IPS Concept

Intrusion Prevention System mode, or IPS mode, is the Suricata mode that makes it act as a traffic filter.

By default it will allow all traffic, and will use drop or reject rules to block unwanted traffic.

It is generally used inline, where threat detection rules are used to drop known bad traffic.

The inline operations are either on layer 2 (bridge, for example using AF_PACKET or DPDK) or on layer 3 (routing, for example in NFQueue or IPFW).

Differences from the passive IDS mode

TCP stream engine ^^^^^^^^^^^^^^^^^

Where in IDS mode TCP traffic is only inspected after the acknowledgement (ACK) for it has been received, in IPS mode the default behavior is different: new data is inspected immediately, together with previous data where possible. The inspection happens in a sliding window. This behavior is controlled by the stream.inline setting.

In case of overlapping data, the first data Suricata receives is accepted. Follow-up data that overlaps with this is then checked against the first data. If it is different, the traffic on the wire is rewritten to match the first data.

The sliding window inspection can be visualized as such::

Packet 1: [hdr][segment data 1     ]
Segments: [segment data 1     ]
Window:   [ inspection window ]

Packet 2: [hdr][segment data 2]
Segments: [segment data 1     ][segment data 2]
Window:   [ inspection window                 ]

Packet 3: [hdr][segment data 3]
Segments: [segment data 1     ][segment data 2][segment data 3]
Window:            [ inspection window                        ]

Packet 4: [hdr][segment data 4]
Segments: [segment data 2][segment data 3][segment data 4]
Window:            [ inspection window                   ]

Each segment's data is inspected together with the other available data. One consequence of this is that there can be significant rescanning of data, which has a performance impact.

http body inspection ^^^^^^^^^^^^^^^^^^^^

Similar to the sliding window approach in the TCP stream engine, the HTTP body inspection will happen in a sliding manner by default. In IDS mode body data is buffered to the configured settings before inspection.

::

app-layer:
  protocols:
    http:
      libhtp:
         default-config:
           # auto will use http-body-inline mode in IPS mode, yes or no set it statically
           http-body-inline: auto

file.data ^^^^^^^^^

For HTTP, the file.data logic is the same as the body inspection above.

Exception Policies

By default, when IPS mode is enabled, the exception policies are set to block (drop). This is to make sure rules cannot be bypassed due to Suricata reaching an error state in parsing, reaching internal resource limits and other exception conditions.

See :ref:Exception Policies documentation <exception policies>.

Differences from Firewall Mode

The main difference is that unlike IPS mode, Firewall Mode has a default drop policy. This means that a ruleset must be created to allow traffic to be accepted, instead of accepting traffic by default and filtering out unwanted traffic.

See :ref:Firewall Mode Design <firewall mode design>.