Watch your home network for attacks with Suricata
Your smart plug, your TV and your kids' laptop all talk to the internet, and you can't install security software on most of them. Put a network sensor in the path instead. A Raspberry Pi or mini PC running Suricata reads a copy of every packet, checks it against more than 50,000 free Emerging Threats rules, and tells you which device just did something it shouldn't, including which cheap gadget is quietly phoning home to a server on the other side of the world.
- A triage method for alerts: what each ET category means, what to ignore and how to silence it properly
- A per-device report of DNS lookups and TLS servers, so you can see exactly where each IoT gadget phones home
- A managed switch with port mirroring, for example a TP-Link TL-SG105E (around £20 to £30). Unmanaged switches can't mirror
- A sensor: a Raspberry Pi 5 (4GB or 8GB) running Ubuntu Server 24.04 64-bit, or a mini PC with two network ports. Pi 4 works for connections up to roughly 100Mbps
- Two network connections on the sensor: one to sniff (the Pi's Ethernet port) and one to manage it (the Pi's Wi-Fi, or the mini PC's second port)
- Comfortable with SSH and editing config files. Terminal survival kit covers the basics
Decide where the sensor sits
Choose between a passive mirror port and an inline bridge, and know what each one can see.
An IDS only sees what reaches itSuricata reads packets from a network interface. If a device's traffic never crosses that cable, Suricata never sees it. So placement matters more than any rule.
Mirror for a home network. Inline only if you accept the house going offline when the sensor does. Port mirroring (do this)A managed switch sits between your ISP router and the rest of your network. You tell it to copy every packet on the uplink port (the one going to the router) out of a spare port, and plug the sensor into that spare port. The sensor sees every device behind the switch with its real internal IP address, and if it crashes nobody notices. This is an IDS: it detects and alerts.
Inline (later, maybe)The sensor sits physically between the router and everything else, with two network ports bridged together, and Suricata can drop packets that match a rule. That's an IPS. It's powerful, but a reboot or a crash takes the whole house offline, and a Pi has to keep up with your full line speed.
The Wi-Fi catchIf your ISP router also does your Wi-Fi, wireless devices talk to the router directly and never cross your switch. The fix is to turn the router's Wi-Fi off and plug your own access point or mesh unit into the managed switch. Then every phone, TV and smart plug flows through the mirrored uplink.
TipZeek is the other big name. Suricata matches traffic against attack signatures and also logs DNS, TLS and flows. Zeek writes very detailed logs of every connection but ships no signature rules. For a home sensor that alerts you, Suricata is the better first build.