IDS and IPS rules on LAN

Rule Signatures
, , ,
1

Hi,

I’m interesting to do IDS and IPS on the inside of my network using Suricata. I have trouble of as an exampe of detecting nmap scans and having a look at the example rule below:
alert tcp $EXTERNAL_NET any → $HOME_NET any (msg:“ET SCAN NMAP -sS window 1024”; fragbits:!D; dsize:0; flags:S,12; ack:0; window:1024; threshold: type both, track by_dst, count 1, seconds 60; reference:url,Emerging Threats; classtype:attempted-recon; sid:2009582; rev:3; metadata:created_at 2010_07_30, updated_at 2010_07_30;)

Since the flow is $EXTERNAL_NET object to $HOME_NET object, how would it be best configured so that I trigger and IDS alert on rules as such (I assume there are loads of rules with similar flow)?

I will not get flooded with alerts since I do not run IDS on WAN, only on LAN subnets (everything incoming on WAN is anyways blocked, LAN is more open).

Thanks alot!

1 Like
2

Hi!
I believe the easiest option for this scenario would be to set your $EXTERNAL_NET definition in your suricata.yaml to any.

JT

1 Like