{"id":11302,"date":"2026-05-08T18:23:56","date_gmt":"2026-05-08T16:23:56","guid":{"rendered":"https:\/\/www.sigalou-domotique.fr\/?p=11302"},"modified":"2026-05-15T14:19:34","modified_gmt":"2026-05-15T12:19:34","slug":"je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard","status":"publish","type":"post","link":"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard","title":{"rendered":"I monitor my home network with Home Security Assistant"},"content":{"rendered":"<p>The security of home networks has become a real concern.<\/p>\n<p>Between connected objects, voice assistants, IP cameras, NAS, smartphones and home automation equipment, our local networks increasingly resemble small corporate networks.<\/p>\n<p>And we will not escape mass attacks by cybercriminals.<\/p>\n<p>After several years of upgrading my home automation system, I wanted to add a passive network monitoring layer:<\/p>\n<ul>\n<li>without impacting performance;<\/li>\n<li>without changing traffic;<\/li>\n<li>and without turning the grid into a gas plant.<\/li>\n<\/ul>\n<p><!--more--><\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-light-blue ez-toc-container-direction\">\n<label for=\"ez-toc-cssicon-toggle-item-6ae4fc380dbcc\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewbox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewbox=\"0 0 24 24\" version=\"1.2\" baseprofile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ae4fc380dbcc\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%8D_Pourquoi_je_surveille_mon_reseau_local\" >\ud83d\udd0d Why do I monitor my local network?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%8E%AF_Mon_objectif_avec_cette_installation\" >\ud83c\udfaf My goal with this installation<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%8C%90_Mon_architecture_reseau\" >\ud83c\udf10 My Network Architecture<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%AA%9E_Je_mets_en_place_du_port_mirroring\" >\ud83e\ude9e I set up port mirroring<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%92%B8_Combien_cela_ma_coute\" >\ud83d\udcb8 How much did it cost me?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A7%B0_Le_materiel_que_jutilise\" >\ud83e\uddf0 The equipment I use<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%8C_Je_choisis_le_switch_manageable_Zyxel_GS1200-5\" >\ud83d\udd0c I choose the Zyxel GS1200-5 manageable switch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A5%A7_Je_prepare_le_Raspberry_Pi\" >\ud83e\udd67 I prepare the Raspberry Pi<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A7%A0_Pourquoi_je_prefere_un_switch_miroir_plutot_quun_firewall_IDS\" >\ud83e\udde0 Why do I prefer a mirror switch over an IDS firewall?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%A7_Je_configure_le_switch_Zyxel_GS1200-5\" >\ud83d\udd27 I configure the Zyxel GS1200-5 switch<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%9A%80_Je_fais_la_premiere_mise_en_route_du_switch\" >\ud83d\ude80 I make the first start of the switch<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%8C%90_Jaccede_au_switch_sur_le_reseau_local\" >\ud83c\udf10 I access the switch on the local network<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%80_Je_configure_les_ports\" >\ud83d\udd00 I configure ports<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%AA%9E_Je_configure_le_Port_Mirroring\" >\ud83e\ude9e I configure the Port Mirroring<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9D%93_Pourquoi_je_ne_mirror_pas_tous_les_ports\" >\u2753 Why don't I mirror all the ports?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%8F%B7%EF%B8%8F_Je_laisse_les_VLAN_par_defaut\" >\ud83c\udff7  I leave VLANs by default<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9A%99%EF%B8%8F_Je_laisse_QoS_LAG_et_IGMP_presque_par_defaut\" >\u2699  I leave QoS, LAG and IGMP almost by default<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A5%A7_Jinstalle_le_Raspberry_Pi_de_supervision_reseau\" >\ud83e\udd67 I install the Raspberry Pi network monitoring<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A4%94_Pourquoi_jutilise_un_Raspberry_Pi\" >\ud83e\udd14 Why do I use a Raspberry Pi?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%92%BE_Je_choisis_le_stockage\" >\ud83d\udcbe I choose storage<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A7%B0_Jinstalle_le_systeme\" >\ud83e\uddf0 I install the system<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A9%BA_Je_verifie_que_la_base_systeme_est_saine\" >\ud83e\ude7a I check that the system base is healthy<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%9B%A1%EF%B8%8F_Jinstalle_Suricata\" >\ud83d\udee1  I install Suricata<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%93%9A_Jinstalle_les_regles_de_detection\" >\ud83d\udcda I install the detection rules<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%A7_Je_configure_le_reseau_du_Raspberry\" >\ud83d\udd27 I configure the Raspberry network<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%8C_Je_branche_le_port_miroir\" >\ud83d\udd0c I plug in the mirror port<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%93%A1_Je_fais_un_premier_test_de_capture_reseau\" >\ud83d\udce1 I do a first network capture test<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9A%99%EF%B8%8F_Je_configure_Suricata\" >\u2699  I configure Suricata<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%9A%80_Je_demarre_Suricata\" >\ud83d\ude80 I start Suricata<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%93%9C_Je_valide_les_logs_reseau\" >\ud83d\udcdc I validate network logs<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%97%82%EF%B8%8F_Je_mets_en_place_une_rotation_automatique_des_logs\" >\ud83d\uddc2  I set up an automatic log rotation<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-32\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%93%A1_Jexporte_les_flux_reseau_vers_Home_Assistant_avec_softflowd\" >\ud83d\udce1 I export network flows to Home Assistant with softflowd<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-33\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%93%A6_Jinstalle_softflowd\" >\ud83d\udce6 I install softflowd<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-34\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%A7%AA_Je_fais_un_premier_test_manuel\" >\ud83e\uddea I do a first manual test<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-35\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%9B%A0%EF%B8%8F_Je_cree_un_service_systemd_dedie\" >\ud83d\udee0  I create a dedicated systemd service<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-36\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9C%85_Je_verifie_le_bon_fonctionnement\" >\u2705 I check the correct functioning<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-37\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%8F%A0_Jintegre_Home_Security_Assistant_dans_Home_Assistant\" >\ud83c\udfe0 