Signature Rules with Snort and Suricata

Snort and Suricata are the two dominant open-source IDS/IPS engines. They share a largely compatible rule language, so a rule written for one usually runs on the other.

Suricata adds multi-threading, native protocol parsers, file extraction, and rich logging (EVE JSON); Snort 3 modernized its own engine similarly. Learning the rule syntax once gives you leverage over both.

Every rule has two parts: a header and a parenthesized body of options. The header sets the action, protocol, and traffic direction; the body defines what to match and how to report.

The header is read left to right:

• action — alert, drop, reject, pass
• protocol — tcp, udp, icmp, ip (or app protocols in Suricata: http, dns, tls)
• source IP/port and destination IP/port
• direction — -> one-way, or <> bidirectional

Variables like $HOME_NET and $EXTERNAL_NET come from your config so rules stay portable across sites.

The action determines IDS vs IPS behavior for that rule:

• alert — log and notify, do not stop traffic (IDS)
• drop — silently discard the packet (IPS, inline only)
• reject — drop and send a TCP reset or ICMP unreachable
• pass — explicitly allow, skipping later rules

The same engine becomes IDS or IPS depending on whether it is deployed inline and which actions you use.

The content keyword matches a byte pattern in the payload. Text is in quotes; binary is in pipes as hex.

Anchoring keywords sharpen matches: offset, depth, distance, and within constrain where the pattern may appear, which improves both accuracy and performance.

Modern rules match against protocol-aware buffers rather than the raw stream. After a buffer keyword, subsequent content matches apply to that part of the parsed protocol.

• http_uri — the request URI
• http_header — request/response headers
• http_user_agent — the User-Agent
• tls_sni / dns_query — TLS server name / DNS query

This is far more reliable than searching the whole packet for a substring.

When fixed strings are not enough, pcre brings Perl-compatible regular expressions. Pair a cheap content prefilter with a pcre so the regex only runs on candidate packets, preserving performance.

The nocase modifier makes a content match case-insensitive, important for headers and user-controlled fields attackers can vary.

The flow option scopes a rule to connection state and direction, cutting false positives and cost.

• established — only on completed TCP sessions
• to_server / to_client — request vs response direction

Matching server responses only when established and to_client avoids firing on stray or spoofed packets.

Bookkeeping options keep a ruleset maintainable:

• sid — unique signature ID (use 1000000+ for local rules)
• rev — revision number, bump on every edit
• msg — the alert text analysts see
• classtype — category that drives priority
• reference — link to CVE or advisory

Stable sids and incrementing revs let you track and update rules without breaking dashboards and suppressions.

Though rule-compatible, the engines differ in capability:

• Suricata is multi-threaded, parses application protocols natively, extracts files, computes JA3, and emits EVE JSON
• Snort 3 rewrote its engine for performance and a modular plugin system

Some keywords are engine-specific. Suricata adds app-layer keywords (tls.sni, dns.query, http.method) and dataset/flowbits features. When sharing rules, target the lowest common denominator or maintain engine-specific rule sets.

To stop a rule from flooding the console, apply thresholds. detection_filter fires only after N events in a window; threshold with limit caps alert volume.

This is essential for brute-force and scan detections where one event is meaningless but a burst is the signal.

Read a rule and predict its behavior.

You can now read and write Snort/Suricata signatures:

• A rule = header (action, proto, src/dst, direction) + body options
• Action sets IDS vs IPS: alert, drop, reject, pass
• content with offset/depth and hex matches payload bytes
• Sticky buffers (http.uri, tls.sni, dns.query) match parsed protocol fields
• pcre and nocase handle variable patterns
• flow scopes to state and direction
• sid/rev/msg/reference keep rules maintainable
• Thresholds tame brute-force and scan noise

Next: detecting threats with no signature at all.