SLIPS on Ubuntu 24.04 LTS

Overview

SLIPS (Stratosphere Linux IPS) is a free, open source behavioural network intrusion detection and prevention system from the Stratosphere Laboratory. Rather than matching packets against fixed signatures, it hands captured traffic to Zeek to reconstruct connection flows, builds a behavioural profile for every host it sees inside Redis, and raises evidence and alerts from a suite of detection modules covering port scans, long and unusual connections, threat intelligence blacklists, command and control channel behaviour and malicious TLS fingerprints. It can analyse a live interface, act as an inline sensor on traffic routed through it, or run offline over packet captures for forensics, and it writes its findings to structured alert files that downstream tooling can consume.

This image is honest about scope. SLIPS's core mechanism, profiling the traffic it is handed, works exactly as designed on a cloud virtual network. What the platform constrains is visibility: a virtual network interface receives only the frames addressed to it, so this appliance inspects its own machine's traffic out of the box, inspects everything you deliberately route through it once you enable IP forwarding and a user defined route, and reads captures taken elsewhere, but it cannot passively monitor a neighbouring machine's traffic the way a physical network tap or a SPAN port can. The guide says so plainly rather than leaving you to discover it.

Common uses

• Behavioural intrusion detection on a virtual machine's own network traffic
• Inline behavioural inspection of a subnet's traffic as a routed network appliance
• Offline behavioural analysis and forensics of packet captures taken elsewhere