How to Install Suricata on Ubuntu (Stable PPA, Rules, Interface Setup, and Testing)

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

Install Suricata on Ubuntu from the Open Information Security Foundation’s suricata-stable PPA, then configure the network interface, HOME_NET, and detection rules before starting the service. The complete installation is more than installing one package: Suricata must be able to see the traffic you want to inspect and must have rules that can generate alerts.

This guide takes you from a clean Ubuntu host to a verified sensor. It covers package installation, configuration validation, ET Open rule updates, live-log inspection, EVE JSON filtering, the documented controlled detection test, offline PCAP replay, upgrades, removal, and the differences between stable, debug, beta, and daily packages.

#	Preview	Product	Price
1		FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and...	$1,008.87	Buy on Amazon
2		WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)	$890.01	Buy on Amazon
3		Ubiquiti Unifi Security Appliance (USG), Single,White	$178.90	Buy on Amazon

What you are installing

Suricata is a network threat-detection engine. In an intrusion-detection deployment it captures packets from an interface, decodes the traffic, evaluates signatures (also called rules), and writes operational data and alerts to log files. A successful package installation does not prove that the sensor is seeing useful traffic; capture visibility, network definitions, and a populated ruleset determine whether detection works.

The commands below use Ubuntu’s APT tooling and the OISF suricata-stable PPA. The stable channel is the normal choice for a production sensor. The OISF quickstart also uses jq when showing how to filter EVE JSON at the shell.

#1 Best Overall

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

• HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 1 year of FortiCare Premium and FortiGuard Unified Threat Protection.
• UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
• OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
• RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
• EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.

$1,008.87

Buy on Amazon

How the pieces fit together

There are four separate dependencies to keep straight. APT installs the Suricata executable and its service unit. The YAML file tells the engine which networks are internal and which interface should provide packets. Rule files provide the signatures that can match suspicious content. Finally, systemd starts the process and the log files show whether it is actually processing traffic. Troubleshooting is easier when you test those dependencies in that order rather than treating “the service is running” as the entire installation.

Before you begin

Confirm administrative access and packet visibility

You need an account that can run sudo. Decide which Ubuntu network device Suricata should monitor and make sure that device can actually observe the traffic of interest. A sensor attached to a host’s ordinary interface may see that host’s traffic, while a sensor on a monitoring port or other network tap can see traffic from additional systems. Suricata cannot alert on packets that never reach its capture interface.

Write down the interface name and its address before editing the configuration. Device names such as enp1s0 are host-specific, so copying an interface value from an example or another server is a common cause of an apparently healthy but inactive sensor. If you plan to use a recorded PCAP for validation, keep its path available as well; offline replay is useful when live traffic is limited.

Understand the repository decision

The stable PPA is a third-party APT repository. Canonical’s Ubuntu repository guidance states: “Only add software repositories from sources that you trust.” Ubuntu also warns that PPAs are not checked by Ubuntu members for security or reliability. Review your organization’s repository policy and trust the source before enabling it.

The package channel is an operational choice, not just a download location. Stable packages reduce surprise changes for a production sensor. Beta and daily packages are useful for testing a particular upcoming change, but they can be unstable and require more validation. A source build gives you more control over compilation, while also making updates and repeatability your responsibility.

Install Suricata from the stable PPA

Run the following commands in order. The first package supplies the add-apt-repository helper, the second command enables the OISF stable channel, the third refreshes package metadata, and the final command installs Suricata.

1. sudo apt-get install software-properties-common
2. sudo add-apt-repository ppa:oisf/suricata-stable
3. sudo apt-get update
4. sudo apt-get install suricata

Read each APT prompt and confirm that the package source and release are the ones you intended. If you want to use the quickstart’s EVE JSON examples, install the JSON command-line filter separately:

sudo apt-get install jq

Do not enable beta or daily packages simply because they are newer. Those channels are intended for testing and can be unstable; choose them only when you have a specific development or troubleshooting reason.

APT may ask you to confirm dependencies or service behavior during installation. Record the package channel you selected so future administrators know whether the sensor is expected to follow stable updates or a test stream. Keeping that decision documented prevents an accidental switch between channels during later maintenance.

Verify the package and service

Check the compiled capabilities and the systemd unit immediately after installation:

sudo suricata --build-info
sudo systemctl status suricata

suricata --build-info reports build capabilities. systemctl status suricata shows whether the service is loaded, running, or stopped and displays recent service messages. A running service at this point is not yet proof of correct capture: the interface and rules still need to be configured and checked.

Use the build-information output as a baseline when diagnosing a later change. If a capability or capture method you expect is absent, resolve that package or build question before spending time tuning rules. The status command is a point-in-time view; the statistics and event logs below provide evidence of ongoing packet processing.

