IDS/IPS Recommendation (Snort vs Suricata)

rnewman

Hello,

I am deploying an SG4200 appliance for a client and want to ad IDS/IPS. I know there is Snort and Suricata. My understanding is that Snort 3 is multi-threaded whereas Snort 2 in single-threaded. When I check for the package in Package Manager it shows version 4.1.10 but dependencies are 2.9.20_9. On the official Snort website, I only see Snort 3 as available.

Is it safe to assume that the Snort version that will be installed thru Package Manager is v2?
If so, has anyone used Suricata and what are your thoughts of it compared to Snort?

SteveITS

@rnewman Snort 3 is only available in the new Nexus GUI.

A package version number in pfSense is not related to the underlying software versions.

We have used Suricata for a long time. It is fine. As I recall Snort had a bug on ARM devices many years back so we had switched, and just kept using Suricata. I can provide a few config tips if desired, but overall operation is basically the same, and the same person (bmeeks) had maintained both packages for many years.

bmeeks

Currently the Snort package available for pfSense CE uses the 2.9.x upstream Snort binary (the quite old single-threaded code). I maintained that package for years, but retired from that duty last year. Netgate decided to create a Snort3 package (the multi-thread binary), but so far that new version is only available on pfSense Plus with the Nexus package enabled.

Suricata on pfSense (both CE and Plus) is- and always has been- multi-threaded. But that package also no longer has an active maintainer for pfSense. That means updates will lag, and it's likely new features introduced upstream by Suricata will not get back ported into the GUI configuration code used on pfSense.

Note that neither Snort nor Suricata come with any type of GUI interface. Both are command-line only tools. But on pfSense, a PHP GUI wrapper was created to provide easy control of the configuration parameters. That GUI PHP code must stay in step with any significant changes in the underlying binary component that provides the actual IDS/IPS functionality. Without an active maintainer for the package, the PHP GUI code slowly slips "out of sync" with the updated binary component pulled in from upstream. That can lead to occasional breakage.

rnewman

@SteveITS thanks for the info. That confirms what I found online but wanted t make sure.

@bmeeks thank you for all that. Currently we dont have Nexus for this client but that is something I am going to look into for future clients. Since Suricata no longer has an active maintainer, would it still be wise to continue using it? I just got it installed but havent set anything up yet except creating the Snort/MaxMind accounts.

bmeeks

@rnewman said in IDS/IPS Recommendation (Snort vs Suricata):

Since Suricata no longer has an active maintainer, would it still be wise to continue using it? I just got it installed but havent set anything up yet except creating the Snort/MaxMind accounts.

Well, at least on CE, Snort has no package maintainer either. So, there is risk with depending on either package on CE at the moment. That does not mean the package won't work. It just means updates may become few and far between including even security hot fixes.

Personally I've found that without MITM interception, all the encryption used by default on Internet traffic today (and most intranet traffic as well) significantly neuters an IPS/IDS. Remember the IDS can't peer into encrypted payloads. It can look at header stuff (at least until encrypted SNI takes over), and it can look at the early stages of key exchange sequences, but it can't see the payload itself unless you intercept and terminate the encryption, decrypt the payload, then re-encrypt the payload and send it on to the intended destination. This obviously breaks the chain of trust and so requires that you have admin access to client devices such that you can install your own trusted certificates on them.

rnewman

@bmeeks got it, thanks for that info. It is much appreciated.

@SteveITS if you can provide those configuration tips, that would be great. DM is good with me since I will go ahead and mark this thread as solved.

SteveITS

@rnewman Thanks for the reminder. I can list them here. Apologies as they are brief.

On a new install, do not enable blocking right away, instead monitor alerts for a while to look for false positives
restart Snort/Suricata to apply changes
check "Disable hardware checksum offload" in (System->Advanced->Networking) (https://docs.suricata.io/en/suricata-7.0.2/performance/packet-capture.html#offloading; Legacy=PCAP, Inline=NETMAP)
set up on LAN interface (not the default WAN) to 1) avoid checking packets the firewall will block anyway, and 2) alerts will show LAN IPs
uncheck "Enable HTTP Log" on the interface or it will log all HTTP requests (to be clear, not HTTPS)
Suricata: disable categories via dropsid.conf because categories are always re-enabled at every reinstall/upgrade. “Events” rules are intended to be informative not blocking. Disable the stream-events.rules category or it will block lots of traffic on false positives. Consider disabling all *events categories.
To do so add disable-sid.conf file on SID Mgmt tab and assign to “Disable SID List”:

# Example of modifying state for specific categories entirely.
# "snort_" limits to Snort VRT rules, "emerging-" limits to 
# Emerging Threats Open rules, "etpro-" limits to ET-PRO rules.
# "shellcode" with no prefix would match in any vendor set.
# snort_web-iis,emerging-shellcode,etpro-imap,shellcode

stream-events.rules,quic-events.rules

Check “Enable Automatic SID State Management” on SID tab (top of page)
on Log Mgmt tab ensure log rotation is enabled and "Enable Directory Size Limit" is checked
if using RAM disk set log limit to 20% or less of /var RAM disk size (or at least ensure it doesn't fill it)
ET Policy and ET Info categories are also more informative than blocking.

Every once in a while they will add a rule that blocks things you want. Earlier this year they added a rule which disconnected all our ScreenConnect agents for example. So just keep an eye out, or if something suddenly doesn't work, check the alerts/blocks.

rnewman

@SteveITS awesome thanks for this. I would like to mention that I do have multiple VLANs configured for the client (see below).

VLAN1: management VLAN for all equipment /27
VLAN20: client network /24
VLAN21: guest network /27
VLAN30: VoIP network /28

Should I enable for each interface except for the guest network? Some of the security stuff is new to me so any info you can provide would be great. I am more than capable of finding stuff online or opening another thread, but enought o get me going would be great. Mind you I do have the Snort Community, ETOpen Free, Feodo Tracker, ABUSE.ch, and Maxmind GeoIP free rules installed.

SteveITS

@rnewman IDS doesn't see VLAN tags so if you enable it on the parent interface it will apply to all VLANs.