Suricata
Signature-based intrusion detection for industrial traffic.
Suricata is an open-source intrusion detection and prevention engine that evaluates network traffic against signature rules and raises an alert when one matches.
In an industrial context its value and its limits are both specific. Suricata is strong on known bad — CVE patterns, exploit attempts, scanning activity, anything already characterised and written into a rule. It can also run inline as an IPS and drop traffic, which passive monitoring tools cannot do.
One detail decides whether it sees industrial traffic at all: the Modbus, DNP3 and EtherNet/IP application-layer parsers ship disabled in a stock configuration. Enabling them is a one-line change per protocol, and on Suricata 7 and later a rule using a disabled protocol keyword is rejected at load time rather than failing silently.
Inside Labshock, Suricata receives mirrored industrial traffic through Surge Router, so rules can be exercised against live protocol behaviour from a running process rather than against a replayed capture.
A signature engine answers one question well: is this something somebody has already seen and described?
That covers a great deal of real risk, and it covers none of the activity that is technically valid — a write to a coil, a breaker operation, a setpoint change — where the packet breaks no rule and the process still moves.
Suricata sits in Labshock as the known-bad half of detection, paired with tools that record what happened rather than judging it.