iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To run Suricata as an intrusion prevention system (IPS) on Ubuntu, install the stable package, download rules with suricata-update, validate the YAML configuration, then place Suricata inline with either NFQUEUE or AF_PACKET IPS mode. NFQUEUE is normally the practical choice when Ubuntu already routes traffic and enforces firewall policy. AF_PACKET is better for a transparent appliance with two dedicated network interfaces. In both designs, prevention is not proven until you observe a matching rule and a drop or reject action in Suricata’s event logs.
What changes when Suricata runs as an IPS
Suricata can inspect packets and generate alerts without being in the traffic path. That is an intrusion detection system (IDS) deployment. An IPS deployment adds an inline decision: a rule can allow traffic to continue, or a rule with a prevention action can drop or reject the packet. The inline design therefore determines whether Suricata can block traffic, how traffic reaches the engine, and what happens if the engine or its rule path fails.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe two Linux designs covered here are:
| Design | Placement | How packets reach Suricata | Hardware | Best fit |
|---|---|---|---|---|
| NFQUEUE | Layer 3, integrated with the host firewall | iptables or nftables sends selected packets to a queue; Suricata returns an allow or drop decision | No additional interface is inherently required | A routed Ubuntu host where you want to select INPUT, OUTPUT or FORWARD traffic |
| AF_PACKET IPS | Layer 2, transparent inline path | Suricata copies packets from one interface to the other when copy-mode: ips is enabled |
Two dedicated interfaces connected between the network segments | A bridge-like appliance that must inspect traffic without relying on host firewall forwarding rules |
Do not enable both paths for the same traffic while learning the setup. Choose one forwarding model, document its rollback, and test it during a maintenance window.
Prerequisites and a safe change plan
- An Ubuntu system with administrative access and a supported network interface driver.
- A maintenance window if the host carries production traffic. Inline changes can interrupt connectivity.
- A written rollback command that removes queue rules before stopping Suricata in an NFQUEUE deployment.
- Permission to generate or replay the traffic used for validation. Do not test blocking against systems or networks you do not control.
- For AF_PACKET IPS, two interfaces that can be dedicated to the inline path. Confirm their names with
ip link; names such asenp1s0andenp2s0are examples, not assumptions.
Record the current firewall rules before changing them. For iptables, save a copy with sudo iptables-save > ~/iptables-before-suricata.rules and, on a dual-stack host, also save sudo ip6tables-save > ~/ip6tables-before-suricata.rules. The files are a recovery aid; they do not replace a tested rollback procedure.
#1 Best Overall
- 𝐇𝐢𝐠𝐡-𝐒𝐩𝐞𝐞𝐝 𝐔𝐒𝐁 𝐄𝐭𝐡𝐞𝐫𝐧𝐞𝐭 𝐀𝐝𝐚𝐩𝐭𝐞𝐫 - UE306 is a USB 3.0 Type-A to RJ45 Ethernet adapter that adds a reliable wired network port to your laptop, tablet, or Ultrabook. It delivers fast and stable 10/100/1000 Mbps wired connections to your computer or tablet via a router or network switch, making it ideal for file transfers, HD video streaming, online gaming, and video conferencing.
- 𝐔𝐒𝐁 𝟑.𝟎 𝐟𝐨𝐫 𝐅𝐚𝐬𝐭𝐞𝐫, 𝐌𝐨𝐫𝐞 𝐒𝐭𝐚𝐛𝐥𝐞 𝐃𝐚𝐭𝐚 𝐓𝐫𝐚𝐧𝐬𝐟𝐞𝐫𝐬- Powered via USB 3.0, this adapter provides high-speed Gigabit Ethernet without the need for external power(10/100/1000Mbps). Backward compatible with USB 2.0/1.1, it ensures reliable performance across a wide range of devices.
- 𝐒𝐮𝐩𝐩𝐨𝐫𝐭𝐬 𝐍𝐢𝐧𝐭𝐞𝐧𝐝𝐨 𝐒𝐰𝐢𝐭𝐜𝐡- Easily connect your Nintendo Switch to a wired network for faster downloads and a more stable online gaming experience compared to Wi-Fi.
- 𝐏𝐥𝐮𝐠 𝐚𝐧𝐝 𝐏𝐥𝐚𝐲- No driver required for Nintendo Switch, Windows 11/10/8.1/8, and Linux. Simply connect and enjoy instant wired internet access without complicated setup.
