<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div dir="ltr"><span>Excuse me, I guess my question is not correct but I'm a nongeek in this field. If possible, Please guide me.</span></div><div dir="ltr"><span><br></span></div><div dir="ltr" id="yui_3_16_0_1_1420288202045_16537"><span>Cheers.</span></div> <div class="qtdSeparateBR"><br><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div style="font-family: HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif; font-size: 16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Tuesday, December 23, 2014 11:45 PM, Jason Long <hack3rcon@yahoo.com> wrote:<br> </font> </div> <br><br> <div class="y_msg_container"><div id="yiv4906661399"><div><div style="color:#000;background-color:#fff;font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"><div dir="ltr" id="yiv4906661399yui_3_16_0_1_1419407032939_2892"><span>Thank you so much.</span></div><div dir="ltr" id="yiv4906661399yui_3_16_0_1_1419407032939_2891"><span id="yiv4906661399yui_3_16_0_1_1419407032939_2890">Excuse me, I'm a Nongeek and Can you show me some tutorials for launch Suricata-IDS in my Goal?</span></div> <div class="yiv4906661399qtdSeparateBR"><br clear="none"><br clear="none"></div><div class="yiv4906661399yqt3573984480" id="yiv4906661399yqt91676"><div class="yiv4906661399yahoo_quoted" style="display: block;"> <div style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"> <div style="font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px;"> <div dir="ltr"> <font size="2" face="Arial"> On Tuesday, December 23, 2014 10:14 PM, Leonard Jacobs <ljacobs@netsecuris.com> wrote:<br clear="none"> </font> </div> <br clear="none"><br clear="none"> <div class="yiv4906661399y_msg_container"><div id="yiv4906661399"><style>#yiv4906661399 --
filtered {font-family:Helvetica;panose-1:2 11 6 4 2 2 2 2 2 4;}
#yiv4906661399 filtered {font-family:Helvetica;panose-1:2 11 6 4 2 2 2 2 2 4;}
#yiv4906661399 filtered {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;}
#yiv4906661399 filtered {font-family:Tahoma;panose-1:2 11 6 4 3 5 4 4 2 4;}
#yiv4906661399
p.yiv4906661399MsoNormal, #yiv4906661399 li.yiv4906661399MsoNormal, #yiv4906661399 div.yiv4906661399MsoNormal
{margin:0in;margin-bottom:.0001pt;font-size:12.0pt;}
#yiv4906661399 a:link, #yiv4906661399 span.yiv4906661399MsoHyperlink
{color:blue;text-decoration:underline;}
#yiv4906661399 a:visited, #yiv4906661399 span.yiv4906661399MsoHyperlinkFollowed
{color:purple;text-decoration:underline;}
#yiv4906661399 p.yiv4906661399MsoAcetate, #yiv4906661399 li.yiv4906661399MsoAcetate, #yiv4906661399 div.yiv4906661399MsoAcetate
{margin:0in;margin-bottom:.0001pt;font-size:8.0pt;}
#yiv4906661399 p.yiv4906661399msoacetate, #yiv4906661399 li.yiv4906661399msoacetate, #yiv4906661399 div.yiv4906661399msoacetate
{margin-right:0in;margin-left:0in;font-size:12.0pt;}
#yiv4906661399 p.yiv4906661399msonormal, #yiv4906661399 li.yiv4906661399msonormal, #yiv4906661399 div.yiv4906661399msonormal
{margin-right:0in;margin-left:0in;font-size:12.0pt;}
#yiv4906661399 p.yiv4906661399msochpdefault, #yiv4906661399 li.yiv4906661399msochpdefault, #yiv4906661399 div.yiv4906661399msochpdefault
{margin-right:0in;margin-left:0in;font-size:12.0pt;}
#yiv4906661399 span.yiv4906661399msohyperlink
{}
#yiv4906661399 span.yiv4906661399msohyperlinkfollowed
{}
#yiv4906661399 span.yiv4906661399emailstyle17
{}
#yiv4906661399 span.yiv4906661399balloontextchar
{}
#yiv4906661399 p.yiv4906661399msonormal1, #yiv4906661399 li.yiv4906661399msonormal1, #yiv4906661399 div.yiv4906661399msonormal1
{margin:0in;margin-bottom:.0001pt;font-size:12.0pt;}
#yiv4906661399 span.yiv4906661399msohyperlink1
{color:blue;text-decoration:underline;}
#yiv4906661399 span.yiv4906661399msohyperlinkfollowed1
{color:purple;text-decoration:underline;}
#yiv4906661399 p.yiv4906661399msoacetate1, #yiv4906661399 li.yiv4906661399msoacetate1, #yiv4906661399 div.yiv4906661399msoacetate1
{margin:0in;margin-bottom:.0001pt;font-size:8.0pt;}
#yiv4906661399 span.yiv4906661399emailstyle171
{color:#1F497D;}
#yiv4906661399 span.yiv4906661399balloontextchar1
{}
#yiv4906661399 p.yiv4906661399msochpdefault1, #yiv4906661399 li.yiv4906661399msochpdefault1, #yiv4906661399 div.yiv4906661399msochpdefault1
{margin-right:0in;margin-left:0in;font-size:10.0pt;}
#yiv4906661399 span.yiv4906661399EmailStyle31
{color:#1F497D;}
#yiv4906661399 span.yiv4906661399BalloonTextChar
{}
#yiv4906661399 .yiv4906661399MsoChpDefault
{font-size:10.0pt;}