I integrate Home Security Assistant into Home Assistant<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-38\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9E%95_Jajoute_le_depot_personnalise_dans_HACS\" >\u2795 I add the custom repository in HACS<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-39\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%93%A6_Jinstalle_lintegration\" >\ud83d\udce6 I install the integration<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-40\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%94%8C_Jajoute_lintegration_dans_Home_Assistant\" >\ud83d\udd0c I add integration in Home Assistant<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-41\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9A%99%EF%B8%8F_Je_configure_Home_Security_Assistant\" >\u2699  I configure Home Security Assistant<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-42\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%E2%9C%85_Validation_finale_de_la_configuration\" >\u2705 Final configuration validation<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-43\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%91%80_Premieres_impressions_apres_la_mise_en_route\" >\ud83d\udc40 First impressions after start-up<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-44\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#%F0%9F%8E%AF_Conclusion\" >\ud83c\udfaf Conclusion<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-45\" href=\"https:\/\/www.sigalou-domotique.fr\/en\/je-surveille-mon-reseau-domestique-et-je-laffiche-sur-mon-dasboard\/#Question_Besoin_daide\" >Question? Need help?<\/a><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%94%8D_Pourquoi_je_surveille_mon_reseau_local\"><\/span>\ud83d\udd0d Why do I monitor my local network?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Most connected equipment constantly communicates with the Internet:<\/p>\n<ul>\n<li>Connected TVs;<\/li>\n<li>voice assistants;<\/li>\n<li>home automation sockets;<\/li>\n<li>cameras;<\/li>\n<li>IoT objects;<\/li>\n<li>mobile applications;<\/li>\n<li>etc.<\/li>\n<\/ul>\n<p>The problem:<\/p>\n<ul>\n<li>it is not always clear what they are sending;<\/li>\n<li>nor to whom;<\/li>\n<li>and how often.<\/li>\n<\/ul>\n<p>Network monitoring makes it possible in particular to:<\/p>\n<ul>\n<li>detecting unknown devices;<\/li>\n<li>identify suspicious behaviour;<\/li>\n<li>to see which equipment speaks outwards;<\/li>\n<li>identify network scans;<\/li>\n<li>identify abnormal flows;<\/li>\n<li>or simply to better understand your network.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%8E%AF_Mon_objectif_avec_cette_installation\"><\/span>\ud83c\udfaf My goal with this installation<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The objective was simple:<\/p>\n<ul>\n<li>observe network traffic;<\/li>\n<li>detecting abnormal behaviour;<\/li>\n<li>centralise alerts in Home Assistant;<\/li>\n<li>while remaining 100 % local.<\/li>\n<\/ul>\n<p>To do this, I chose an architecture based on:<\/p>\n<ul>\n<li>a manageable switch with mirroring port;<\/li>\n<li>a Raspberry Pi dedicated to network analysis;<\/li>\n<li>and Home Security Assistant integration for Home Assistant.<\/li>\n<\/ul>\n<p>But I wanted a solution:<\/p>\n<ul>\n<li>passive;<\/li>\n<li>discreet;<\/li>\n<li>reliable;<\/li>\n<li>local;<\/li>\n<li>and independent of the router.<\/li>\n<\/ul>\n<p>The principle adopted is that used in many professional environments.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%8C%90_Mon_architecture_reseau\"><\/span>\ud83c\udf10 My Network Architecture<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>My network is organised as follows:<\/p>\n<pre>Internet \u2193 Freebox (bridge mode) \u2193 Router Synology \u2193 Switch manageable Zyxel GS1200-5 \u251c\u2500\u2500 other switches \u2514\u2500\u2500 port mirror \u2192 Raspberry Pi IDS\r\n<\/pre>\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2.png\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11313\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2.png\" alt=\"\" width=\"800\" height=\"533\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2.png 1536w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-300x200.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1024x683.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-768x512.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-600x400.png 600w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" \/><\/a><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%AA%9E_Je_mets_en_place_du_port_mirroring\"><\/span>\ud83e\ude9e I set up port mirroring<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The switch duplicates network traffic from a specific port and sends it to another port dedicated to analysis. We usually talk about <strong>Mirroring Port<\/strong>, or <strong>SPAN<\/strong>.<\/p>\n<p>For example:<\/p>\n<ul>\n<li>the Raspberry Pi receives a copy of the packages;<\/li>\n<li>without being visible on the network;<\/li>\n<li>without changing traffic;<\/li>\n<li>and without becoming a critical point of the infrastructure.<\/li>\n<\/ul>\n<p>And honestly, if he falls, if he burns, if he is tired of working for me, it will have no impact on the home automation installation of the house.<\/p>\n<p>And for the good health of my relationships with the rest of my small family, my crafts should not prevent the lights from turning on or the watering from going off.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%92%B8_Combien_cela_ma_coute\"><\/span>\ud83d\udcb8 How much did it cost me?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Setting up a security probe in my home was not going to cost me much, as the family budget had many other priorities.<\/p>\n<p>Thus, the only financial investment was the addition of a manageable switch that I detail just after. It cost me: <strong>17,36 \u20ac<\/strong>.<\/p>\n<p><a href=\"https:\/\/www.sigalou-domotique.fr\/en\/product\/gs1200-5\/\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11324\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/commande.jpg\" alt=\"\" width=\"628\" height=\"256\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/commande.jpg 628w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/commande-300x122.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/commande-600x245.jpg 600w\" sizes=\"auto, (max-width: 628px) 100vw, 628px\" \/><\/a><\/p>\n<ul>\n<li>cf. <a href=\"https:\/\/www.sigalou-domotique.fr\/en\/product\/gs1200-5\/\" target=\"_blank\" rel=\"noopener\">Page dedicated to this product with sellers, price or promo<\/a><\/li>\n<\/ul>\n<p>I already had the Ethernet cables and an old Raspberry Pi 3B+ in a drawer.<\/p>\n<p>If you need to buy a Raspberry Pi 3B+, you will find it used for around \u20ac40. I would take no less than: 3B+ seems to me to be the minimum for this type of use. And if you have a choice, directly prefer a Raspberry Pi 4.