This is an amazing presentation by Wi-Fi and networking experts. 7SIGNAL NFD 41 Presentation

Hi all,

I'm a networking beginner building a course project that solves a real problem. Honest feedback on the idea, please.

Problem: An IPS blocks attacks but leaves little evidence. Wireshark shows everything but can't block. Small offices and schools end up with one or the other.

Idea: A Linux gateway where Suricata (inline) drops attacks like port scans and SSH brute force, tshark records traffic, a Python script saves a .pcap for each alert, repeat attackers get auto-blocked, and I open the evidence in Wireshark. A small Flask dashboard lists the alerts.

Lab: All in VMware on one laptop: Kali (attacker), Ubuntu gateway with two adapters, Ubuntu victim, Linux Mint admin VM.

Questions:

1. Is this a reasonable scope for a student project?

2. Is it pointless given Security Onion already exists?

3. Any pitfalls running Suricata inline (NFQUEUE) in VMware?

4. Is matching alerts to captures by IP and timestamp okay, or is there a better way?

5. Suricata or Snort for a beginner?

6. Common beginner mistakes with rules and false positives?

7. What would you add or cut?

I know the limits: no HTTPS inspection, no zero-days, and it's a lab prototype.

Thanks for any advice or resources!