#yiv4906661399 filtered {margin:1.0in 1.0in 1.0in 1.0in;}
#yiv4906661399 div.yiv4906661399WordSection1
{}
#yiv4906661399 </style><div><div class="yiv4906661399WordSection1"><div class="yiv4906661399MsoNormal"><span style="font-size:11.0pt;">You can use the Suricata IPS anywhere in a network. </span></div><div class="yiv4906661399MsoNormal"><span style="font-size:11.0pt;"> </span></div><div class="yiv4906661399MsoNormal"><span style="font-size:11.0pt;">We don’t use our Suricata installations as gateways. In my opinion Suricata is not setup to be a gateway because it really does not route.</span></div><div class="yiv4906661399MsoNormal"><span style="font-size:11.0pt;"> </span></div><div class="yiv4906661399yqt7034474333" id="yiv4906661399yqt52856"><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;"><div class="yiv4906661399MsoNormal"><b><span style="font-size:10.0pt;">From:</span></b><span style="font-size:10.0pt;"> Jason Long [mailto:hack3rcon@yahoo.com] <br clear="none"><b>Sent:</b> Tuesday, December 23, 2014 11:35 PM<br clear="none"><b>To:</b> Leonard Jacobs; 'Menerick, John'; discussion@lists.openinfosecfoundation.org<br clear="none"><b>Subject:</b> Re: [Discussion] Ca I use Suricata in a local network?</span></div></div></div><div class="yiv4906661399MsoNormal"> </div><div><div id="yiv4906661399yui_3_16_0_1_1419399005682_4995"><div class="yiv4906661399MsoNormal" style="background:white;"><span style="">Thank you so much.</span></div></div><div id="yiv4906661399yui_3_16_0_1_1419399005682_4995"><div class="yiv4906661399MsoNormal" style="background:white;"><span style="">As I understand, I must use Suricata as a gateway. I have a Local network with 200 clients and my network is not large. I use TMG as a gateway and I want to know can I use Suricata in my local network and not as a Gateway ? Sorry, My question may funny but to be honest, I don't know any more about IPS.</span></div></div><div><div class="yiv4906661399MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style=""> </span></div></div><div><div><div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:10.0pt;">On Monday, December 22, 2014 9:16 AM, Leonard Jacobs <<a rel="nofollow" shape="rect" ymailto="mailto:ljacobs@netsecuris.com" target="_blank" href="mailto:ljacobs@netsecuris.com">ljacobs@netsecuris.com</a>> wrote:</span><span style=""></span></div></div><div class="yiv4906661399MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style=""> </span></div><div><div id="yiv4906661399"><div><div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:11.0pt;">You could also use Suricata setup to run in af-packet mode to perform IPS. I find it more efficient than using Suricata with Iptables for doing dropping of malicious packets. We have been using Af-Packet ips mode for a long time.</span><span style=""></span></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:11.0pt;"> </span><span style=""></span></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:11.0pt;"><a rel="nofollow" shape="rect" target="_blank" href="https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/">https://home.regit.org/2012/09/new-af_packet-ips-mode-in-suricata/</a> Don’t forget If you want to drop a packet then the signature needs to be changed from alert to drop.</span><span style=""></span></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:11.0pt;"> </span><span style=""></span></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:11.0pt;"><a rel="nofollow" shape="rect" target="_blank" href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Packet_Acquisition_API">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Packet_Acquisition_API</a></span><span style=""></span></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style="font-size:11.0pt;"> </span><span style=""></span></div></div><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in;"><div><div class="yiv4906661399MsoNormal" style="background:white;"><b><span style="font-size:10.0pt;">From:</span></b><span style="font-size:10.0pt;"> <a rel="nofollow" shape="rect" ymailto="mailto:discussion-bounces@lists.openinfosecfoundation.org" target="_blank" href="mailto:discussion-bounces@lists.openinfosecfoundation.org">discussion-bounces@lists.openinfosecfoundation.org</a> [<a rel="nofollow" shape="rect" ymailto="mailto:discussion-bounces@lists.openinfosecfoundation.org" target="_blank" href="mailto:discussion-bounces@lists.openinfosecfoundation.org">mailto:discussion-bounces@lists.openinfosecfoundation.org</a>] <b>On Behalf Of </b>Menerick, John<br clear="none"><b>Sent:</b> Monday, December 22, 2014 11:07 AM<br clear="none"><b>To:</b> Jason Long; <a rel="nofollow" shape="rect" ymailto="mailto:discussion@lists.openinfosecfoundation.org" target="_blank" href="mailto:discussion@lists.openinfosecfoundation.org">discussion@lists.openinfosecfoundation.org</a><br clear="none"><b>Subject:</b> Re: [Discussion] Ca I use Suricata in a local network?