<\/p>\n<p>So we arrive at an overall budget of around 60 \u20ac if you have to buy the switch and the Raspberry.<\/p>\n<p>And if you replace the SD card with a SATA SSD, there is no need to take huge: a model of 20 to 32 GB is more than enough. In USB via a small box, it is convenient and easy to use.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A7%B0_Le_materiel_que_jutilise\"><\/span>\ud83e\uddf0 The equipment I use<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%94%8C_Je_choisis_le_switch_manageable_Zyxel_GS1200-5\"><\/span>\ud83d\udd0c I choose the Zyxel GS1200-5 manageable switch<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11306\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183329.png\" alt=\"\" width=\"337\" height=\"207\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183329.png 888w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183329-300x184.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183329-768x471.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183329-600x368.png 600w\" sizes=\"auto, (max-width: 337px) 100vw, 337px\" \/><\/p>\n<p>I chose:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.sigalou-domotique.fr\/en\/product\/gs1200-5\/\" target=\"_blank\" rel=\"noopener\">Zyxel GS1200-5 v3<\/a><\/li>\n<\/ul>\n<p>Why this model:<\/p>\n<ul>\n<li>compact;<\/li>\n<li>silencer;<\/li>\n<li>low consumption;<\/li>\n<li>simple web administration;<\/li>\n<li>support for the mirroring port;<\/li>\n<li>really very reasonable price.<\/li>\n<\/ul>\n<p>This is an excellent compromise for a home automation laboratory or an advanced residential network.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%A5%A7_Je_prepare_le_Raspberry_Pi\"><\/span>\ud83e\udd67 I prepare the Raspberry Pi<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The Raspberry Pi will serve as a network probe.<\/p>\n<p>The Raspberry:<\/p>\n<ul>\n<li>does not drive anything;<\/li>\n<li>does not filter anything;<\/li>\n<li>does not serve as a firewall;<\/li>\n<li>it simply listens to the mirror traffic sent by the switch.<\/li>\n<\/ul>\n<p>I recommend:<\/p>\n<ul>\n<li>Raspberry Pi 4 with a minimum of 4 GB, even though I used a Raspberry Pi 3B+ that I already had;<\/li>\n<li>Ideally with a USB SSD.<\/li>\n<\/ul>\n<p>Why avoid the SD card:<\/p>\n<ul>\n<li>IDS tools write a lot of logs;<\/li>\n<li>SD cards wear out quickly.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A7%A0_Pourquoi_je_prefere_un_switch_miroir_plutot_quun_firewall_IDS\"><\/span>\ud83e\udde0 Why do I prefer a mirror switch over an IDS firewall?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Some solutions such as:<\/p>\n<ul>\n<li>pfSense;<\/li>\n<li>OPNsense;<\/li>\n<li>or Suricata directly on the router;<\/li>\n<\/ul>\n<p>They are very powerful.<\/p>\n<p>But in my case I wanted to:<\/p>\n<ul>\n<li>separate the analysis from the main network;<\/li>\n<li>avoid any network outages linked to the IDS;<\/li>\n<li>keep a modular architecture;<\/li>\n<li>be able to stop the analysis without impacting the Internet.<\/li>\n<\/ul>\n<p>Passive mode brings several advantages:<\/p>\n<ul>\n<li>no latency;<\/li>\n<li>no impact on traffic;<\/li>\n<li>no network dependencies;<\/li>\n<li>simplicity;<\/li>\n<li>security.<\/li>\n<\/ul>\n<p>Even if Raspberry plants:<\/p>\n<p>\u2192 the network continues to function normally.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%94%A7_Je_configure_le_switch_Zyxel_GS1200-5\"><\/span>\ud83d\udd27 I configure the Zyxel GS1200-5 switch<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11307\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-scaled.jpg\" alt=\"\" width=\"651\" height=\"455\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-scaled.jpg 2560w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-300x210.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-1024x716.jpg 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-768x537.jpg 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-1536x1073.jpg 1536w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-2048x1431.jpg 2048w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/ordiportable-600x419.jpg 600w\" sizes=\"auto, (max-width: 651px) 100vw, 651px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%9A%80_Je_fais_la_premiere_mise_en_route_du_switch\"><\/span>\ud83d\ude80 I make the first start of the switch<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Before integrating the switch into the main network, I started by making an initial configuration with a direct connection to a laptop.<\/p>\n<p>This method makes it possible to:<\/p>\n<ul>\n<li>to configure the switch quietly out of production;<\/li>\n<li>avoid any network conflict;<\/li>\n<li>immediately secure administrator access;<\/li>\n<li>and prepare the mirroring port before integration into the real network.<\/li>\n<\/ul>\n<p>After unpacking:<\/p>\n<ul>\n<li>connection of the power supply;<\/li>\n<li>connection of the laptop to port 1 of the switch;<\/li>\n<li>temporary deactivation of Wi-Fi on the computer;<\/li>\n<li>and configuration of a static IP address on the Ethernet network card.<\/li>\n<\/ul>\n<p>By default, the Zyxel switch uses the address:<\/p>\n<pre>192.168.1.3<\/pre>\n<p>I have therefore temporarily configured the PC with:<\/p>\n<table>\n<thead>\n<tr>\n<th>Parameter<\/th>\n<th>Value<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>IP address<\/td>\n<td>192.168.1.50<\/td>\n<\/tr>\n<tr>\n<td>Mask<\/td>\n<td>24<\/td>\n<\/tr>\n<tr>\n<td>Gateway<\/td>\n<td>192.168.1.1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Once both devices are in the same subnet, the switch immediately responds to the ping.<\/p>\n<p>Web administration only works in HTTPS on recent firmwares. The connection is therefore made via:<\/p>\n<pre>https:\/\/192.168.1.3<\/pre>\n<p>The browser then displays a self-signed SSL certificate warning, which is perfectly normal on this type of equipment.<\/p>\n<p>On first connection:<\/p>\n<ul>\n<li>the switch immediately asks for the administrator password to be changed;<\/li>\n<li>then access to the configuration interface becomes available.<\/li>\n<\/ul>\n<p>I then:<\/p>\n<ul>\n<li>disabled the DHCP client of the switch;<\/li>\n<li>assigned a fixed IP address, optional but I put <code>192.168.1.11<\/code> ;<\/li>\n<li>and saved the configuration before integration to the main network.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11310\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-184232.png\" alt=\"\" width=\"650\" height=\"407\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-184232.png 994w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-184232-300x188.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-184232-768x481.