shamimrezasohag/dns-suricata-tcpdump repository overview

DNS-Suricata-Tcpdump Container

This Docker container provides a comprehensive network traffic monitoring and intrusion detection environment. It is built on Ubuntu and comes pre-configured with DNS services, Suricata, and Tcpdump, making it suitable for network security analysis and monitoring tasks. The container supports recursive DNS queries, real-time network traffic analysis with Suricata, and packet capturing using Tcpdump.

Key Features:

Suricata: An open-source, high-performance network IDS, IPS, and network security monitoring engine. Suricata allows for real-time traffic inspection and rule-based alerts.

Tcpdump: A powerful packet capture tool that allows network traffic capture for deeper analysis.

DNS (Bind9): Configured with recursive DNS functionality, allowing this container to act as a recursive DNS server, handling and resolving DNS queries.

SSH Access: SSH is enabled for remote access to the container, allowing users to run commands and perform network monitoring tasks directly inside the container.

EVE JSON Logging: Suricata logs are configured to output in JSON format for easy integration with external log analysis systems. Use Cases:

Network Intrusion Detection: This container can monitor network traffic and detect malicious activities, leveraging Suricata's rule-based engine.

DNS Monitoring: Capture and analyze DNS queries to detect DNS-based attacks or abnormal query patterns.

Packet Capturing and Analysis: Capture and analyze network packets using Tcpdump for in-depth traffic inspection.

How to Use:

Pull the Docker Image: docker pull shamimrezasohag/dns-suricata-tcpdump

Run the Container: docker run -it -p 2222:22 -p 53:53/udp -p 5300:53/tcp shamimrezasohag/dns-suricata-tcpdump

Access the Container via SSH: ssh root@localhost -p 2222

The default root password is set to rootpassword.

Monitor DNS Queries and Traffic:

Suricata will analyze traffic in real time, and logs can be found in /var/log/suricata/.

Tcpdump can be used to capture traffic on any network interface: tcpdump -i eth0

Configure and Manage DNS: This container comes pre-configured with Bind9 as a recursive DNS server. You can modify the DNS configuration at /etc/bind/.

Ports:

22: SSH Access. 53/udp: DNS Service. 53/tcp: DNS Service (if needed). 5300: Custom DNS TCP Port (if needed).

Environment Variables:

TZ: Set the container timezone (default is Asia/Dhaka).

Logs and Output:

Suricata Logs: Logs are saved in /var/log/suricata/. You can view alerts in fast.log or detailed EVE JSON logs in eve.json.

This container is ideal for security analysts, network administrators, and developers who need a ready-to-use environment for network intrusion detection, traffic analysis, and DNS monitoring.