Controlled detection and prevention lab

Build a small authorized lab

Use client 10.10.10.20, server 192.0.2.80:8080 and a dedicated Linux sensor. Choose either the two-NIC AF_PACKET topology or the NFQUEUE routed topology from the prior lessons. Keep separate management and a saved rollback. Do not connect this test path to unrelated users or Internet targets. No exploit, scan or malicious payload is needed.

Create a benign repeatable service

On the prepared server, create two harmless resources in a dedicated working directory. On the client, send one request to each resource. Python and curl must already be available; these commands are lab instructions, not executions on this computer.

mkdir -p routecraft-web
cd routecraft-web
printf "marker resource\n" > routecraft-check
printf "ordinary resource\n" > ordinary
python3 -m http.server 8080 --bind 192.0.2.80

curl --max-time 5 http://192.0.2.80:8080/ordinary
curl --max-time 5 http://192.0.2.80:8080/routecraft-check

Verify both succeed before enabling blocking. Ensure the client uses the intended source address and path. Save an authorized complete bidirectional lab capture as lab-http.pcap using the lab’s established capture procedure.

First prove detection offline

alert http 10.10.10.20 any -> 192.0.2.80 8080 (msg:"LAB PacketLab marker"; flow:established,to_server; http.uri; content:"/routecraft-check"; startswith; sid:1000001; rev:1;)

mkdir -p lab-passive-out
suricata -T -c /etc/suricata/suricata.yaml -S ./local.rules --init-errors-fatal
suricata -c /etc/suricata/suricata.yaml -S ./local.rules -r ./lab-http.pcap -l ./lab-passive-out

Use a fresh directory and the known packaged YAML with EVE alert/HTTP/flow enabled. Confirm SID 1000001 for the marker and no marker alert for the ordinary resource. If this fails, repair fixture, header, stream or logging before introducing live prevention.

Then prove narrow prevention

drop http 10.10.10.20 any -> 192.0.2.80 8080 (msg:"LAB PacketLab marker"; flow:established,to_server; http.uri; content:"/routecraft-check"; startswith; sid:1000002; rev:1;)

Replace the alert marker with this drop rule in the selected lab instance. Validate and activate using the deployment lesson, then repeat the two requests as new connections. The ordinary request must still succeed; the marker should fail to reach the server application and correlate with SID 1000002 and final drop evidence. A sender timeout alone is not a pass.

Exercise one fault and restore

Choose one reversible fault: wrong local rule path, wrong monitored interface or a deliberately stopped lab consumer. Predict its effect before testing, collect the evidence and restore the known-good state. For NFQUEUE remove only the dedicated suricata_lab table when rolling back; never flush the host’s unrelated firewall. For AF_PACKET restore the approved physical path and saved interface settings.

Finish by restoring alert-only policy or the original lab topology, verifying ordinary traffic, and stopping the temporary HTTP service. Retain the engine version, rules, configuration, fixture hash, EVE excerpts, endpoint results and any untested assumptions. Passing this lab does not establish production throughput or universal fail-open/fail-closed behavior.