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-184232-600x375.png 600w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>This preparation stage makes it possible to have immediately:<\/p>\n<ul>\n<li>a properly configured switch;<\/li>\n<li>a known administrative address;<\/li>\n<li>and a stable configuration before going into production.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%8C%90_Jaccede_au_switch_sur_le_reseau_local\"><\/span>\ud83c\udf10 I access the switch on the local network<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The switch is now accessible via HTTPS:<\/p>\n<pre>https:\/\/192.168.1.11<\/pre>\n<p>I can stay on my laptop live or connect it to the local network. The switch now has its fixed IP, so no conflict.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11308\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183804.png\" alt=\"\" width=\"650\" height=\"371\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183804.png 1023w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183804-300x171.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183804-768x438.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-183804-600x343.png 600w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%94%80_Je_configure_les_ports\"><\/span>\ud83d\udd00 I configure ports<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Configuration chosen:<\/p>\n<table>\n<thead>\n<tr>\n<th>Port<\/th>\n<th>Use<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Port 1<\/td>\n<td>Synology Router<\/td>\n<\/tr>\n<tr>\n<td>Port 2<\/td>\n<td>Local network<\/td>\n<\/tr>\n<tr>\n<td>Port 3<\/td>\n<td>Local network<\/td>\n<\/tr>\n<tr>\n<td>Port 4<\/td>\n<td>Local network<\/td>\n<\/tr>\n<tr>\n<td>Port 5<\/td>\n<td>Raspberry Pi IDS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>I prepare a small label that I will stick on the switch.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11335\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/switch-mirroring.jpg\" alt=\"\" width=\"447\" height=\"112\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/switch-mirroring.jpg 945w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/switch-mirroring-300x75.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/switch-mirroring-768x193.jpg 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/switch-mirroring-600x150.jpg 600w\" sizes=\"auto, (max-width: 447px) 100vw, 447px\" \/><\/p>\n<p>and here is the result:<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11336\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-scaled.jpg\" alt=\"\" width=\"653\" height=\"490\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-scaled.jpg 2560w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-300x225.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-1024x768.jpg 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-768x576.jpg 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-1536x1152.jpg 1536w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-2048x1536.jpg 2048w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260508_172509-600x450.jpg 600w\" sizes=\"auto, (max-width: 653px) 100vw, 653px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%AA%9E_Je_configure_le_Port_Mirroring\"><\/span>\ud83e\ude9e I configure the Port Mirroring<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The principle:<\/p>\n<ul>\n<li>copy traffic from the port connected to the router;<\/li>\n<li>towards the port of the Raspberry Pi.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11309\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-164208.png\" alt=\"\" width=\"650\" height=\"372\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-164208.png 967w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-164208-300x172.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-164208-768x439.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-08-164208-600x343.png 600w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>Parameters configured:<\/p>\n<table>\n<thead>\n<tr>\n<th>Parameter<\/th>\n<th>Value<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Port Mirroring<\/td>\n<td>Enable<\/td>\n<\/tr>\n<tr>\n<td>Mirror Direction<\/td>\n<td>Both<\/td>\n<\/tr>\n<tr>\n<td>Mirrored Port<\/td>\n<td>Port 1<\/td>\n<\/tr>\n<tr>\n<td>Monitor Port<\/td>\n<td>Port 5<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The \u2018Both\u2019 mode is important: it allows you to see incoming AND outgoing traffic.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E2%9D%93_Pourquoi_je_ne_mirror_pas_tous_les_ports\"><\/span>\u2753 Why don't I mirror all the ports?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This is a question that often comes up.<\/p>\n<p>In practice:<\/p>\n<ul>\n<li>monitoring the port of the router is more than enough;<\/li>\n<li>this already makes it possible to observe all internet traffic;<\/li>\n<li>without unnecessarily overloading the Raspberry Pi.<\/li>\n<\/ul>\n<p>Mirror all ports:<\/p>\n<ul>\n<li>greatly increases the volume of traffic;<\/li>\n<li>generates duplicates;<\/li>\n<li>and can saturate the analysis system.<\/li>\n<\/ul>\n<p>For a home network, the mirroring of the router port is largely sufficient.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%8F%B7%EF%B8%8F_Je_laisse_les_VLAN_par_defaut\"><\/span>\ud83c\udff7  I leave VLANs by default<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11338\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142016.png\" alt=\"\" width=\"650\" height=\"461\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142016.png 966w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142016-300x213.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142016-768x545.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142016-600x425.png 600w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>No particular VLAN configuration was needed, I left everything by default.<\/p>\n<p>All ports remain:<\/p>\n<ul>\n<li>in VLAN 1;<\/li>\n<li>in untagged mode.<\/li>\n<\/ul>\n<p>For a classic residential installation, it works perfectly.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%E2%9A%99%EF%B8%8F_Je_laisse_QoS_LAG_et_IGMP_presque_par_defaut\"><\/span>\u2699  I leave QoS, LAG and IGMP almost by default<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11339\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142139.png\" alt=\"\" width=\"649\" height=\"554\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142139.png 966w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142139-300x256.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142139-768x656.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-142139-600x512.png 600w\" sizes=\"auto, (max-width: 649px) 100vw, 649px\" \/><\/p>\n<p>The other advanced functions of the switch have been left by default:<\/p>\n<ul>\n<li>no Link Aggregation;<\/li>\n<li>no specific QoS;<\/li>\n<li>IGMP Snooping activated;<\/li>\n<li>EEA disabled.