The Dual-Pillars of NDR
Suricata 8.0.x
Multi-threaded signature matching at line rate — the engine that fires when traffic matches a known pattern. Its strength is precision on things you have already characterised, and that is also its ceiling: a signature engine detects the known, and every rule it does not have is a gap that produces silence rather than an error. Rule maintenance is the actual job. An unmaintained Suricata is not a degraded detection capability, it is a green dashboard with nothing behind it.
Zeek 7.x
Zeek parses protocols properly and writes structured logs of every connection, certificate, DNS query and file transfer it sees — no rules, no alerts, just an accurate record. That record is what turns "an alert fired at 02:14" into a timeline. The cost is storage and the discipline to keep it: Zeek logs are voluminous, retention is the hard ceiling on every investigation you will ever run, and a thirty-day window makes "when did they get in" permanently unanswerable regardless of how good your analysts are.
Under the Hood Architecture
Multi-Threading & Hyperscan
Packets arrive through AF_PACKET with zero copy from the kernel and feed a multi-pattern matcher accelerated by Hyperscan on x86 or Vectorscan elsewhere. The number that decides whether any of this works is the drop rate, and it is the number nobody watches. A sensor dropping 30% of packets alerts normally on the 70% it sees and reports nothing about the rest. Graph capture.kernel_drops and alert on it, or you are guessing about your own coverage.
JA4 TLS 1.3 Fingerprinting
Neither engine decrypts anything. JA4 hashes the plaintext ClientHello — cipher ordering, extensions, ALPN — producing a stable fingerprint of the client stack rather than the traffic, which is how a malware family with a distinctive TLS implementation stays visible inside encrypted sessions. Understand what that gives you: strong evidence about which software opened the connection, and nothing whatsoever about content. Fingerprints are also evadable by an author who bothers to mimic a browser's handshake, so treat a JA4 hit as a lead rather than a finding.
Real-World Attack Surface
The Sensor Parses Hostile Input
A sensor's entire input is traffic chosen by whoever is on the network, parsed in C at line rate. Suricata has shipped fixes for parser crashes and resource-exhaustion conditions across its history, and the consequence is worse than it sounds — a crashed sensor deployed passively means the network is unmonitored, and a crashed sensor deployed inline means the network is down. Neither state announces itself as a security event. Monitor the process, not just its alerts.
Zeek State-Tracking Exhaustion
Zeek holds per-connection state in memory, so anything that inflates connection counts inflates memory — a scan, a SYN flood, or an ordinary busy day on a link you sized the sensor for two years ago. It ends in the OOM killer, and the log directory simply stops growing. There is no alert for this. The practical defence is a memory alarm on the sensor host and a periodic check that today's logs are the size you expect, which is a five-minute cron job that has saved more investigations than any rule.
Mandatory Hardening Baseline
- Passive Mode Deployment: a TAP with fail-open is the right default. Inline IPS means the sensor is now a network device, and every crash, every rule reload and every misjudged block becomes an outage the network team owns. Blocking is a genuinely better control and it is a much bigger organisational commitment — go inline deliberately, with dedicated hardware above 10 Gbps, or not at all.
- Thread Pinning:
isolcpuskeeps worker threads off cores the scheduler is using for everything else, which removes a real source of jitter and drops. It also permanently removes those cores from general use, so a sensor host doing anything besides sensing will feel it. - eBPF Bypass for Elephant Flows: shedding large trusted flows — backups, replication, video — before they reach the ring buffer is often the difference between a sensor that keeps up and one that drops. Be deliberate about it. You are choosing to be blind to that traffic, and a bypass rule written for last year's backup job is a permanent hole nobody remembers creating. Review the bypass list on the same schedule as your rules.
Architecture Comparison
| Architecture Matrix | Suricata 8.0.x | Zeek 7.x |
|---|---|---|
| Processing Model | Multi-threaded Signature (MPM) | Single-threaded Scripting |
| Hardware Acceleration | Hyperscan / Vectorscan | Cluster-based Hashing |
| Encrypted Analysis | Native JA4/JA4S support | JA4+ suite via zkg |
| Primary Output | eve.json (Alerts & Metadata) | Distinct protocol logs |
