How to Install Suricata on Ubuntu: Stable PPA, Configuration, Rules, and Testing

Install Suricata on Ubuntu from the Open Information Security Foundation’s stable PPA, then configure the interface and HOME_NET, download detection rules, validate the configuration, and test an alert. Installing the package alone does not make an effective sensor: Suricata must be attached to the interface carrying the traffic you need to inspect and must have rules enabled.

Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.

The commands below use the Ubuntu package workflow documented for Suricata 8.0.0. Package versions and service defaults can change, so verify the installed build with suricata --build-info before putting the sensor into production.

#	Preview	Product	Price
1		The Practice of Network Security Monitoring: Understanding Incident Detection and Response	$47.50	Buy on Amazon
2		Applied Network Security Monitoring: Collection, Detection, and Analysis	$35.57	Buy on Amazon
3		The Tao Of Network Security Monitoring: Beyond Intrusion Detection	$28.85	Buy on Amazon
4		Security Monitoring with Wazuh: A hands-on guide to effective enterprise security using real-life...	$21.28	Buy on Amazon
5		IP Cam Viewer User Guide for Beginners: A step-by-step guide to installing, configuring, and using...	$15.99	Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

What you need before installing

Use an Ubuntu host on which you have an account with sudo privileges. The host needs working network access to the package repository and to the rule-update service. It also needs an interface that actually sees the traffic you want Suricata to inspect. A sensor installed on a machine that only sees its own loopback traffic will not detect activity elsewhere on the network.

• Administrative access: the installation, configuration-file edits, service management, and rule updates require root privileges, normally through sudo.
• Network visibility: identify whether the host is monitoring a physical NIC, a virtual NIC, a VLAN, a bridge, or a mirrored/SPAN port. The interface name used in the configuration must match the device on this Ubuntu host.
• Address information: record the interface’s IPv4 and IPv6 addresses and the local networks that should be treated as internal.
• Authorization: only capture and test traffic on systems and networks you own or are explicitly permitted to monitor.

The procedure does not assume a particular Ubuntu release because the available package version depends on the release and repository metadata. If your organization pins package versions or uses an internal mirror, follow that policy while preserving the same configuration and validation steps.

#1 Best Overall

Sale

The Practice of Network Security Monitoring: Understanding Incident Detection and Response

• Used Book in Good Condition

$47.50

Buy on Amazon

Choose an installation channel

The recommended Ubuntu route is the OISF suricata-stable PPA followed by an apt installation. Ubuntu describes PPAs as third-party repositories and advises: “Only add software repositories from sources that you trust.” Review your organization’s repository policy before enabling it.

This guide uses the stable PPA. Beta and daily packages are testing channels, not a shortcut to newer production software.

Install Suricata from the stable PPA

1. Install the Ubuntu helper that provides add-apt-repository:

   sudo apt-get install software-properties-common

2. Add the OISF stable repository:

   sudo add-apt-repository ppa:oisf/suricata-stable

   Read the repository information shown by the command and confirm that it is the source your policy allows. Do not add unrelated PPAs simply because they appear in a search result.

3. Refresh apt metadata so Ubuntu can see the package from the new channel:

   sudo apt-get update

4. Install Suricata:

   sudo apt-get install suricata

5. If you want to use the documented shell filter for EVE JSON later, install jq as well:

   ×Worth Installing

   Crashes, No Sound, or Screen Glitches?

   Outbyte Driver Updater · freeRandom freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFind the Right Drivers →
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

   sudo apt-get install jq

Apt may start the service during installation, but do not treat that as a completed deployment. The interface, HOME_NET, and rules still need to be checked.

Verify the installed build and service

Confirm that the binary is present and inspect the capabilities compiled into it:

Rank #2

Sale

Applied Network Security Monitoring: Collection, Detection, and Analysis

$35.57

Buy on Amazon

sudo suricata --build-info

The output identifies build features and helps explain later differences between package channels. Save it with your deployment notes if you need to troubleshoot capture support.

Check the systemd unit:

sudo systemctl status suricata

A service can be active while still monitoring the wrong interface or loading no useful rules, so service status is only the first verification step. If systemd reports a failed start, inspect the Suricata log and run the explicit configuration test described below before trying another restart.

Find the interface and addresses Suricata must monitor

List interfaces and assigned addresses with:

ip addr

Record the exact device name, such as enp1s0, rather than relying on a label from another machine. Ubuntu’s predictable interface names mean that a device called enp1s0 on one host could be named differently on another.

