHA256/952e74346a3041ecc3797429ac19d5c520c49bbf1a05a208760ceae3fa3e6ae1[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.377740 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/binary-i386/by-hash/SHA256/3cef8d18a708af1a19851086a2958301e6751c802cf28ba4f14f7131f3173b3c[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.377740 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/binary-i386/by-hash/SHA256/3cef8d18a708af1a19851086a2958301e6751c802cf28ba4f14f7131f3173b3c[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.397642 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/i18n/by-hash/SHA256/d368367cb2bf89514ca2740cbbb57554f5a4038259a49d9152e1e01b33188be9[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.397642 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/i18n/by-hash/SHA256/d368367cb2bf89514ca2740cbbb57554f5a4038259a49d9152e1e01b33188be9[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.418344 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/cnf/by-hash/SHA256/50eba70e058304568dcb675a10765d6d0891da46cd1a23528db80807c4c327af[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.418344 security.ubuntu.com[]/ubuntu/dists/jammy-security/restricted/cnf/by-hash/SHA256/50eba70e058304568dcb675a10765d6d0891da46cd1a23528db80807c4c327af[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.434624 security.ubuntu.com[]/ubuntu/dists/jammy-security/universe/dep11/by-hash/SHA256/fb7d0c8ecf85806ce6a0d85e5eac51a1ba4c638959ca834521403f065fbc4ede[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.434624 security.ubuntu.com[]/ubuntu/dists/jammy-security/universe/dep11/by-hash/SHA256/fb7d0c8ecf85806ce6a0d85e5eac51a1ba4c638959ca834521403f065fbc4ede[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.449013 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/binary-i386/by-hash/SHA256/37999ea45a75ce0740f788b2b9b23be735d529ba15c897ea5d88bd2d2013def9[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.449013 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/binary-i386/by-hash/SHA256/37999ea45a75ce0740f788b2b9b23be735d529ba15c897ea5d88bd2d2013def9[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46744 → 91.189.91.39:80

07/13/2023-00:28:23.487131 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/binary-amd64/by-hash/SHA256/4d24b2009666ca92705f19f7d2170914d22010e5d85ec11c6ff7fc6bf0875a6c[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46758 → 91.189.91.39:80

07/13/2023-00:28:23.487131 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/binary-amd64/by-hash/SHA256/4d24b2009666ca92705f19f7d2170914d22010e5d85ec11c6ff7fc6bf0875a6c[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46758 → 91.189.91.39:80

07/13/2023-00:28:23.501799 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/i18n/by-hash/SHA256/3bfbd668e53e13eb3a2fcd9335ae2a366b7f2a6b630744fcb3c4af3a8dc747fc[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46758 → 91.189.91.39:80

07/13/2023-00:28:23.501799 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/i18n/by-hash/SHA256/3bfbd668e53e13eb3a2fcd9335ae2a366b7f2a6b630744fcb3c4af3a8dc747fc[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46758 → 91.189.91.39:80

07/13/2023-00:28:23.558819 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/cnf/by-hash/SHA256/800bcf63c8216fd7dd93511424a3a7bc6882b765a22b38757fc3d12158587410[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46758 → 91.189.91.39:80

07/13/2023-00:28:23.558819 security.ubuntu.com[]/ubuntu/dists/jammy-security/multiverse/cnf/by-hash/SHA256/800bcf63c8216fd7dd93511424a3a7bc6882b765a22b38757fc3d12158587410[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:46758 → 91.189.91.39:80

07/13/2023-00:28:30.522335 www.google.com[]/[]BlackSun[**]192.168.1.156:54946 → 142.250.72.100:80

07/13/2023-00:28:30.522335 www.google.com[]/[]BlackSun[**]192.168.1.156:54946 → 142.250.72.100:80

07/13/2023-00:29:23.092861 us.archive.ubuntu.com[]/ubuntu/dists/jammy/InRelease[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:57852 → 91.189.91.38:80

07/13/2023-00:29:29.094606 us.archive.ubuntu.com[]/ubuntu/dists/jammy/InRelease[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:57870 → 91.189.91.38:80

07/13/2023-00:29:51.300156 security.ubuntu.com[]/ubuntu/dists/jammy-security/InRelease[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:57858 → 91.189.91.38:80

07/13/2023-00:30:40.234041 us.archive.ubuntu.com[]/ubuntu/dists/jammy/InRelease[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:57870 → 91.189.91.38:80

07/13/2023-00:31:12.045508 security.ubuntu.com[]/ubuntu/dists/jammy-security/InRelease[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:57858 → 91.189.91.38:80

07/13/2023-00:31:12.045858 us.archive.ubuntu.com[]/ubuntu/dists/jammy/InRelease[]Debian APT-HTTP/1.3 (2.4.8) non-interactive[**]192.168.1.156:57852 → 91.189.91.38:80

I am not sure when it comes to iptables what the setup should look like. Perhaps someone else that knows about the sort of configuration you have will chime in.

JT

I changed my rules to this:

iptables -t mangle -A PREROUTING --s 0/0 -j TEE --gateway 192.168.1.156
iptables -t mangle -A POSTROUTING -s 192.168.0.0/24 -j TEE --gateway 192.168.1.156

And my VM is running in promiscuous mode, so I am seeing a lot of traffic on the VM, but not sure if it all is being reflected in eve.json…

Would this maybe have anything to do with the fact that in the router the 5g/2.5g is eth0.2 but in the VM with Suricata the network is enp0s3 in ifconfig? SHould I change suricata.yaml to eth0 or en0 instead of enp0s3 (my LAN is called “en0” under IFCONFIG On my home laptop)? Should I change my VM to en0 instead of enp0s3?

I would start with trying to see if the curl command that you trigger shows up in the flow events in the EVE JSON output. Once we see that, we know that Suricata actually sees that traffic and can debug why the alert does not trigger.