Snort/Suricata tuner
Tune a rule with the traffic in hand
Load a capture of the false positive, optionally a capture of the real activity, and the rule. We show why it fired, where the strings sit, the traffic itself so you can tune on its content (select text, such as a table name, to build an exclusion), and the narrowest rule change that fixes it, re-checked against both captures.
Runs only in your browser. What you paste or load here is never uploaded, saved, or sent anywhere. This page cannot make network requests at all, and it uses no cookies or storage. Reloading or closing the tab clears everything.
Read this first.
- Your captures stay in your browser. They are read here and never uploaded. They can still contain sensitive data, so use the address masking below before you share a screen or copy any text.
- The numbers come from a simulation. It follows Suricata and Snort matching rules for the options it supports and says when it has to guess. The engine is the final judge: the page gives you the command to check every change.
- Tuning is not the same as fixing. Only change a rule after you have checked the history and know what causes the alert. Rule text stays locked until you confirm that.
- A tuned rule can be dodged. The narrower the window, the easier it is to move an attack outside it. Each suggestion shows its risk.
1. Your engine and rule
2. Your captures
Without a true-positive capture the page can only describe what matched. It cannot prove a change keeps detecting the attack.
3. Hide real addresses
4. Analyze
Or try an example (it builds a small capture in this page):
What offset, depth, distance and within mean
When network activity is abnormal
These patterns deserve investigation, not tuning.