Determine which address ranges are local to the sensor and which traffic direction matters to you. HOME_NET should include the monitored interface address and the local networks that your rules should regard as internal. Include the appropriate IPv4 and IPv6 ranges when both protocols are in use. Do not blindly replace it with every address on the Internet; an overbroad value changes the meaning of many signatures and can create excessive alerts.

Configure suricata.yaml

The main configuration file installed by the package is /etc/suricata/suricata.yaml. Make a backup before editing so you can restore a known-good version:

sudo cp /etc/suricata/suricata.yaml /etc/suricata/suricata.yaml.backup

Set HOME_NET

Open the file with an editor available on your host, for example:

sudo nano /etc/suricata/suricata.yaml

Find the HOME_NET variable in the address-vars section. Edit the list so it contains the actual monitored interface address and the internal networks relevant to this sensor. Preserve the YAML list syntax and indentation. If the host has multiple internal segments, include each approved CIDR; if a network is not yours to monitor, do not classify it as home merely because packets from it are visible.

Set the AF_PACKET interface

In the af-packet section, set the interface to the device name returned by ip addr. The basic IDS capture settings documented by OISF look like this:

Rank #3

Sale

The Tao Of Network Security Monitoring: Beyond Intrusion Detection

$28.85

Buy on Amazon

af-packet:
  - interface: enp1s0
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    tpacket-v3: yes

Replace enp1s0 with your real interface name. Keep af-packet: spelled exactly as shown; it is a YAML key, not a command-line option in this section. The cluster and packet-ring settings allow Suricata workers to distribute flows while preserving flow affinity. If another application already owns the interface or your deployment uses a bridge, VLAN, container network, or bonded device, verify which logical device carries the packets before changing the configuration.

YAML is indentation-sensitive. A missing space, a tab character, or a duplicated list marker can prevent the service from starting. That is why configuration testing should happen before a production restart.

Install and update detection rules

Suricata’s engine does not generate signature alerts without rules. The project’s documentation notes that “Signatures are also called rules, thus the name rule-files.” Run the rule updater after installation:

sudo suricata-update

With its default configuration, suricata-update fetches the Emerging Threats Open ruleset and writes the generated rules under /var/lib/suricata/rules, normally as suricata.rules. The command’s output should show whether downloading and rule generation completed successfully.

Check that the directory and generated file exist:

sudo ls -l /var/lib/suricata/rules

If your configuration points to a different rule filename or directory, make sure the path in suricata.yaml matches the file that the updater creates. A successful update followed by a service that loads zero rules usually indicates a path mismatch, permissions problem, or a configuration override.

Validate the configuration before launching

Use Suricata’s configuration-test mode:

sudo suricata -T -c /etc/suricata/suricata.yaml

The -T option checks that the YAML, referenced files, and rule configuration can be loaded. Treat a nonzero exit or an explicit error as a deployment blocker. Correct one issue at a time, rerun the test, and only restart systemd after the test completes successfully.

Common causes of a failed test include a misspelled interface, malformed YAML indentation, a rule file that does not exist, an invalid network in HOME_NET, or a rule that is incompatible with the installed engine version.

Start Suricata and inspect its logs

Once the configuration test and rule update succeed, restart the service:

Rank #4

Sale

Security Monitoring with Wazuh: A hands-on guide to effective enterprise security using real-life use cases in Wazuh

$21.28

Buy on Amazon

sudo systemctl restart suricata

Inspect the primary log for startup messages and errors:

sudo tail /var/log/suricata/suricata.log

Watch processing counters while traffic is flowing:

sudo tail -f /var/log/suricata/stats.log

The documented default is an update to stats.log every eight seconds. The counters show whether packets are being received, decoded, and processed. A running service with counters that remain at zero generally means the selected interface is idle, the host cannot see the desired traffic, or capture permissions and device selection do not match the topology.

For structured alert events in EVE JSON, use:

sudo tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

If you did not install jq, view the file directly with sudo tail -f /var/log/suricata/eve.json. EVE records contain more fields than the compact fast log, so they are useful for checking the signature, source and destination addresses, protocol, and timestamp of an alert.

Run a controlled detection test

The OISF quickstart documents a test using ET Open signature ID 2100498. It looks for the string uid=0(root) in a response from the test site. This is a documentation procedure, not an independent performance test. Use it only from a system and network where you are authorized to generate and inspect the request.

