Anybus Defender - Configure Suricata IDS

APPLICABLE PRODUCTS 

Anybus Defender Series 4000 and up

VERSIONS USED IN THIS ARTICLE

• Anybus Defender 2.5.2-2026100522

Anybus Defender - Configure Suricata IDS

This guide explains how to configure Suricata Intrusion Detection System (IDS) on an Anybus Defender to monitor HTTP webpage titles and FTP file contents.

Two custom Suricata rules are used:

1. HTTP Apache2 Page Title Incorrect: Generates an alert when the title of the HTTP webpage does not match the expected title.
2. FTP Configuration File Incorrect: Generates an alert when the contents of a configuration file transferred using FTP do not match the expected configuration.

Suricata operates in IDS mode, meaning that incorrect content generates an alert without blocking the communication.

Prerequisites

• A client and server connected through the Defender.
• An HTTP server hosting a webpage.
• An FTP server hosting the machine configuration file.
• Firewall rules allowing the required HTTP and FTP traffic.

Instructions

1. Network configuration

The Defender separates the client from the server network using two interfaces.

Traffic travels through the Defender between the client and server.

Client Requests: Client -> LAN -> Defender -> LAN3 -> Server

Server responses: Server -> LAN3 -> Defender -> LAN -> Client

Suricata interface assignment

Suricata is configured on LAN3, where responses from the server enters the Defender. This allows both rules to monitor server-originated traffic without running another Suricata instance on LAN.

2. Install Suricata

1. Navigate to System -> Package Manager
2. Open the Available Packages tab
3. Search for Suricata
4. Click Install
5. Confirm the installation
6. After installation, navigate to Services -> Suricata

3. Configure the Suricata interface

1. Navigate to Services -> Suricata
2. Open the Interfaces tab
3. Click Add to create a Suricata interface
4. Configure the following settings:

6. Click Save

Leave blocking disabled because Suricata should only detect and report incorrect HTTP or FTP content.

4. Configure the HTTP content inspection rule

The first rule monitors HTTP responses from the webpage server.

Its purpose is to detect when the webpage title differs from the expected title.

4.1 Expected webpage title

The expected HTML title is:

<title>Apache2 Test Page</title>

For example, if the webpage is changed to:

<title>Hacked Page</title>

Suricata should generate an alert when the modified title is transferred in a matching HTTP response.

4.2 Add the HTTP rule

1. Navigate to Services -> Suricata -> Interfaces
2. Select the LAN3 Suricata interface
3. Open the Rules tab
4. Select custom.rules from the rule category dropdown
5. Enter the following rule:

alert tcp 20.0.0.125 80 -> any any (msg:"HTTP Apache2 Page Title Incorrect"; flow:established,to_client; content:"<title>"; pcre:"/^(?!Apache2 Test Page<\/title>)[^<]*<\/title>/R"; sid:1000523; rev:1;)

6. Click Save

The custom rules editor stores the rule in the Suricata configuration for that interface.

4.3 Rule explanation

The regular expression uses a negative lookahead to check that the title content immediately following <title> is not the expected text.

Important: This rule checks a specific HTML title pattern. It is not a complete verification of the webpage’s content or cryptographic integrity check. Changes elsewhere on the page will not necessarily generate an alert.

5. Configure the FTP content inspection rule

The second rule monitors configuration file contents transferred from the FTP server.

It checks whether the configuration contains the expected machine settings.

5.1 Expected configuration file

The FTP server should contain a text file named:

machine_config.txt

The expected file contents are:

Machine Configuration
Device: PLC_01
Mode: Automatic
Temperature Limit: 80
Safety Enabled: True
System Status: OK

For example, if the temperature limit changes from 80 to 100. The rule is intended to generate an alert when the modified configuration is downloaded.

5.2 Add the FTP rule

1. Navigate to Services -> Suricata -> Interfaces
2. Select the LAN3 Suricata interface
3. Open the Rules tab
4. Select custom.rules
5. Add the FTP rule below the existing HTTP rule

alert tcp 20.0.0.125 any -> any any (msg:"FTP Machine Configuration Incorrect"; flow:established; content:"Machine Configuration"; pcre:"/Machine Configuration\r?\n(?!Device: PLC_01\r?\nMode: Automatic\r?\nTemperature Limit: 80\r?\nSafety Enabled: True\r?\nSystem Status: OK(?:\r?\n|$))/"; sid:1000724; rev:1;)

6. Click Save

5.3 Rule explanation

Important: The FTP rule monitors matching TCP content, not a particular filename. It also does not guarantee detection of all changes to the file- It checks the specified sequence of settings, and its effectiveness depends on the required content being available in the inspected stream.

5.4 FTP data connection

FTP uses two connections:

• Control connection: Usually TCP port 21, used for commands such as USER, PASS and RETR.
• Data connection: Used to transfer the actual file contents.

The FTP rule does not restrict the server source to port 21 because the file contents are carried over the data connection.

Since the rule uses the server IP address as its source, it is designed for FTP downloads where the data connection originates from 20.0.0.125.

It may not match passive-mode FTP downloads of the server’s data connection originates from a different address or does not use the direction covered by the rule.

6. Verify that both custom rules are enabled

After adding the rules, the custom.rules category should contain both entries.

1. Navigate to Services -> Suricata -> Interfaces
2. Select LAN3 -> Rules
3. Select custom.rules
4. Verify both rules are present
5. Confirm the rules are enabled in Active Rules
6. Click Apply if the page indicates that unapplied changes remain

7. Start Suricata

1. Navigate to Services -> Suricata -> Interfaces
2. Locate the LAN3 interface
3. Start Suricata using the Start button
4. Verify that Suricata reports a running status

If Suricata is already running, verify that the updated rules have been applied.

Suricata should now inspect traffic on LAN3 and generate alerts for matching HTTP and FTP content.

8. Test the HTTP rule

The HTTP rule can be tested by modifying the title of the webpage or if you are unable to do that, change the phrase in the rule to something that does not appear on the webpage, for example change Apache2 Test Page to Hacked Page.

On the client 192.168.200.50, open a browser and go to http://20.0.0.125.

In Services -> Suricata -> Alerts, check for:

The result should be an alert indicating that the title differs from the expected value.

Because Suricata operates in IDS mode, the webpage should remain accessible.

Restore the original webpage title/changed rule after the test.

9. Test the FTP rule

The FTP rule can be tested by changing one of the expected configuration values and downloading the file.

9.1 Test the incorrect configuration

On the FTP server, modify the file, for example changing the Temperature Limit from 80 to 100.

On the client:

1. Connect to the FTP server
2. Download the modified machine_config.txt
3. Open Services -> Suricata -> Alerts
4. Select LAN3 and locate the corresponding alert

Expected alert:

The FTP transfer should still succeed because Suricata is operating in IDS mode.

Restore the original configuration after completing the test.

10. Final configuration summary

With this configuration, the Anybus Defender monitors HTTP and FTP response originating from the server and generates alerts when the specified patterns are detected.

Detection limitations: These two rules are intended for a controlled demonstration. They are not full-file integrity monitoring: the HTTP rule only checks the page title, and the FTP rule checks a specific configuration sequence.

© HMS Networks AB 2026