<\/li>\n<\/ul>\n<p>The aim is to keep:<\/p>\n<ul>\n<li>simple behaviour;<\/li>\n<li>stable;<\/li>\n<li>predictable.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%A5%A7_Jinstalle_le_Raspberry_Pi_de_supervision_reseau\"><\/span>\ud83e\udd67 I install the Raspberry Pi network monitoring<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once the manageable switch was configured and the mirroring port was operational, it was now necessary to set up the network sensor capable of analysing the traffic of the home network.<\/p>\n<p>The aim was not to block traffic or replace the router, but simply to set up a fully passive monitoring system capable of observing what is happening on the local network.<\/p>\n<p>The idea is simple: the Zyxel switch duplicates network traffic with the mirroring port, then sends this copy to a Raspberry Pi dedicated to analysis.<\/p>\n<p>The Raspberry then becomes a kind of \u2018network surveillance camera\u2019, capable of observing connected equipment, external connections, DNS exchanges, TLS flows, suspicious behaviour or certain known attacks.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%A4%94_Pourquoi_jutilise_un_Raspberry_Pi\"><\/span>\ud83e\udd14 Why do I use a Raspberry Pi?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The Raspberry Pi is perfect for this type of use:<\/p>\n<ul>\n<li>low power consumption;<\/li>\n<li>completely silent operation;<\/li>\n<li>reduced cost;<\/li>\n<li>compact format;<\/li>\n<li>perfect for 24-hour operation.<\/li>\n<\/ul>\n<p>I had several models available at home: Raspberry Pi 3, 3B and 3B+.<\/p>\n<p>The choice was ultimately a Raspberry Pi 3B+ which offers a good compromise between power, stability and consumption.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11340\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/raspberrypi3bplus.png\" alt=\"\" width=\"439\" height=\"308\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/raspberrypi3bplus.png 860w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/raspberrypi3bplus-300x211.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/raspberrypi3bplus-768x539.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/raspberrypi3bplus-600x421.png 600w\" sizes=\"auto, (max-width: 439px) 100vw, 439px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%92%BE_Je_choisis_le_stockage\"><\/span>\ud83d\udcbe I choose storage<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>I wanted to avoid classic microSD cards.<\/p>\n<p>Even if they work very well for simple projects, they do not support long-term intensive writes, especially when it comes to generating network logs continuously.<\/p>\n<p>I have therefore chosen to use:<\/p>\n<ul>\n<li>a 2.5 SATA SSD;<\/li>\n<li>a USB to SATA adapter;<\/li>\n<li>Raspberry Pi OS Lite 64-bit.<\/li>\n<\/ul>\n<p>The objective was to obtain an installation:<\/p>\n<ul>\n<li>more reliable;<\/li>\n<li>faster;<\/li>\n<li>more sustainable;<\/li>\n<li>and more stable over time.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%A7%B0_Jinstalle_le_systeme\"><\/span>\ud83e\uddf0 I install the system<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The system was installed with Raspberry Pi Imager directly on the SSD.<\/p>\n<p>I have chosen:<\/p>\n<ul>\n<li>Raspberry Pi OS Lite 64-bit;<\/li>\n<li>pre-configured Wi-Fi connection;<\/li>\n<li>SSH activated upon installation;<\/li>\n<li>personalised host name;<\/li>\n<li>Automatically update the system after the first boot.<\/li>\n<\/ul>\n<p>As soon as it started, the Raspberry immediately appeared on the home Wi-Fi network.<\/p>\n<p>It was then assigned a fixed IP from the Synology router to facilitate remote administration.<\/p>\n<p>At this point, I set the IP address, each its own method, I do it on the Synology router but this can be done on the Raspberry, note that from here, every time I use <em><strong>192.168.1.222, it will be the IP of the Raspberry<\/strong><\/em>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%A9%BA_Je_verifie_que_la_base_systeme_est_saine\"><\/span>\ud83e\ude7a I check that the system base is healthy<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Before installing Suricata, I preferred to check that the system base was sound.<\/p>\n<p>The idea was simple: before converting the Raspberry into a 24-hour network probe, it was necessary to ensure that the system started well on the SSD, that the power supply was stable, that the temperature was correct and that the network interfaces were in the expected state.<\/p>\n<h4>\ud83d\udce6 Complete system update<\/h4>\n<pre><code>sudo apt update &amp;&amp; sudo apt full-upgrade -y<\/code><\/pre>\n<p>After the update, a restart makes it possible to restart on a clean basis:<\/p>\n<pre><code>sudo reboot<\/code><\/pre>\n<h4>\ud83d\udcbd I check that the Raspberry starts well on the SSD<\/h4>\n<pre><code>lsblk<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>sda \u251c\u2500sda1 \/boot\/firmware \u2514\u2500sda2 \/<\/code><\/pre>\n<p>The important point here is to see that the root partition <code>\/<\/code> has been well-mounted since <code>\/dev\/sda2<\/code>.<\/p>\n<p>This confirms that the Raspberry boots well on the USB SSD and not on a microSD card.<\/p>\n<h4>\ud83d\udcca I check the available disk space<\/h4>\n<pre><code>df -h<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>\/dev\/sda2 29G 3.0G 25G 11% \/ \/dev\/sda1 505M 65M 440M 13% \/boot\/firmware<\/code><\/pre>\n<p>In my case, the 32 GB SSD offers plenty of space for the system, Suricata and logs, provided that the files are rotated automatically.<\/p>\n<h4>\ud83c\udf10 I check network interfaces<\/h4>\n<pre><code>ip a<\/code><\/pre>\n<p>Expected result before connecting the mirror port:<\/p>\n<pre><code>eth0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; wlan0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; inet 192.168.1.22\/24<\/code><\/pre>\n<p>In this architecture, Wi-Fi is used to administer the Raspberry in SSH.<\/p>\n<p>The Ethernet interface <code>eth0<\/code>, it will be reserved for the capture of network traffic from the mirror port of the switch.<\/p>\n<h4>\ud83c\udf21  I check the temperature<\/h4>\n<pre><code>vcgencmd measure_temp<\/code><\/pre>\n<p>Result achieved:<\/p>\n<pre><code>temp=40.8'C<\/code><\/pre>\n<p>A temperature around 40 to 60 \u00b0C is perfectly correct for this type of use.<\/p>\n<p>The Raspberry will therefore be able to work continuously without any particular problem.<\/p>\n<h4>\ud83d\udd0c I check feeding and throttling<\/h4>\n<pre><code>vcgencmd get_throttled<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>throttled=0x0<\/code><\/pre>\n<p>This is a very important point.<\/p>\n<p>Value <code>0x0<\/code> means that the Raspberry does not detect:<\/p>\n<ul>\n<li>nor undervoltage;<\/li>\n<li>nor frequency limitation;<\/li>\n<li>no feeding problems.