1. In one terminal, follow the fast alert log:

   sudo tail -f /var/log/suricata/fast.log

2. In a second terminal on a host whose traffic traverses the monitored interface, request the test page:

   ×Worth Installing

   Outdated Drivers Are Slowing You Down

   Outbyte Driver Updater · freeOne free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchScan My Drivers Free →
   Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

   curl http://testmynids.org/uid/index.html

3. Look for an alert that identifies SID 2100498. The exact surrounding text can vary with the installed rule metadata, but the signature ID is the key check.

4. Confirm the same event appears in EVE JSON if that output is enabled. Compare the interface counters in stats.log with the request time so you know the packet reached the sensor.

   Best Value

   

   IP Cam Viewer User Guide for Beginners: A step-by-step guide to installing, configuring, and using IP cameras for remote viewing and home security monitoring

   $15.99

   Buy on Amazon

If no alert appears, first verify that the request used the monitored path, then confirm that the rule update completed and that the loaded rules include the test SID. A DNS result or an HTTP response on the client does not prove that the sensor saw the traffic; a switched network may require a mirror port or a sensor placed inline.

Use live capture or replay a PCAP

The Ubuntu manpage documents several operating modes:

Use one operating mode at a time unless you have deliberately designed a multi-process deployment. PCAP replay is useful for safely reproducing a known event, checking a rule update, or troubleshooting without waiting for live traffic. The capture file must be accessible to the user running Suricata, and its timestamps and link-layer type must be compatible with the decoder.

Troubleshoot the most common failures

Keep the installation updated

For the stable package channel, update apt metadata and upgrade only the Suricata package:

sudo apt-get update
sudo apt-get upgrade suricata

After an engine upgrade, rerun suricata-update, test the configuration, and inspect the service logs. Rule syntax or defaults can change between engine versions, so a successful package transaction is not a substitute for a post-upgrade validation.

To remove the package while leaving unrelated system packages in place, run:

sudo apt-get remove suricata

Before removal, export any configuration, custom rules, log-retention settings, and systemd overrides that you may need for a later reinstall. Removing the package does not answer whether historical logs or generated rule files should be retained; handle those according to your retention and incident-response policy.

Quick Recap

SaleBestseller No. 1

The Practice of Network Security Monitoring: Understanding Incident Detection and Response

Used Book in Good Condition

$47.50

SaleBestseller No. 2

Applied Network Security Monitoring: Collection, Detection, and Analysis

$35.57

SaleBestseller No. 3

The Tao Of Network Security Monitoring: Beyond Intrusion Detection

$28.85

SaleBestseller No. 4

Security Monitoring with Wazuh: A hands-on guide to effective enterprise security using real-life use cases in Wazuh

$21.28

Bestseller No. 5

IP Cam Viewer User Guide for Beginners: A step-by-step guide to installing, configuring, and using IP cameras for remote viewing and home security monitoring

$15.99

Operational practices that prevent surprises

• Document the monitored path: record the interface, mirror or tap configuration, VLAN assumptions, and the networks represented in HOME_NET.
• Separate configuration from generated rules: treat /etc/suricata/suricata.yaml as administrator-managed and the files under /var/lib/suricata/rules as updater-managed.
• Watch health, not just process state: systemd status confirms that a process exists; stats.log confirms whether packets are being handled.
• Protect logs: EVE and fast logs can contain internal addresses, URLs, and other sensitive metadata. Apply appropriate file permissions and retention limits.
• Stage changes: update rules or packages during a maintenance window, run -T, restart, and verify counters and alerts before declaring the sensor healthy.
• Use testing channels deliberately: beta and daily packages are useful for compatibility work but can introduce instability that is inappropriate for an always-on production sensor.

Installation checklist

1. Install software-properties-common.
2. Add and review the trusted ppa:oisf/suricata-stable repository.
3. Run sudo apt-get update and install suricata.
4. Verify the build with sudo suricata --build-info.
5. Use ip addr to identify the real capture interface and its networks.
6. Set HOME_NET and the af-packet interface in /etc/suricata/suricata.yaml.
7. Run sudo suricata-update and confirm the generated rules under /var/lib/suricata/rules.
8. Pass sudo suricata -T -c /etc/suricata/suricata.yaml.
9. Restart the service and inspect suricata.log, stats.log, fast.log, and eve.json.
10. Perform the authorized SID 2100498 test or replay a known PCAP, then verify both packet counters and alert output.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

ET Open rulesIDSIntrusion detectionNetwork SecuritySuricataUbuntu