</span><span style=""></span></div></div></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style=""> </span></div></div><div><div class="yiv4906661399MsoNormal" style="background:white;"><span style=""><br clear="none">Yes, you can. How you do it depends on the scale of your local network, equipment, and other information technology challenges. <a rel="nofollow" shape="rect" target="_blank" href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux</a> is one such example. For instance, if you need to scale far beyond a linux router, then you will augment your blocking with remote calls into your network equipment to enact the change.<br clear="none"><br clear="none"><br clear="none">Warmly,<br clear="none"><br clear="none">John Menerick<br clear="none"><a rel="nofollow" shape="rect" ymailto="mailto:Security@NetSuite" target="_blank" href="mailto:Security@NetSuite">Security@NetSuite</a><br clear="none"><a rel="nofollow" shape="rect" target="_blank" href="http://www.securesql.info/">http://www.securesql.info</a><br clear="none"><br clear="none">-----Original Message-----<br clear="none">From: <a rel="nofollow" shape="rect" ymailto="mailto:discussion-bounces@lists.openinfosecfoundation.org" target="_blank" href="mailto:discussion-bounces@lists.openinfosecfoundation.org">discussion-bounces@lists.openinfosecfoundation.org</a> [<a rel="nofollow" shape="rect" ymailto="mailto:discussion-bounces@lists.openinfosecfoundation.org" target="_blank" href="mailto:discussion-bounces@lists.openinfosecfoundation.org">mailto:discussion-bounces@lists.openinfosecfoundation.org</a>] On Behalf Of Jason Long<br clear="none">Sent: Monday, December 22, 2014 2:44 AM<br clear="none">To: <a rel="nofollow" shape="rect" ymailto="mailto:discussion@lists.openinfosecfoundation.org" target="_blank" href="mailto:discussion@lists.openinfosecfoundation.org">discussion@lists.openinfosecfoundation.org</a><br clear="none">Subject: [Discussion] Ca I use Suricata in a local network?<br clear="none"><br clear="none">Hello Folks.<br clear="none">How are you?<br clear="none">Excuse me, I want to know can I use Suricata-IDS in a local network for blocked bad users in my network and prevent them to attack my servers? <br clear="none">Excuse me if my question is vague.<br clear="none"><br clear="none">Cheers.<br clear="none">_______________________________________________<br clear="none">Discussion mailing list<br clear="none"><a rel="nofollow" shape="rect" ymailto="mailto:Discussion@lists.openinfosecfoundation.org" target="_blank" href="mailto:Discussion@lists.openinfosecfoundation.org">Discussion@lists.openinfosecfoundation.org</a><br clear="none"><a rel="nofollow" shape="rect" target="_blank" href="https://lists.openinfosecfoundation.org/mailman/listinfo/discussion">https://lists.openinfosecfoundation.org/mailman/listinfo/discussion</a><br clear="none"><br clear="none"><br clear="none"></span><span style="font-size:7.5pt;">NOTICE: This email and any attachments may contain confidential and proprietary information of NetSuite Inc. and is for the sole use of the intended recipient for the stated purpose. Any improper use or distribution is prohibited. If you are not the intended recipient, please notify the sender; do not review, copy or distribute; and promptly delete or destroy all transmitted information. Please note that all communications and information transmitted through this email system may be monitored and retained by NetSuite or its agents and that all incoming email is automatically scanned by a third party spam and filtering service which may result in deletion of a legitimate e-mail before it is read by the intended recipient.</span><span style=""> </span></div></div></div></div></div><div class="yiv4906661399MsoNormal" style="margin-bottom:12.0pt;background:white;"><span style=""> </span></div></div></div></div></div></div></div></div></div></div><br clear="none"><br clear="none"></div> </div> </div> </div></div> </div></div></div><br><br></div> </div> </div> </div> </div></body></html>