<\/li>\n<\/ul>\n<h4>\ud83e\udde0 I check that the system is 64 bits<\/h4>\n<pre><code>uname -a<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>aarch64 GNU\/Linux<\/code><\/pre>\n<p>The presence of <code>aarch64<\/code> Confirms that Raspberry Pi OS Lite 64-bit is installed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%9B%A1%EF%B8%8F_Jinstalle_Suricata\"><\/span>\ud83d\udee1  I install Suricata<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Once the Raspberry was fully operational, I installed the Intrusion Detection System (IDS) engine, which will analyse network traffic: Suricata.<\/p>\n<p>Suricata\u2019s choice was quite natural:<\/p>\n<ul>\n<li>open source;<\/li>\n<li>widely used in the professional world;<\/li>\n<li>advanced protocol analysis;<\/li>\n<li>support for JSON logs;<\/li>\n<li>Home Assistant compatibility;<\/li>\n<li>detection of network anomalies;<\/li>\n<li>fingerprints JA3 and JA4;<\/li>\n<li>automatic updating of the rules.<\/li>\n<\/ul>\n<h4>\ud83d\udce6 Suricata Installation<\/h4>\n<pre><code>sudo apt install suricata -y<\/code><\/pre>\n<p>Once the installation was complete, I checked the version and the compiled functionalities:<\/p>\n<pre><code>suricata --build-info<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>This is Suricata version 7.x AF_PACKET support: yes eBPF support: yes JA3 support: yes JA4 support: yes<\/code><\/pre>\n<p>This step makes it possible to confirm:<\/p>\n<ul>\n<li>Suricata is well installed;<\/li>\n<li>Linux network support is active;<\/li>\n<li>JA3\/JA4 prints are available;<\/li>\n<li>that the engine is working properly on Raspberry Pi.<\/li>\n<\/ul>\n<h4>\u2705 I check the Suricata service<\/h4>\n<pre><code>sudo systemctl status suricata<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>Active: active (running)<\/code><\/pre>\n<p>The service starts automatically at the Raspberry boot.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%93%9A_Jinstalle_les_regles_de_detection\"><\/span>\ud83d\udcda I install the detection rules<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>By default, Suricata contains almost no active rules.<\/p>\n<p>It is therefore necessary to download a database of network signatures.<\/p>\n<p>I chose the Community rules Emerging Threats Open.<\/p>\n<h4>\ud83d\udce6 Installation of suricata-update<\/h4>\n<pre><code>sudo apt install suricata-update -y<\/code><\/pre>\n<h4>\u2717 \u2717 Downloading the rules<\/h4>\n<pre><code>sudo suricata-update<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>Loaded 65950 rules Writing rules to \/var\/lib\/suricata\/rules\/suricata.rules<\/code><\/pre>\n<p>More than 50,000 detection signatures were installed automatically.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%94%A7_Je_configure_le_reseau_du_Raspberry\"><\/span>\ud83d\udd27 I configure the Raspberry network<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>At this stage, an extremely important point had to be addressed:<\/p>\n<p>The Raspberry should never communicate over the network via its capture interface.<\/p>\n<p>The port connected to the switch's mirror port must only listen for network traffic, without ever sending packets.<\/p>\n<p>For this purpose:<\/p>\n<ul>\n<li>no IP address should be present on <code>eth0<\/code> ;<\/li>\n<li>no DHCP;<\/li>\n<li>no gateway;<\/li>\n<li>no outbound traffic;<\/li>\n<li>mandatory PROMISC mode.<\/li>\n<\/ul>\n<h4>\ud83d\udd0e I identify the network operator used<\/h4>\n<pre><code>nmcli device status<\/code><\/pre>\n<p>Result achieved:<\/p>\n<pre><code>eth0 ethernet connected netplan-eth0 wlan0 wifi connected netplan-wlan0<\/code><\/pre>\n<p>This confirms that the system uses NetworkManager.<\/p>\n<h4>\ud83d\udeab I disable IPv4 and IPv6 on eth0<\/h4>\n<pre><code>sudo nmcli connection modify netplan-eth0 ipv4.method disabled sudo nmcli connection modify netplan-eth0 ipv6.method disabled<\/code><\/pre>\n<h4>\ud83d\udd04 I restart the network connection<\/h4>\n<pre><code>sudo nmcli connection down netplan-eth0 sudo nmcli connection up netplan-eth0<\/code><\/pre>\n<h4>\ud83d\udc42 I am constantly activating PROMISC mode<\/h4>\n<p>The promiscuous mode allows the network card to receive all packets copied by the switch.<\/p>\n<p>Creation of a systemd service:<\/p>\n<pre><code>sudo nano \/etc\/systemd\/system\/promisc-eth0.service<\/code><\/pre>\n<p>Content of the file:<\/p>\n<pre><code>[Unit] Description=Enable promiscuous mode on eth0 After=network.target [Service] Type=oneshot ExecStart=\/usr\/sbin\/ip link set eth0 promisc on [Install] WantedBy=multi-user.target<\/code><\/pre>\n<h4>\u25b6\u25b6 I activate the service<\/h4>\n<pre><code>sudo systemctl enable promisc-eth0 sudo systemctl start promisc-eth0<\/code><\/pre>\n<h4>\u2705 I check the network interface<\/h4>\n<pre><code>ip a<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>eth0: &lt;BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP&gt;<\/code><\/pre>\n<p>Very important:<\/p>\n<ul>\n<li>no IP address;<\/li>\n<li>no line <code>inet<\/code> ;<\/li>\n<li>mode <code>PROMISC<\/code> active.<\/li>\n<\/ul>\n<p>The Raspberry then becomes a real passive network probe.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%94%8C_Je_branche_le_port_miroir\"><\/span>\ud83d\udd0c I plug in the mirror port<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Once the Raspberry was ready, port 5 of the Zyxel switch configured as a mirror port was connected directly to the Ethernet port of the Raspberry Pi.<\/p>\n<p>From this point on, the Raspberry starts receiving a copy of the network traffic.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter  wp-image-11369\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740.jpg\" alt=\"\" width=\"649\" height=\"487\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740.jpg 1723w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740-300x225.jpg 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740-1024x768.jpg 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740-768x576.jpg 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740-1536x1152.jpg 1536w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/20260515_141740-600x450.jpg 600w\" sizes=\"auto, (max-width: 649px) 100vw, 649px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%93%A1_Je_fais_un_premier_test_de_capture_reseau\"><\/span>\ud83d\udce1 I do a first network capture test<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Before launching Suricata, I preferred to check that the mirroring actually worked.<\/p>\n<h4>\ud83d\udce6 Installation of tcpdump<\/h4>\n<pre><code>sudo apt install tcpdump -y<\/code><\/pre>\n<h4>\ud83e\uddea Test Capture<\/h4>\n<pre><code>sudo tcpdump -i eth0 -nn -c 20<\/code><\/pre>\n<p>Result achieved:<\/p>\n<pre><code>IP 192.168.1.x &gt; 192.168.1.x UDP, length 70 ICMP echo request HTTPS traffic DNS traffic<\/code><\/pre>\n<p>Network traffic immediately started to scroll:<\/p>\n<ul>\n<li>DNS queries;<\/li>\n<li>HTTPS traffic;<\/li>\n<li>IoT communications;<\/li>\n<li>internal flows;<\/li>\n<li>ICMP;<\/li>\n<li>Various network connections.