Find the interface and addresses

List interfaces and their addresses with:

ip addr

Record the exact device name (for example, enp1s0) and the addresses or local networks that should be treated as internal. Interface names are not interchangeable: the name in Suricata’s YAML must match the device reported by ip addr.

Look for the interface that carries the traffic you intend to inspect, not merely the interface with an address. A host can have several devices, and a monitoring interface may have little or no ordinary host traffic. The address and subnet information from this step is also what you use to define HOME_NET.

Configure HOME_NET and AF_PACKET capture

Set HOME_NET for your environment

Open /etc/suricata/suricata.yaml with your preferred editor. In the network variable section, set HOME_NET to include the address on the monitored interface and the local networks whose hosts should be considered internal. Use the address and subnet values that actually belong to this sensor; do not copy an example network from another installation. Correct HOME_NET classification affects how rules distinguish internal and external sides of a connection.

Review the resulting value whenever the host moves networks or the monitored segment changes. An incorrect internal-network definition can leave Suricata running while causing alerts to be classified with the wrong source and destination context. It is therefore a detection-quality setting, not a cosmetic label.

Match the AF_PACKET interface

In the af-packet section, make the interface name match the device you found with ip addr. The OISF quickstart’s basic IDS capture settings are:

af-packet:
  - interface: enp1s0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    tpacket-v3: yes

Replace enp1s0 with your real device name. Keep the YAML indentation intact. The remaining values select the documented flow-based packet clustering, defragmentation, and TPACKET v3 settings for this basic configuration.

Do not create a second, conflicting interface entry merely to make an example fit your host. Keep the active capture definition clear, and make sure the service’s configuration points to the same file you edited. If you later change interfaces, update the YAML and retest before restarting.

Rank #2

WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)

• WatchGuard Firebox T45 tabletop appliances bring enterprise-level network security to small office/branch office and retail environments. These appliances are small-footprint, cost-effective security powerhouses that deliver all the features present in WatchGuard’s higher-end UTM appliances, including all security capabilities, such as AI-powered anti-malware, threat correlation, and DNS-filtering.
• 5G and Wi-Fi 6 enabled models available. Up to 3.94 Gbps firewall throughput, 5 x 1Gb ports, 30 Branch Office VPNs
• Zero-touch deployment makes it possible to eliminate much of the labor involved in setting up a Firebox to connect to your network - all without having to leave your office. A robust, Cloud-based deployment and configuration tool comes standard with WatchGuard Firebox appliances. Local staff connects the device to power and the Internet, and the appliance connects to the Cloud for all its configuration settings.
• Firebox T45 models make network optimization easy. With integrated SD-WAN and optional 5G technology, you can ensure failover to the cellular network, minimize disruptive connectivity, and establish secure and reliable connections for small offices.
• Standard Support includes 24x7 access to technical support, with an unlimited number of incidents with a targeted response time of 24 hours for low priority, 8 hours for medium priority, 4 hours for high priority, and live calls for critical priority. Support is Web-Based and Phone-Based.

$890.01

Buy on Amazon

Check the result before restarting

After editing the file, test the configuration before asking systemd to run it:

sudo suricata -T

The -T option tests the configuration. If it reports a YAML, interface, or rule-loading error, correct that error first rather than repeatedly restarting the service. A clean configuration test is the fastest way to separate syntax problems from runtime capture problems.

Run this check again after material changes: changing HOME_NET, changing the capture device, changing rule locations, or upgrading the package. Treat a failed test as a release blocker for the sensor, because restarting a known-invalid configuration only obscures the original error in the service logs.

Install and update detection rules

Suricata needs signatures to trigger alerts. The project documentation calls signatures “rules,” which is why the files are commonly called rule-files. Fetch the default ruleset with:

sudo suricata-update

In its default mode, suricata-update retrieves the ET Open ruleset and writes the generated rules under /var/lib/suricata/rules, using suricata.rules by default. Run this command after the initial installation and again when you need a newer ruleset. If rules are absent or stale, the engine can capture traffic without producing the detections you expect.

Rule preparation and service startup are separate steps. After updating rules, restart the service so the running process loads the new files, then inspect the logs for startup or rule-loading errors. When an alert is missing, establish first that the expected rule file exists and was generated, and only then investigate traffic visibility or the test request.

Restart the service and inspect its logs

Once the YAML configuration passes validation and rules are present, restart Suricata:

sudo systemctl restart suricata

Inspect the main and statistics logs:

sudo tail /var/log/suricata/suricata.log
sudo tail -f /var/log/suricata/stats.log

The statistics log is updated every eight seconds by default. Its counters show packet-processing and decoded-traffic activity, which helps establish whether the process is receiving packets rather than merely remaining alive.

