Network security monitor
reddit / selfhosted

----------------------------------------------------------------------
_clapclapclap · 2023-12-23 10:39

Hi,

Is there something I could setup to monitor my network and maybe
notify me if there's something suspicious going on. Maybe like detect
if someone is hacking through the Wi-Fi using WPA vulnerabilities,
etc.

TIA

----------------------------------------------------------------------
hereisjames · 2023-12-23 23:33

No simple answer. Generally I suggest Wazuh as a starting point, but
if you're specifically concerned about Network intrusions something
like Suricata might be enough.

----------------------------------------------------------------------
_clapclapclap · 2023-12-23 23:38

Oh thank you. I thought my account is shadowbanned on this sub because
it looked like noone is seeing the post.

Anyway, I posted the same question on chatgpt and it did suggest
suricata and snort.

----------------------------------------------------------------------
ddpbsd · 2023-12-24 01:04

Snort and suricata are great IDSes. Zeek is pretty cool too for what
it does. Not sure what kinds of Wireless Intrusion Detection Systems
are out there these days though.

----------------------------------------------------------------------
YYCwhatyoudidthere · 2023-12-24 04:37

Wazuh is pretty slick and easy to setup. A more fullsome alternative
is Security Onion (includes IDS, log/SIEM, alerting, PCAP)

Note that any system worth installing is going to generate false
positives requiring you to tune the monitoring for your specific
environment. These systems aren't set and forget, they will require
ongoing management.