Suricata

In this tutorial you will learn how to configure Suricata’s built-in Intrusion Prevention System (IPS) mode. When you enable IPS mode, Suricata can actively drop suspicious network traffic in addition to generating alerts. Once you know which signatures you would like to use in IPS mode, you’ll convert their default action to drop or reject traffic. With your signatures in place, you’ll learn how to send network traffic through Suricata using the netfilter NFQUEUE iptables target.