Let the statistics view run through several eight-second updates while generating known traffic. A service that remains active but shows no packet-processing activity points toward the wrong interface or insufficient network visibility. Counters that increase while no signatures fire point more toward rules, network classification, or the nature of the test traffic.

Watch EVE JSON alerts

Suricata writes structured events to /var/log/suricata/eve.json. To follow only alert events, use:

sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

This view is useful when the file contains many event types. Keep the unfiltered EVE file available for investigations that require flow, DNS, HTTP, or other event records; the filter only changes what is displayed at the shell.

Use the fast log for a concise alert stream and EVE JSON when you need structured records for filtering or later processing. Checking both helps distinguish “no alert was generated” from “the alert exists but was not visible in the particular log view you were watching.”

Run the documented controlled detection test

The OISF quickstart documents a controlled IDS test using ET Open signature ID 2100498. The associated rule looks for the string uid=0(root). This procedure is a documentation test, not an independent performance claim.

1. Open a terminal and follow the fast alert log: sudo tail -f /var/log/suricata/fast.log.
2. From the monitored host, request the test page: curl http://testmynids.org/uid/index.html.
3. Inspect the resulting alert and confirm that it includes SID 2100498.

Start watching the log before issuing the request so that a short-lived event is not missed. The request must traverse the interface Suricata is monitoring; running curl on a different path or from a host whose traffic is not visible to the sensor will not exercise the rule.

If the documented alert appears, the process is loading rules and can generate an alert for traffic it can see. If it does not, work through the troubleshooting branches below instead of assuming that the package installation failed.

Choose live capture or offline PCAP replay

Suricata can validate configuration, capture live traffic, or process a recorded packet capture. The Ubuntu manpage documents these options:

For a live sensor, the systemd service and the configured af-packet interface provide the normal operating path. For repeatable analysis, an offline PCAP lets you test the same rules against recorded traffic without depending on what happens to be traversing the interface at that moment.

Use -T before either mode to catch configuration errors. Use -i when the operating system interface is the source of packets, and --af-packet for the Linux capture method represented in the YAML. Use -r when the input is a file rather than a live device. These options describe different operating paths; selecting one does not compensate for an incorrect HOME_NET or an empty ruleset.

Understand the available package channels

The OISF Ubuntu documentation lists several package choices. They serve different operational needs:

Rank #3

Ubiquiti Unifi Security Appliance (USG), Single,White

• Integration with Unifi Controller. Powerful firewall performance
• Convenient VLAN support. QoS for enterprise VoIP
• VPN server for secure communications. 10/100/1000Base-T
• 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
• Refer instruction manual for troubleshooting steps.

$178.90

Buy on Amazon

A source build is another installation path, but it requires more maintenance than an APT package. Unless you need a source-specific feature or build change, the stable PPA keeps installation and upgrades aligned with Ubuntu’s package tools.

Compare channels on four practical axes: stability, maintenance effort, feature or debug needs, and operational access to the traffic. A debug package may help investigate a specific failure but does not solve a missing monitoring path. Likewise, a newer daily build cannot detect packets that never arrive at the host. Choose the least volatile channel that satisfies the requirement, and test any non-stable package in an environment where a service interruption is acceptable.

Upgrade or remove Suricata

Upgrade the stable package

For a stable PPA installation, refresh package metadata and upgrade only the Suricata package:

sudo apt-get update
sudo apt-get upgrade suricata

After an upgrade, rerun sudo suricata -T and inspect systemctl status suricata before relying on the sensor. If configuration and rules are unchanged, the same interface and HOME_NET checks still apply.

Schedule a rule update and package upgrade as separate, observable maintenance actions when possible. That makes it clear whether a changed binary, changed configuration, or changed ruleset introduced a new behavior. Preserve the prior working configuration and review the main log after the restart.

Remove the package

Remove the installed package with:

sudo apt-get remove suricata

Removal stops managing the package, but review your repository configuration and retained configuration or log files according to your own system-cleanup policy. Preserve logs if they are needed for an incident or audit.

Troubleshoot the common failure points

The service will not start

• Run sudo suricata -T and fix the first configuration error it reports.
• Confirm that the af-packet interface name exactly matches the device shown by ip addr.
• Review /var/log/suricata/suricata.log for the startup failure and then check sudo systemctl status suricata for the unit state.
• Confirm that the rule file expected by the configuration was generated by suricata-update.

