This project demonstrates the setup and configuration of an Intrusion Detection System (IDS) using Suricata on Ubuntu. A custom rule was created to detect ICMP (ping) traffic, and the detection was verified through real network traffic.
- Installed and configured Suricata IDS
- Configured Suricata to monitor the active network interface
- Created a custom ICMP detection rule
- Captured and analyzed network traffic
- Generated IDS alerts for ICMP ping packets
- Ubuntu 26.04 LTS
- Suricata 8.0.3
- VMware Workstation
- Linux Terminal
CodeAlpha_IntrusionDetectionSystem/
│── README.md
│── requirements.txt
│── suricata.rules
└── screenshots/
├── build-info.png
├── config-test.png
├── ping-test.png
└── ids-alert.png
alert icmp any any -> any any (msg:"ICMP Ping Detected"; sid:1000001; rev:1;)
The IDS was tested by sending ICMP packets using:
ping 8.8.8.8 -c 5Suricata successfully detected the traffic and generated alerts in:
/var/log/suricata/fast.log
The repository includes screenshots showing:
- Suricata installation
- Configuration test
- ICMP traffic generation
- IDS alert detection
Shazil Naseem