🔐 Securing ROS 2 Robots: Network Intrusion Detection with Suricata

As robots become more deeply integrated into logistics, healthcare, research, and everyday life, they also become more attractive targets for cyber threats. Network security in robotics is no longer optional—especially when those systems rely on distributed middleware like ROS 2 (Robot Operating System 2).

In this article, part of our broader ROS 2 robot hardening series, we focus on using Suricata, a high-performance open-source intrusion detection system (IDS), to monitor and alert on suspicious network traffic in real time.

🔎 This guide covers installing Suricata on an Ubuntu 24.04-based ROS 2 robot, integrating it into an automated main.sh install script, and validating the setup.

📚 Table of Contents

• Why Use Suricata for Robotic Network Security?

• Suricata Deployment Modes for Robots

  • ✅ Host-Based Monitoring
  • ✅ Inline IPS Mode
  • ✅ Passive Mode with SPAN/TAP

• Installing Suricata via main.sh Integration

  • suricata_setup Function

• Configuring Suricata for Your Network Interface

• Testing Suricata with ICMP Traffic

• Summary and Next Steps

Why Use Suricata for Robotic Network Security?

Suricata provides deep packet inspection and real-time alerting for potentially malicious activity across:

• Ethernet, IP, TCP/UDP, and application-layer protocols
• ROS 2 DDS traffic, which typically operates over UDP ports 7400–7600
• Common attack patterns, detected via customizable rule signatures

By adding Suricata to a robotic system, you gain:

• ✅ Visibility into all traffic flows (including internal ROS 2 communication)
• ✅ Early warnings for unauthorized access or malformed packets
• ✅ A foundation for Zero Trust network security, even on public or mobile connections

Suricata Deployment Modes for Robots

Suricata supports multiple deployment models depending on your network architecture:

✅ Host-Based Monitoring

Runs directly on the robot and inspects packets via the system's network interface.

🧰 Best for: Isolated devices, portable robots, and standalone systems.

✅ Inline IPS Mode

Sits between network segments to actively block malicious traffic (intrusion prevention system mode).

🧰 Best for: Robots behind dedicated gateways or firewalls.

✅ Passive Mode with SPAN/TAP

Connects to a mirror or SPAN port on a switch to passively monitor all subnet traffic.

🧰 Best for: Labs, testing environments, and security operations centers.

Installing Suricata via main.sh Integration

In this series, we use a modular approach to secure ROS 2 systems. Suricata is installed via the suricata_setup function, called by the centralized main.sh installer. This makes security setup consistent and scriptable across all robot deployments.

🔧 suricata_setup Function

#!/bin/bash

source ./common.sh

suricata_setup() {
    apt update && apt upgrade
    apt install -y suricata

    # Add basic detection rules
    echo 'alert udp any any -> any 7400:7600 (msg:"ROS2 DDS UDP Traffic Detected"; sid:100001;)' | sudo tee -a /etc/suricata/rules/local.rules
    echo 'alert icmp any any -> any any (msg:"ICMP test detected"; sid:1000001; rev:1;)' | sudo tee -a /etc/suricata/rules/local.rules

    # Ensure Suricata loads the custom rule file
    echo 'include: local.rules' >> /etc/suricata/suricata.yaml

    systemctl enable --now suricata
}

You can plug this function directly into your main.sh or call it as a modular step in a larger installation sequence.

🔄 Configuring Suricata for Your Network Interface

Suricata needs to monitor the correct network interface. Identify yours:

ip a | grep UP

Sample result:

2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> ...

Update /etc/suricata/suricata.yaml:

af-packet:
  - interface: ens3  # Replace 'ens3' with your active network interface

Update the rule path configuration:

default-rule-path: /etc/suricata/rules

rule-files:
  - local.rules

Make sure there are no conflicting includes:

# Comment out default includes if needed
#include:
#  - include1.yaml
#  - include2.yaml
# include: local.rules

Restart Suricata to apply the changes:

sudo systemctl restart suricata

🧪 Testing Suricata with ICMP Traffic

You can validate your setup with a basic ping test:

Terminal 1:

ping 8.8.8.8

Terminal 2:

sudo tail -f /var/log/suricata/fast.log

Expected output:

[**] [1:1000001:1] ICMP test detected [**] {ICMP} 10.0.2.15:8 -> 8.8.8.8:0

This confirms Suricata is actively monitoring and logging traffic based on your rules.

🛡️ Summary and Next Steps

With Suricata installed and configured, your robot now has:

✅ Real-time intrusion detection
✅ Visibility into ROS 2 DDS traffic
✅ A scalable security foundation for Zero Trust deployments

You're now protected against common threats that might slip past firewalls or go undetected at the system level.

🔜 Next in the series: We'll explore how to add reporting and alerting, so your robot can notify you when suspicious behavior occurs—further closing the loop on real-time defense.

Looking to learn more about ROS2 security, SROS2 node permissions, or robotic system hardening? Bookmark this series and follow along as we secure each layer of our Linux-based robotic system.

For more content like this, tools, and walkthroughs, visit my site at Sebos Technology.