#IDS/IPS and Network Monitoring

#Suricata (recommended over Snort)

Multi-threaded, uses all cores. Supports DPI, protocol decoding, file extraction. IDS/IPS/NSM modes.

Snort is single-threaded, sequential packet checking, bottleneck on modern hardware.

Deployment: start in IDS mode, tune for a week, review alerts, then enable IPS incrementally.

Guide: https://homeprivacynetwork.com/blog/featured/deploying-open-source-ids-ips-suricata-snort-zeek-in-a-home-environment/

#Zeek (formerly Bro)

Event-driven network analysis. Multi-process with worker nodes. Produces structured logs (conn.log, dns.log, http.log, tls.log). Custom scripting language for detection.

Best practices:

• ~200 Mbps per worker (Suricata or Zeek)
• SSDs for log storage, sufficient RAM
• Disable unnecessary logs
• Ship to SIEM or data lake

References:

• Guide 2025: https://www.onlinehashcrack.com/guides/security-tools/zeek-network-security-monitor-guide-2025.php
• Operationalizing (PDF): https://zeek.org/wp-content/uploads/2025/03/MUC-2025-Operationalizing-Zeek-Deployments.pdf

#Security Onion

Bundles Suricata + Zeek + Elastic Stack. Free open-source SIEM/IDS.

Hardware requirements:

• CPU: ~200 Mbps per worker. 1 Gbps = 10 cores minimum
• RAM: 16 GB min, 64 GB+ recommended with full PCAP
• Storage: 1 TB+ for PCAP retention, SSDs for ES indices
• NICs: minimum 2 (management + sniffing via TAP/SPAN)

Docs: https://docs.securityonion.net/en/2.4/introduction.html

#Arkime (Full Packet Capture)

Open-source large-scale PCAP, indexing, and database system.

• Capture (C app): monitors interfaces, writes PCAP, sends metadata to OpenSearch/ES

• Viewer (Node.js): web interface per capture machine (port 8005)

• Config: /opt/arkime/etc/config.ini

• Site: https://arkime.com/

• GitHub: https://github.com/arkime/arkime

#RITA (Beacon Detection)

Framework for detecting C2 via network traffic analysis. Works on Zeek logs.

Detects:

• Periodic heartbeat patterns (beaconing)

• DNS tunneling

• Long persistent connections

• Large outbound transfers (data exfil)

• Known malicious IPs

• GitHub: https://github.com/activecm/rita

• CISA: https://www.cisa.gov/resources-tools/services/rita

• Active CM: https://www.activecountermeasures.com/free-tools/rita/

#JA3/JA4 TLS Fingerprinting

#JA3

Hashes TLS ClientHello fields. MD5 produces 32-char fingerprint. Now unstable because modern browsers randomize extension order.

#JA4 (next-gen)

Sorts extensions before hashing. Survives extension permutation. Designed by FoxIO.

Use: detect inconsistencies (User-Agent says Chrome but TLS fingerprint matches Python/OpenSSL).

• Salesforce JA3: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967/
• Cloudflare docs: https://developers.cloudflare.com/bots/additional-configurations/ja3-ja4-fingerprint/

#DNS Analytics for C2 Detection

• DGA detection: high-entropy domains, anomalous query frequency

• DNS tunneling: encoding in TXT/CNAME, unusual record types, high entropy labels

• Beaconing: periodic queries to external domains

• Passive DNS: historical record tracking

• FIRST.org beacons: https://www.first.org/global/sigs/dns/stakeholder-advice/detection/dns-beacons-c2-communication

• Passive DNS for C2: https://cybersecuritynews.com/how-to-use-passive-dns-to-trace-hackers-command-and-control-infrastructure/

#Flow Analysis (NetFlow, sFlow, IPFIX)

• NetFlow: Cisco, maintains flow cache
• sFlow: sampled packets, near real-time, no cache, more scalable
• IPFIX: IETF standard, vendor-neutral, flexible templates

Tools: ntopng, nfdump/nfsen, GoFlow2, Elastiflow

Reference: https://networkthreatdetection.com/network-flow-analysis-netflow-sflow-ipfix/