Intrusion Detection System for a home network

Question

I would like to setup an IDS/IPS (network intrusion prevention and detection system) like snort, but I would prefer not have to dedicate a computer to handle it.

Are there any applications or routers that can be hacked or some other free or not too expensive IDS that I could use?

I would prefer real time notifications.

Answer 1

Try out Suricata.

Suricata is a rule-based ID/PS engine that utilises externally developed rule sets to monitor network traffic and provide alerts to the system administrator when suspicious events occur. Designed to be compatible with existing network security components, Suricata features unified output functionality and pluggable library options to accept calls from other applications.

Answer 2

You can run snort on your local machine, either through a virtual machine or directly if you're running a unix variant already. Unfortunately advanced intrusion detection systems require huge signature files and a lot of processing power to run in real time which is going to rule out all consumer routers. The big enterprise router manufacturers don't add full IPS/IDS feature sets to their routers so they don't compete with their firewall and dedicated IPS products. Some vendors do add a small amount of IPS/IDS functionality to their routers but since this requires so much cpu to run you're going to have to have a beefy router. What router do you currently have and how many machines would you like to monitor?

Answer 3

I can use pretty much any operating system I guess, that runs on either x64/x86 or custom routers. I have about 50 machines to monitor so not a lot. (Including devices and phones etc). I have a couple of SonicWall routers, and a few dLInk routers. I have one router running ddwrt.

Thanks for all of the responses so far.