- 𝐁𝐫𝐨𝐚𝐝 𝐃𝐞𝐯𝐢𝐜𝐞 𝐂𝐨𝐦𝐩𝐚𝐭𝐢𝐛𝐢𝐥𝐢𝐭𝐲- Supports Nintendo Switch, PCs, laptops, Ultrabooks, tablets, and other USB-powered web devices; works with network equipment including modems, routers, and switches.
Install Suricata and inspect the build
The Open Information Security Foundation (OISF) quickstart uses the stable Ubuntu PPA. Run the package steps in this order:
sudo apt-get install software-properties-commonsudo add-apt-repository ppa:oisf/suricata-stablesudo apt updatesudo apt install suricata jq
jq is useful for reading Suricata’s JSON event log. Before changing configuration, capture the installed version and service state:
suricata --version
suricata --build-info
sudo systemctl status suricata --no-pagersuricata --build-info is especially important for NFQUEUE. The output must show NFQ support; a configuration that sends packets to NFQUEUE cannot work if the installed binary was built without that capability. Also note the interface names and whether NetworkManager, netplan or another service owns their addresses, because an AF_PACKET appliance should not have ordinary host addressing on the transit ports unless your design explicitly requires it.
Install and manage the detection rules
Suricata’s signatures are its rules. The official management utility is suricata-update. Run:
sudo suricata-updateThe resulting rule files are installed under /var/lib/suricata/rules; the standard rule file is /var/lib/suricata/rules/suricata.rules. The main YAML file normally references that path. Confirm the file exists and has a recent timestamp:
sudo ls -l /var/lib/suricata/rules/suricata.rules
sudo grep -n 'default-rule-path|rule-files' /etc/suricata/suricata.yamlA rule that only has an alert action records a match but does not block it. Prevention requires a rule whose action is intended to drop or reject traffic, and the selected inline mode must be able to enforce that action. Do not assume that every downloaded signature is a blocking rule.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Validate YAML and IPS capabilities before sending traffic
Run a configuration test before inserting any firewall queue or connecting an inline cable:
Rank #2
- Connects a USB 3.0 device (computer/laptop) to a router, modem, or network switch to deliver Gigabit Ethernet to your network connection. Does not support Smart TV or gaming consoles (e.g.Nintendo Switch).
- Supported features include Wake-on-LAN function, Green Ethernet & IEEE 802.3az-2010 (Energy Efficient Ethernet)
- Supports IPv4/IPv6 pack Checksum Offload Engine (COE) to reduce Cental Processing Unit (CPU) loading
- Compatible with Windows 8.1 or higher, Mac OS
sudo suricata -T -c /etc/suricata/suricata.yamlA successful test reports that the configuration loaded and rules were parsed. Fix every error before proceeding. Common causes include an incorrect indentation level in YAML, a rule path that does not exist, an interface name copied from another host, or an option unsupported by the installed Suricata version.
For NFQUEUE, check the build again and retain the output for change records:
suricata --build-infoFor AF_PACKET, validate that each interface exists and is up or can be brought up without an address conflict:
ip link show
sudo ip link set dev enp1s0 up
sudo ip link set dev enp2s0 upReplace the example names with the actual transit interfaces. Do not run the interface commands on a production port until you understand how Ubuntu’s network manager will react.
Choose NFQUEUE or AF_PACKET IPS mode
When NFQUEUE is the better choice
NFQUEUE fits a routed host. The existing firewall decides which INPUT, OUTPUT or FORWARD packets are inspected, so you can start with a narrow scope and expand it. This makes staged deployment and rollback straightforward, but it also means you must cover both address families and every relevant chain. IPv4 iptables rules do not automatically inspect IPv6; use matching ip6tables or nftables rules for IPv6 traffic.
When AF_PACKET IPS is the better choice
AF_PACKET IPS fits a transparent inline device. Suricata receives traffic on one dedicated interface and copies it to the other. The OISF guide describes this as a mode in which the interfaces only need to be up; Suricata performs the packet copying. No iptables or nftables forwarding rule is needed for the transit path. The trade-off is physical: a single-interface host cannot provide this two-port path without adding another suitable interface.
Decision checklist
- Choose NFQUEUE if Ubuntu already owns routing and you need to select traffic by firewall chain, address, protocol or interface.
- Choose AF_PACKET if Suricata will sit transparently between two network segments and you can dedicate two interfaces.
- Prefer NFQUEUE when a narrow initial scope and an explicit firewall rollback are more important than transparent placement.
- Prefer AF_PACKET when you need Layer 2 insertion and do not want to build forwarding policy around the inspection host.
- In either mode, define what should happen when Suricata stops. A fail-open path preserves connectivity but can bypass prevention; a fail-closed path preserves enforcement but can become an outage.