<\/li>\n<\/ul>\n<p>This confirmed that:<\/p>\n<ul>\n<li>the Zyxel mirror port worked perfectly;<\/li>\n<li>the Raspberry did receive a copy of the traffic;<\/li>\n<li>Passive capture was operational.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%E2%9A%99%EF%B8%8F_Je_configure_Suricata\"><\/span>\u2699  I configure Suricata<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The main configuration file can be found here:<\/p>\n<pre><code>\/etc\/suricata\/suricata.yaml<\/code><\/pre>\n<h4>\ud83c\udfe0 I declare the local network<\/h4>\n<p>I adapted the local network to my installation:<\/p>\n<pre><code>HOME_NET: \"[192.168.1.0\/24]\"<\/code><\/pre>\n<p>This improves:<\/p>\n<ul>\n<li>the accuracy of the alerts;<\/li>\n<li>performance;<\/li>\n<li>detection of internal and external flows.<\/li>\n<\/ul>\n<h4>\ud83e\uddec I activate fingerprints JA3 and JA4<\/h4>\n<p>The JA3\/JA4 fingerprints make it possible to identify certain TLS behaviours very precisely.<\/p>\n<p>Activation in the TLS block:<\/p>\n<pre><code>ja3-fingerprints: yes ja4-fingerprints: yes<\/code><\/pre>\n<h4>\u2705 I validate the configuration<\/h4>\n<pre><code>sudo suricata -T -c \/etc\/suricata\/suricata.yaml<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>Configuration provided was successfully loaded<\/code><\/pre>\n<p>This command is extremely useful:<\/p>\n<ul>\n<li>detection of YAML errors;<\/li>\n<li>validation of rules;<\/li>\n<li>control of roads;<\/li>\n<li>global configuration check.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%9A%80_Je_demarre_Suricata\"><\/span>\ud83d\ude80 I start Suricata<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4>\ud83d\udd04 I'm restarting the service<\/h4>\n<pre><code>sudo systemctl restart suricata<\/code><\/pre>\n<h4>\ud83d\udcca I check the status<\/h4>\n<pre><code>sudo systemctl status suricata<\/code><\/pre>\n<p>Expected result:<\/p>\n<pre><code>Active: active (running)<\/code><\/pre>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%93%9C_Je_valide_les_logs_reseau\"><\/span>\ud83d\udcdc I validate network logs<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The core of the system is based on the JSON file generated by Suricata:<\/p>\n<pre><code>\/var\/log\/suricata\/eve.json<\/code><\/pre>\n<h4>\ud83d\udc40 Real-time visualization<\/h4>\n<pre><code>sudo tail -f \/var\/log\/suricata\/eve.json<\/code><\/pre>\n<p>By generating some network traffic (YouTube, web browsing, \u2026 connected objects), the first events appear immediately:<\/p>\n<pre><code>\"event _type\":\"flow\" \"event _type\":\"dns\" \"event _type\":\"tls\" \"event _type\":\"http\"<\/code><\/pre>\n<p>This confirms that:<\/p>\n<ul>\n<li>Suricata analyses packets correctly;<\/li>\n<li>protocols are decoded;<\/li>\n<li>JSON logs are usable;<\/li>\n<li>Network supervision actually works.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%97%82%EF%B8%8F_Je_mets_en_place_une_rotation_automatique_des_logs\"><\/span>\ud83d\uddc2  I set up an automatic log rotation<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A network monitoring system generates a lot of logs.<\/p>\n<p>It is therefore essential to set up an automatic rotation in order to avoid filling the SSD.<\/p>\n<h4>\u2699  Configuration logrotate<\/h4>\n<pre><code>sudo nano \/etc\/logrotate.d\/suricata<\/code><\/pre>\n<p>Configuration used:<\/p>\n<pre><code>\/var\/log\/suricata\/*.log \/var\/log\/suricata\/*.json { daily rotate 14 missingok notifempty compress delaycompress copytruncate sharedscripts postrotate \/bin\/kill -HUP $(cat \/var\/run\/suricata.pid) 2&gt;\/dev\/null || true endscript }<\/code><\/pre>\n<p>This configuration:<\/p>\n<ul>\n<li>keeps 14 days of history;<\/li>\n<li>compresses old logs;<\/li>\n<li>avoids errors if Suricata restarts;<\/li>\n<li>severely limits the wear of the SSD.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%93%A1_Jexporte_les_flux_reseau_vers_Home_Assistant_avec_softflowd\"><\/span>\ud83d\udce1 I export network flows to Home Assistant with softflowd<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once Suricata was operational in passive IDS mode, the next objective was to transmit network metadata to Home Assistant in order to be able to create smart dashboards, activity charts and alerts.<\/p>\n<p>To this end, I added: <strong>softflowd<\/strong>, a lightweight NetFlow exporter perfectly suited to a Raspberry Pi 3B+.<\/p>\n<p>The idea is simple:<\/p>\n<ul>\n<li>Suricata inspects the packages;<\/li>\n<li>softflowd observes network flows;<\/li>\n<li>Home Assistant centralises and visualises the activity.<\/li>\n<\/ul>\n<p>This approach allows for advanced network supervision without turning the Raspberry into an active router or firewall.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%93%A6_Jinstalle_softflowd\"><\/span>\ud83d\udce6 I install softflowd<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Installation is very simple:<\/p>\n<pre><code class=\"language-bash\">sudo apt install softflowd -y<\/code><\/pre>\n<p>Once installed, it was necessary to identify which network interface received mirror traffic from the Zyxel switch.<\/p>\n<p>As before, the following command is used to check the network status:<\/p>\n<pre><code class=\"language-bash\">ip a<\/code><\/pre>\n<p>Observed result:<\/p>\n<pre><code class=\"language-text\">2: eth0: &lt;BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP&gt; 3: wlan0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt;<\/code><\/pre>\n<p>The interface <strong>eth0<\/strong> is therefore good:<\/p>\n<ul>\n<li>connected;<\/li>\n<li>active;<\/li>\n<li>in PROMISC mode;<\/li>\n<li>without an IP address.<\/li>\n<\/ul>\n<p>This is exactly what I was looking for:<\/p>\n<ul>\n<li><strong>eth0<\/strong> receives only mirror traffic from the switch;<\/li>\n<li><strong>wlan0<\/strong> is used to administer the Raspberry and send the data to Home Assistant.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%A7%AA_Je_fais_un_premier_test_manuel\"><\/span>\ud83e\uddea I do a first manual test<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Before any automation, I started softflowd manually to check the operation:<\/p>\n<pre><code class=\"language-bash\">sudo softflowd -i eth0 -n 192.168.1.222:2055<\/code><\/pre>\n<p>The Raspberry returns almost no messages to the screen, which is normal.<\/p>\n<p>The program launches directly in the background.<\/p>\n<p>To verify that the flows were indeed exported to Home Assistant, I opened a second SSH session and then launched:<\/p>\n<pre><code class=\"language-bash\">sudo tcpdump -i wlan0 udp port 2055<\/code><\/pre>\n<p>Result:<\/p>\n<pre><code class=\"language-text\">IP Suricata.42399 &gt; 192.168.1.222.2055: UDP<\/code><\/pre>\n<p>This line confirms several important points:<\/p>\n<ul>\n<li>softflowd works;<\/li>\n<li>NetFlow flows are well generated;<\/li>\n<li>Home Assistant receives the packages;<\/li>\n<li>routing via Wi-Fi is correct.