# IDS/IPS and Network Monitoring

## Suricata (recommended over Snort)

Multi-threaded, uses all cores. Supports DPI, protocol decoding, file extraction. IDS/IPS/NSM modes.

Snort is single-threaded, sequential packet checking, bottleneck on modern hardware.

Deployment: start in IDS mode, tune for a week, review alerts, then enable IPS incrementally.

Guide: https://homeprivacynetwork.com/blog/featured/deploying-open-source-ids-ips-suricata-snort-zeek-in-a-home-environment/

## Zeek (formerly Bro)

Event-driven network analysis. Multi-process with worker nodes. Produces structured logs (conn.log, dns.log, http.log, tls.log). Custom scripting language for detection.

Best practices:
- ~200 Mbps per worker (Suricata or Zeek)
- SSDs for log storage, sufficient RAM
- Disable unnecessary logs
- Ship to SIEM or data lake

References:
- Guide 2025: https://www.onlinehashcrack.com/guides/security-tools/zeek-network-security-monitor-guide-2025.php
- Operationalizing (PDF): https://zeek.org/wp-content/uploads/2025/03/MUC-2025-Operationalizing-Zeek-Deployments.pdf

## Security Onion

Bundles Suricata + Zeek + Elastic Stack. Free open-source SIEM/IDS.

Hardware requirements:
- CPU: ~200 Mbps per worker. 1 Gbps = 10 cores minimum
- RAM: 16 GB min, 64 GB+ recommended with full PCAP
- Storage: 1 TB+ for PCAP retention, SSDs for ES indices
- NICs: minimum 2 (management + sniffing via TAP/SPAN)

Docs: https://docs.securityonion.net/en/2.4/introduction.html

## Arkime (Full Packet Capture)

Open-source large-scale PCAP, indexing, and database system.
- Capture (C app): monitors interfaces, writes PCAP, sends metadata to OpenSearch/ES
- Viewer (Node.js): web interface per capture machine (port 8005)
- Config: /opt/arkime/etc/config.ini

- Site: https://arkime.com/
- GitHub: https://github.com/arkime/arkime

## RITA (Beacon Detection)

Framework for detecting C2 via network traffic analysis. Works on Zeek logs.

Detects:
- Periodic heartbeat patterns (beaconing)
- DNS tunneling
- Long persistent connections
- Large outbound transfers (data exfil)
- Known malicious IPs

- GitHub: https://github.com/activecm/rita
- CISA: https://www.cisa.gov/resources-tools/services/rita
- Active CM: https://www.activecountermeasures.com/free-tools/rita/

## JA3/JA4 TLS Fingerprinting

### JA3
Hashes TLS ClientHello fields. MD5 produces 32-char fingerprint. Now unstable because modern browsers randomize extension order.

### JA4 (next-gen)
Sorts extensions before hashing. Survives extension permutation. Designed by FoxIO.

Use: detect inconsistencies (User-Agent says Chrome but TLS fingerprint matches Python/OpenSSL).

- Salesforce JA3: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/
- Cloudflare docs: https://developers.cloudflare.com/bots/additional-configurations/ja3-ja4-fingerprint/

## DNS Analytics for C2 Detection

- DGA detection: high-entropy domains, anomalous query frequency
- DNS tunneling: encoding in TXT/CNAME, unusual record types, high entropy labels
- Beaconing: periodic queries to external domains
- Passive DNS: historical record tracking

- FIRST.org beacons: https://www.first.org/global/sigs/dns/stakeholder-advice/detection/dns-beacons-c2-communication
- Passive DNS for C2: https://cybersecuritynews.com/how-to-use-passive-dns-to-trace-hackers-command-and-control-infrastructure/

## Flow Analysis (NetFlow, sFlow, IPFIX)

- NetFlow: Cisco, maintains flow cache
- sFlow: sampled packets, near real-time, no cache, more scalable
- IPFIX: IETF standard, vendor-neutral, flexible templates

Tools: ntopng, nfdump/nfsen, GoFlow2, Elastiflow

Reference: https://networkthreatdetection.com/network-flow-analysis-netflow-sflow-ipfix/