Configure NFQUEUE inline IPS
1. Start Suricata on the selected queue
Queue number 0 is an example. It must match the queue number used by your firewall:
Recommended Free Tools
Rank #3
- Ultra-Fast, Rock-Solid: The UGREEN usb to ethernet adapter is engineered for ultra-fast 1000Mbps network speeds. It delivers rock-solid stability and security, helping you boost productivity, unleash smooth gameplay, and browse seamlessly
- Seamless Compatibility with Nintendo Switch: The ethernet to usb adapter is fully compatible with Nintendo Switch and Switch OLED, just connect it to the dock’s ethernet port and dive into ultra-smooth, lag-free gaming
- Plug and Play: The ethernet adapter is driver-free for Windows 11/10/8.1/8, macOS, Chrome OS, and Android. It requires installing the driver on Windows XP/7/Vista and Linux, which you can easily install with our instructions
- Wide Compatibility: The usb to ethernet is compatible with most laptops and desktops featuring USB 3.0 ports, including MacBook Air/Pro, Dell XPS, Surface Book, and more
- Crafted to Last, Designed to Impress: Built with a sturdy aluminum shell for efficient heat dissipation and enhanced durability, the ethernet to usb is designed to last. The cable connection point features reinforced construction for extra strength and reliability. A yellow-green LED indicator keeps you instantly informed of its working status
sudo suricata -c /etc/suricata/suricata.yaml -q 0Use a supervised service for production rather than leaving an interactive process unattended. The exact service arguments depend on the Ubuntu package and your local service definition, so inspect the unit and its effective command line with systemctl cat suricata before changing it. If the unit does not pass the queue option, a service restart alone will not create an NFQUEUE consumer.
2. Insert narrowly scoped firewall rules
Send only the traffic you intend to inspect at first. The following examples queue all traffic in each chain and are useful only as a lab illustration; production rules should normally constrain interface, source, destination or protocol:
sudo iptables -I INPUT 1 -j NFQUEUE --queue-num 0
sudo iptables -I OUTPUT 1 -j NFQUEUE --queue-num 0
sudo iptables -I FORWARD 1 -j NFQUEUE --queue-num 0A narrower example for forwarded traffic is:
sudo iptables -I FORWARD 1 -i enp1s0 -o enp2s0 -p tcp --dport 443 -j NFQUEUE --queue-num 0Mirror the logic with ip6tables for IPv6 if that traffic is in scope. With nftables, the equivalent concept is a queue rule in the appropriate inet table and chain; the queue number still has to match Suricata’s -q value. Keep the rule’s position in mind: inserting it before an accept rule is different from appending it after traffic has already been accepted.
3. Plan the stop and rollback order
Do not stop Suricata while packets are still being sent to its queue. The OISF inline guidance warns that doing so can interrupt connectivity. Remove or disable the NFQUEUE rules first, verify that normal firewall processing has resumed, and only then stop the process:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →sudo iptables -D INPUT -j NFQUEUE --queue-num 0
sudo iptables -D OUTPUT -j NFQUEUE --queue-num 0
sudo iptables -D FORWARD -j NFQUEUE --queue-num 0
sudo systemctl stop suricataWhen the original rules included interface or protocol matches, delete the exact same specifications rather than the simplified examples above. If you use nftables, delete the corresponding queue rules or flush the temporary chain before stopping Suricata.
Configure AF_PACKET IPS inline
1. Prepare the two transit ports
Connect one interface to the upstream network and the other to the protected segment. Use stable interface names and ensure both ports are administratively up. Keep management access on a separate interface whenever possible; otherwise, an incorrect transit configuration can lock you out of the host.
