In this module
NF1.2 VM Setup and Linux Preparation
You've installed Linux before — either for the IR/LX courses on this platform or in your own lab. This sub covers the specific configuration choices that matter for a network sensor: minimal installation, NTP, package prerequisites, and interface preparation. If you already have an Ubuntu 24.04 VM, skip to the prerequisites section.
A sensor VM that's configured like a desktop workstation wastes resources and introduces unnecessary attack surface. A sensor needs: a minimal OS installation, accurate time synchronisation, the right kernel headers for packet capture libraries, and a clean network configuration that separates the management interface (for SSH and updates) from the capture interface (for traffic observation).
This sub walks through the Ubuntu installation and post-install configuration specific to the sensor role. If you already have an Ubuntu 24.04 VM, skip the installation section and start at "Post-Installation Configuration."
Deliverable: A configured Ubuntu 24.04 VM with NTP synchronised, kernel headers installed, build prerequisites in place, and the system ready for Zeek and Suricata installation in NF1.3 and NF1.5.
Figure NF1.2 — The sensor VM setup sequence. Steps 1-2 are standard Ubuntu installation. Steps 3-4 are sensor-specific configuration. Step 5 creates a snapshot you can restore to if anything goes wrong during tool installation.
Ubuntu Installation
If you already have an Ubuntu 24.04 VM, skip to "Post-Installation Configuration." This section covers the installation choices specific to the sensor role.
Create the VM with the specifications from NF1.1: 2 CPU cores, 4 GB RAM, 40 GB disk (thin provisioned), one NAT network adapter. Attach the Ubuntu 24.04 LTS ISO and boot.
During the Ubuntu installer, the key choices for a sensor VM are the installation type (minimal for server, or standard desktop if you want the Wireshark GUI), the hostname (use something descriptive like nf-sensor — you'll reference this in investigation notes), and the user account (a standard account with sudo access — don't use root directly).
For the disk layout, use the default guided partitioning. The sensor doesn't need custom partitioning unless you're planning to store large PCAP files separately, which isn't necessary for the course lab.
After installation completes, log in and verify network connectivity:
ping -c 3 8.8.8.8
ping -c 3 archive.ubuntu.comIf both succeed, your NAT adapter is working and you have internet access for package installation.
Post-Installation Configuration
These steps prepare the system for Zeek and Suricata. Run them in order — the later steps depend on earlier ones.
Step 1 — System update
Update all packages and reboot to ensure you're running the latest kernel. Zeek and Suricata build against kernel headers, so the running kernel must match the installed headers.
sudo apt update && sudo apt upgrade -y
sudo rebootAfter reboot, verify the kernel version:
uname -rRecord this version — you'll need it if you troubleshoot capture interface issues later.
Step 2 — Time synchronisation
Install and configure chrony for NTP. This is the most critical system configuration for a sensor — NF0.9 covered why.
sudo apt install -y chronyVerify chrony is synchronised:
chronyc sources -vThe output shows your NTP sources with their synchronisation status. At least one source should show * (selected) or + (good candidate). The offset should be under 10 milliseconds. If all sources show ? (unreachable), check your network configuration — the NAT adapter needs to allow outbound NTP (UDP port 123).
To verify the system clock is accurate:
timedatectlConfirm System clock synchronized: yes and NTP service: active. If NTP service is not active, enable it:
sudo timedatectl set-ntp trueStep 3 — Build prerequisites
Install the packages required to build and run Zeek and Suricata:
sudo apt install -y build-essential cmake make gcc g++ flex bison \
libpcap-dev libssl-dev python3 python3-dev python3-pip swig \
zlib1g-dev libmagic-dev libjson-c-dev libjansson-dev \
libyaml-dev libpcre2-dev rustc cargo pkg-config \
net-tools curl wget git ethtool jqThis installs the compilers, packet capture libraries, cryptographic libraries, and utility tools that Zeek and Suricata need. The specific packages:
libpcap-dev provides the packet capture API that both tools use. libssl-dev provides TLS parsing libraries. python3-dev is required for Zeek's scripting language bindings. ethtool is used to configure the capture interface. jq processes JSON-format logs.
Verify the key libraries are installed:
dpkg -l | grep -E "libpcap-dev|libssl-dev|python3-dev"All three should show ii (installed).
Step 4 — Kernel headers
Install the kernel headers matching your running kernel. These are required for AF_PACKET and other capture mechanisms:
sudo apt install -y linux-headers-$(uname -r)Verify:
ls /usr/src/linux-headers-$(uname -r)/You should see the kernel build directory with Makefile, include/, and other build artifacts.