The service runs but statistics stay at zero

• Verify that the configured interface is the one carrying the traffic you intend to inspect.
• Confirm that the host’s network placement exposes that traffic to the sensor; a service cannot process packets it cannot receive.
• Follow /var/log/suricata/stats.log for several eight-second update intervals and compare packet-processing and decoded-traffic counters.
• Generate a small amount of known traffic on the monitored path rather than judging the sensor during an idle period.

No alerts appear

• Run sudo suricata-update and confirm that rules are being generated under /var/lib/suricata/rules.
• Check that HOME_NET includes the monitored address and relevant local networks.
• Use the documented test sequence, watching fast.log before issuing the curl request, and look specifically for SID 2100498.
• Use the EVE JSON filter to determine whether alert events are present even when the fast log view is inconvenient.
• Confirm that the test traffic actually crosses the selected interface; a successful request alone does not prove that the sensor saw it.

The test page does not produce SID 2100498

First establish whether the request is reaching the monitored interface. Then verify that the ET Open rules were updated and that Suricata restarted after configuration and rule preparation. The documented test depends on the rule that matches uid=0(root); a missing ruleset, wrong interface, or incorrect network visibility prevents that match from being evaluated.

Check the sequence rather than changing several settings at once: validate with -T, update rules, restart, begin following fast.log, and issue the request again. This preserves a clear cause-and-effect trail and makes the resulting logs easier to interpret.

A repeatable installation checklist

1. Install software-properties-common.
2. Enable ppa:oisf/suricata-stable only after deciding that you trust the third-party source.
3. Run sudo apt-get update and install suricata.
4. Install jq if you want the documented EVE JSON filtering command.
5. Use ip addr to identify the capture interface and its addresses.
6. Set HOME_NET in /etc/suricata/suricata.yaml for the actual local networks.
7. Set the af-packet interface to the exact device name and retain the documented capture options.
8. Run sudo suricata -T.
9. Run sudo suricata-update and verify the rules location.
10. Restart with sudo systemctl restart suricata.
11. Check service status, the main log, statistics, and EVE JSON.
12. Perform the controlled test and look for SID 2100498.
13. Record the package channel, interface, HOME_NET, and rules update procedure for future maintenance.

Following the sequence in this order makes each dependency explicit: the package supplies the engine, the YAML identifies what to inspect, the rules supply detection logic, and the logs show whether the running service is processing and alerting on traffic.

Frequently Asked Questions

Which repository should I use to install Suricata on Ubuntu?

Use the OISF ppa:oisf/suricata-stable PPA for the normal stable installation path. It is a third-party repository, so follow Canonical’s guidance to add repositories only from sources you trust.

Is installing the Suricata package enough to detect attacks?

No. Set HOME_NET, configure the correct af-packet interface, install rules with sudo suricata-update, validate with sudo suricata -T, and verify packet counters and alerts in the logs.

Where does Suricata store the default rules?

The default suricata-update workflow generates the ET Open rules under /var/lib/suricata/rules, using suricata.rules by default.

How do I check that Suricata is receiving packets?

Follow /var/log/suricata/stats.log. It is updated every eight seconds by default and includes packet-processing and decoded-traffic counters. Also confirm that the configured interface is the one carrying the traffic you need.

How can I filter only alert events?

Install jq and run sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'.

What is the documented test for a new installation?

Watch sudo tail -f /var/log/suricata/fast.log, request http://testmynids.org/uid/index.html with curl, and look for ET Open SID 2100498, which matches uid=0(root).

Can I test Suricata without live traffic?

Yes. The Ubuntu manpage documents -r <path> for offline PCAP replay. Use -T to validate the configuration before running either live capture or replay.

Should I use beta or daily packages?

Use suricata-beta or suricata-daily-allarch only for a specific testing purpose. They may be unstable; the stable PPA package is the normal production choice.

The Bottom Line

Install the stable PPA package, identify the real capture interface, set HOME_NET, update ET Open rules, validate with suricata -T, and verify packet counters and SID 2100498 in the logs. Suricata is ready only when the running service can see the intended traffic and has rules loaded to evaluate it.

Quick Recap

Bestseller No. 1

FortiGate-60F Network Security Appliance Plus 1 Year FortiGuard Unified Threat Protection (UTP) and FortiCare Premium (FG-60F-BDL-950-12)

$1,008.87

Bestseller No. 2

WatchGuard Firebox T45-PoE Network Security/Firewall Appliance (WGT47000-US+WGT470063)

$890.01

Bestseller No. 3

Ubiquiti Unifi Security Appliance (USG), Single,White

Integration with Unifi Controller. Powerful firewall performance; Convenient VLAN support. QoS for enterprise VoIP

$178.90

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.