2. Set the AF_PACKET section
Edit /etc/suricata/suricata.yaml. The following structure shows the required relationship; replace the interface names with your two dedicated ports:
Rank #4
- Exploring the New Era of 2.5Gb: The UGREEN usb to ethernet adapter supports a internet speed of up to 2.5Gb and enables your devices to run at full speed. Enjoy unbelievably fast downloads with NAS, fluent streaming, immersive gaming
- Faster, Smoother, Cooler Realtek Chip: The ethernet to usb is equipped with an updated RTL8156BG chip, ensure the network always at peak run. When running 2.5Gb at full speed, it consumes low power, reduce heat dissipation and provide stable performance
- Flexibiliy Upgrade 1Gb to 2.5Gb: Immediately upgrade your 1Gb network, just pair it with 2.5Gb-capable devices like switches and routers to give your aged devices new life! This flexibility is an advantage for you transitioning to higher-speed network
- Instantly Add a 2.5Gb Ethernet Connection: Designed for modern USB laptops that no longer include an Ethernet port. Get fast, stable wired internet whenever Wi-Fi or Gigabit isn't enough
- Sleek, Strong, Stunning: The ethernet adapter for laptop adopts high-quality aluminum. The ports are resistant to plugging and unplugging and the reinforced design makes it very durable for use. Indicator lights make transmission status clear at a glance
af-packet:
- interface: enp1s0
copy-mode: ips
copy-iface: enp2s0
- interface: enp2s0
copy-mode: ips
copy-iface: enp1s0Each interface points to the other with copy-iface, and both entries use copy-mode: ips. AF_PACKET IPS does not use iptables or nftables forwarding rules to perform the copy, so adding NFQUEUE rules at the same time can create duplicate inspection paths or unexpected loops.
3. Validate before cabling production traffic
Run sudo suricata -T -c /etc/suricata/suricata.yaml, then inspect the log while bringing up a controlled link. If the configuration references an interface that does not exist, Suricata will fail to initialize that capture method. If the physical connection is reversed, the engine may be healthy while traffic travels in an unexpected direction, so label both ports and verify the path with counters on each side.
Start, restart and observe the engine
After changing rules or YAML, restart the service during the approved window:
sudo systemctl restart suricata
sudo systemctl status suricata --no-pagerInspect the primary log:
sudo tail -f /var/log/suricata/suricata.logThe quickstart’s expected final initialization message indicates that packet-processing and management threads have initialized and the engine has started. A running systemd process by itself is not proof of inspection; the capture method can still be misconfigured or receive no packets.
Watch counters in stats.log:
sudo tail -f /var/log/suricata/stats.logLook for packet-receive and decoder counters that increase while you generate known, authorized traffic. A counter that remains at zero points to the capture path, interface selection or firewall queue placement rather than a missing signature.
Suricata’s EVE JSON output is the most useful event stream for verification. It commonly resides at /var/log/suricata/eve.json. Use jq to read recent alerts:
sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type == "alert")'Check the configured EVE outputs if that file is absent. The YAML may disable alerts, use a different filename, or write only selected event types.
Best Value
![BENFEI USB 3.0 to Ethernet Adapter, USB C to RJ45 Gigabit LAN (1000Mbps) Network Adapter, Compatible with MacBook/Pro/Air, Surface Pro, Windows 11/10/8/7, Mac OS [Aluminium Shell&Nylon Cable]](https://m.media-amazon.com/images/I/41fk9DHmdwL._SL160_.jpg)
- COMPACT DESIGN - The compact-designed portable BENFEI USB A/C to Ethernet adapter connects your computer or tablet to a router,modem or network switch for network connection. It adds a standard RJ45 port to your Ultrabook, notebook or Macbook Air for file transferring, video conferencing, gaming, and HD video streaming.
- SUPERIOR STABILITY - Built-in advanced IC chip works as the bridge between RJ45 Ethernet cable and your USB A/C devices. The driver-free installation with native driver support in Chrome, Mac, and Windows OS; The USB A/C Ethernet adapter dongle supports important performance features including Wake-on-Lan (WoL), Full-Duplex (FDX) and Half-Duplex (HDX) Ethernet, Crossover Detection, Backpressure Routing, Auto-Correction (Auto MDIX).
- INCREDIBLE PERFORMANCE - Supports full 10/100/1000Mbps gigabit ethernet performance over USB A/C's 5Gbps bus, faster and more reliable than most wireless connections. Link and Activity LEDs. USB powered, no external power required. Backward compatible with USB 2.0/1.1.✅ To reach 1Gbps, make sure to use CAT6 & up Ethernet cables.
- BROAD COMPATIBILITY - The USB A/C-Ethernet adapter is compatible with Windows 11/10/8.1/8/7/Vista/XP, Mac OSX 10.6/10.7/10.8/10.9/10.10/10.11/10.12, Linux kernel 3.x/2.6, Android and Chrome OS.Compatible with IEEE 802.3, IEEE 802.3u and IEEE 802.3ab. Supports IEEE 802.3az (Energy Efficient Ethernet).❌Do Not Support Windows RT. (NOT compatible with Nintendo Switch.)
- 18 MONTH WARRANTY - Exclusive BENFEI Unconditional 18-month Warranty ensures long-time satisfaction of your purchase; Friendly and easy-to-reach customer service to solve your problems timely.