Step 5 — Create working directories
Create the directory structure for Zeek logs, Suricata logs, and PCAP storage:
sudo mkdir -p /opt/sensor/{zeek-logs,suricata-logs,pcap,lab-packs}
sudo chown -R $USER:$USER /opt/sensor/This keeps all sensor data in one location (/opt/sensor/) rather than scattered across the filesystem. When you need to check disk usage or back up the sensor data, it's in one place.
Step 6 — Snapshot
Take a VM snapshot now. Label it "Pre-tool-install — Ubuntu configured, NTP, prerequisites." If anything goes wrong during Zeek or Suricata installation, you can restore to this clean state rather than reinstalling Ubuntu.
In VMware Workstation: VM → Snapshot → Take Snapshot. In VirtualBox: Machine → Take Snapshot. In Hyper-V: right-click VM → Checkpoint.
Your Ubuntu installation offers two options: Desktop (with GUI) or Server (CLI only). For the sensor role, which do you choose?
Desktop adds approximately 2 GB of disk usage and 200-400 MB of RAM overhead. It also installs a graphical display manager, NetworkManager, and numerous desktop applications. The GUI isn't required for Zeek or Suricata — both are command-line tools. But Wireshark's GUI is used extensively in NF3-NF7 for PCAP analysis.
Server is leaner and more production-appropriate. You can install Wireshark separately (sudo apt install wireshark) and use X11 forwarding to display the GUI on your host machine. But X11 forwarding adds complexity and latency.
For the course lab, Desktop is recommended — the Wireshark GUI is used frequently enough that the convenience outweighs the overhead. For a production sensor, Server is appropriate because the sensor's job is to capture and parse, not to run Wireshark.
You should harden a production sensor — disable unnecessary services, configure host-based firewall rules, restrict SSH access. But hardening the lab sensor before you've installed and validated the tools is premature optimization that can cause troubleshooting confusion.
Build the sensor first. Validate that Zeek and Suricata work correctly. Confirm your logs are being generated. Then harden. If you lock down SSH, disable services, and tighten firewall rules before installation, you'll spend time debugging connectivity issues that are hardening-induced rather than tool-related.
The production hardening checklist is covered in NF1.9 (Sensor Maintenance). For the lab, a default Ubuntu installation with a strong password and SSH key authentication is sufficient.
echo "=== SENSOR READINESS CHECK ==="
echo "Kernel: $(uname -r)"
echo "NTP: $(chronyc tracking | grep 'Leap status')"
echo "libpcap: $(dpkg -l libpcap-dev 2>/dev/null | grep '^ii' | awk '{print $3}')"
echo "tcpdump: $(tcpdump --version 2>&1 | head -1)"
echo "python3: $(python3 --version)"
echo "gcc: $(gcc --version | head -1)"
echo "Sensor dir: $(ls /opt/sensor/ 2>/dev/null || echo 'MISSING')"
echo "Disk free: $(df -h / | tail -1 | awk '{print $4}')"
echo "RAM: $(free -h | grep Mem | awk '{print $2}')"Try it: Verify your complete system readiness
Setup. Your Ubuntu VM with all post-installation steps completed.
Task. Run the following verification script and confirm all checks pass:
Expected result. All lines show valid output. Disk free should be at least 20 GB. RAM should be at least 4 GB. No lines should show "MISSING" or error messages.
Debugging branch. If libpcap shows empty: sudo apt install -y libpcap-dev. If NTP shows "Not synchronised": wait 5 minutes and recheck — chrony takes time to synchronise after installation. If disk free is low: delete unnecessary packages with sudo apt autoremove.
You've built the sensor and mapped the evidence landscape.
NF0 established why network evidence matters when every other source is compromised. NF1 built your Zeek + Suricata sensor with the 10 investigation query patterns. From here, every module teaches protocol-specific investigation against real attack scenarios.
- DNS deep dive (NF3) — tunnelling detection, DGA analysis, passive DNS infrastructure mapping, and the INC-NE-2026-0227 AiTM phishing DNS trail
- Protocol analysis (NF4–NF7) — HTTP/HTTPS, SMB lateral movement, SSH tunnelling, and email protocol investigation with Zeek metadata and PCAP
- Detection and hunting (NF8–NF11) — Suricata rule writing, C2 beacon detection with JA3, NetFlow analytics, and proactive network threat hunting
- NSM architecture (NF13) — production sensor deployment at 1–10 Gbps with Arkime, Security Onion, and enterprise storage planning
- INC-NE-2026-0830 capstone (NF14) — multi-stage investigation using only network evidence: phishing → domain-fronted C2 → lateral movement → DNS tunnel exfiltration
Cancel anytime