Prove that prevention, not just detection, works
Use an authorized, controlled test
Schedule a maintenance window and select a test signature or controlled traffic pattern approved for your environment. The available Suricata documentation explains operation and logging but does not define one universal safe payload or a performance benchmark. Choose a test that your team understands and that will not damage a service.
Verify all three parts of the result
- Confirm packet counters increase in
stats.log, proving that the selected interface or queue is receiving traffic. - Confirm an EVE alert identifies the test rule and the source and destination you expected.
- Confirm the event records the intended drop or reject action and that the receiving application observes the blocked connection.
An alert without a drop action demonstrates detection only. A drop event with no corresponding traffic interruption may indicate that the test traveled outside the inline path, matched a different rule, or was generated after the connection had already been established. Repeat the check with a new connection and correlate timestamps across Suricata and the application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Test the rollback immediately afterward
For NFQUEUE, remove the queue rules and confirm normal connectivity before stopping Suricata. For AF_PACKET, use the documented physical bypass or maintenance wiring plan for your appliance. Record the exact commands and the observed recovery time so another administrator can execute them under pressure.
Troubleshoot common failure modes
Suricata exits during startup
- Run the configuration test and read the first YAML or rule-file error rather than the final service failure message.
- Check that every path in
suricata.yamlexists and that the service account can read it. - Confirm interface names with
ip link; predictable names differ between Ubuntu installations. - Review
sudo journalctl -u suricata -bfor permissions, capability and service-argument errors.
NFQUEUE traffic stalls or the host loses connectivity
- Check that
suricata --build-inforeports NFQ support. - Verify the firewall queue number equals the value passed with
-q. - Check whether packets are being queued before Suricata started. Remove those rules first if you need to stop the engine.
- Temporarily remove the queue rules using the exact rollback commands and confirm that ordinary firewall policy works again.
- Inspect both IPv4 and IPv6 policy; an unhandled family can make the symptom appear intermittent.
AF_PACKET starts but no packets are seen
- Confirm both transit ports are up and connected to the intended segments.
- Check the YAML indentation and that each
copy-ifacepoints to the opposite port. - Ensure no other bridge, bonding service or network manager profile is consuming the ports in a conflicting design.
- Compare interface counters with
ip -s linkwhile generating controlled traffic.
Alerts appear but traffic is not blocked
- Inspect the matched rule’s action. An
alertaction is not a prevention action. - Confirm Suricata is actually inline; a passive capture sees the same packets but cannot enforce a decision.
- Check EVE JSON for the action and verdict fields, then establish a fresh test connection.
- Make sure a separate firewall accept rule or an alternate route is not allowing the traffic around the inspection point.
Logs are empty or unreadable
- Check the logging and EVE sections of
/etc/suricata/suricata.yamlfor enabled outputs and correct paths. - Verify permissions and available disk space with
df -h. - Use
jqonly on JSON output; the human-readablesuricata.logrequires ordinary text tools such astailandgrep.
Operate the IPS after deployment
Update rules deliberately with sudo suricata-update, validate with sudo suricata -T -c /etc/suricata/suricata.yaml, and restart Suricata only after the test succeeds. Treat rule updates as changes: retain the previous rule file or package state, record the update time, and monitor alerts and packet counters after the restart.
Keep the firewall queue rules, AF_PACKET interface mapping, service arguments and rollback steps in the same change record. Review whether new IPv4 or IPv6 interfaces, routes or chains have bypassed inspection. Monitor disk usage because EVE JSON and statistics logs can grow quickly when verbose event types are enabled.
Do not claim a fixed throughput or packet-loss figure from this configuration alone. Capacity depends on the Ubuntu release, Suricata build, rule set, enabled decoders, traffic mix, CPU, memory, driver and interface hardware. Size and tune the host with measurements from your own authorized traffic, while preserving enough logging to prove that prevention remains active.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Operational checklist
- Install the stable package and capture
suricata --version, build information and service status. - Run
suricata-updateand verify/var/lib/suricata/rules/suricata.rules. - Pass
suricata -T -c /etc/suricata/suricata.yamlbefore every inline change. - Select exactly one inline architecture and document its failure behavior.
- For NFQUEUE, start the matching queue consumer before inserting narrowly scoped firewall rules.
- For AF_PACKET, dedicate two interfaces and configure reciprocal
copy-ifaceentries withcopy-mode: ips. - Observe
suricata.log,stats.logand EVE JSON after startup. - Use an authorized test to demonstrate both a matching alert and the expected drop or reject action.
- Exercise the rollback procedure and keep it accessible to the operator who will respond to an outage.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