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%9B%A0%EF%B8%8F_Je_cree_un_service_systemd_dedie\"><\/span>\ud83d\udee0  I create a dedicated systemd service<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The Debian service provided with softflowd proved unreliable in this specific context.<\/p>\n<p>So I preferred to create my own systemd service.<\/p>\n<p>Creation of the file:<\/p>\n<pre><code class=\"language-bash\">sudo nano \/etc\/systemd\/system\/softflowd-ids.service<\/code><\/pre>\n<p>Configuration used:<\/p>\n<pre><code class=\"language-ini\">[Unit] Description=softflowd NetFlow export for IDS mirror interface After=network-online.target promisc-eth0.service Wants=network-online.target [Service] Type=simple ExecStart=\/usr\/sbin\/softflowd -d -i eth0 -n 192.168.1.222:2055 Restart=always RestartSec=5 [Install] WantedBy=multi-user.target<\/code><\/pre>\n<p>Then activation of the service:<\/p>\n<pre><code class=\"language-bash\">sudo systemctl daemon-reload sudo systemctl enable softflowd-ids sudo systemctl restart softflowd-ids<\/code><\/pre>\n<h3><span class=\"ez-toc-section\" id=\"%E2%9C%85_Je_verifie_le_bon_fonctionnement\"><\/span>\u2705 I check the correct functioning<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>To confirm the correct functioning:<\/p>\n<pre><code class=\"language-bash\">sudo systemctl status softflowd-ids<\/code><\/pre>\n<p>Result:<\/p>\n<pre><code class=\"language-text\">Active: active (running) softflowd v1.1.1 starting data collection Exporting flows from eth0 to [192.168.1.222]:2055<\/code><\/pre>\n<p>At this stage, the network architecture is fully operational:<\/p>\n<ul>\n<li>the Zyxel switch duplicates the traffic;<\/li>\n<li>the Raspberry receives copies of the packages;<\/li>\n<li>Suricata analyses traffic;<\/li>\n<li>softflowd exports flows;<\/li>\n<li>Home Assistant centralizes data.<\/li>\n<\/ul>\n<p>The most interesting thing is that this monitoring remains completely passive:<\/p>\n<ul>\n<li>no impact on the network;<\/li>\n<li>no modification of the equipment;<\/li>\n<li>no possible interruption of traffic;<\/li>\n<li>extremely low power consumption.<\/li>\n<\/ul>\n<p>The Raspberry thus becomes a real home network probe capable of offering very advanced visibility over the entire home automation and IT installation of the house.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%8F%A0_Jintegre_Home_Security_Assistant_dans_Home_Assistant\"><\/span>\ud83c\udfe0 I integrate Home Security Assistant into Home Assistant<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once Suricata was up and running and NetFlow flows were properly exported to Home Assistant via softflowd, the next step was to actually exploit all this data.<\/p>\n<p>The aim was no longer merely to capture network traffic, but to:<\/p>\n<ul>\n<li>correlate security events;<\/li>\n<li>identify active equipment;<\/li>\n<li>detecting abnormal behaviour;<\/li>\n<li>view the home network in real time;<\/li>\n<li>transform Home Assistant into a real security supervision center.<\/li>\n<\/ul>\n<p>For this, I installed the excellent integration <strong>Home Security Assistant<\/strong> by domo-monster.<\/p>\n<p>This integration makes it possible to centralise:<\/p>\n<ul>\n<li>Suricata logs;<\/li>\n<li>NetFlow flows;<\/li>\n<li>network statistics;<\/li>\n<li>suspicious events;<\/li>\n<li>vulnerability detections;<\/li>\n<li>unusual network behaviour.<\/li>\n<\/ul>\n<p>In my case, HACS was already installed in Home Assistant, which greatly simplifies the installation.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%E2%9E%95_Jajoute_le_depot_personnalise_dans_HACS\"><\/span>\u2795 I add the custom repository in HACS<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>In Home Assistant:<\/p>\n<pre><code class=\"language-text\">HACS \u2192 Integrations \u2192 \u22ee (top right menu) \u2192 Custom Deposits<\/code><\/pre>\n<p>Addition of the GitHub repository:<\/p>\n<pre><code class=\"language-text\">https:\/\/github.com\/domo-monster\/HomeSecurityAssistant<\/code><\/pre>\n<p>Then selection of the category:<\/p>\n<pre><code class=\"language-text\">Integration<\/code><\/pre>\n<p>Finally:<\/p>\n<pre><code class=\"language-text\">Add<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11345\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143604.png\" alt=\"\" width=\"387\" height=\"182\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143604.png 387w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143604-300x141.png 300w\" sizes=\"auto, (max-width: 387px) 100vw, 387px\" \/><\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%93%A6_Jinstalle_lintegration\"><\/span>\ud83d\udce6 I install the integration<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Once the deposit has been added:<\/p>\n<pre><code class=\"language-text\">HACS \u2192 Integrations<\/code><\/pre>\n<p>Search for:<\/p>\n<pre><code class=\"language-text\">Home Security Assistant<\/code><\/pre>\n<p>Then install the latest version available.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11346\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143704.png\" alt=\"\" width=\"556\" height=\"220\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143704.png 556w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143704-300x119.png 300w\" sizes=\"auto, (max-width: 556px) 100vw, 556px\" \/><\/p>\n<p>After downloading, Home Assistant requests a full restart.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"%F0%9F%94%8C_Jajoute_lintegration_dans_Home_Assistant\"><\/span>\ud83d\udd0c I add integration in Home Assistant<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>After restarting:<\/p>\n<pre><code class=\"language-text\">Settings \u2192 Devices and services \u2192 Add integration<\/code><\/pre>\n<p>Then search for:<\/p>\n<pre><code class=\"language-text\">Home Security Assistant<\/code><\/pre>\n<h3><span class=\"ez-toc-section\" id=\"%E2%9A%99%EF%B8%8F_Je_configure_Home_Security_Assistant\"><\/span>\u2699  I configure Home Security Assistant<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11347\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-143748.png\" alt=\"\" width=\"285\" height=\"136\" \/><\/p>\n<p>After the integration is installed, Home Assistant automatically opens the Home Security Assistant configuration window.<\/p>\n<p>This configuration shall remain accessible at all times:<\/p>\n<pre><code class=\"language-text\">Settings \u2192 Devices and Services \u2192 Home Security Assistant \u2192 Configure (scratched wheel)<\/code><\/pre>\n<p>Most of the proposed settings can be left by default.<\/p>\n<p>Integration is already designed to work effectively in a standard home environment.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11317\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-071540.png\" alt=\"\" width=\"532\" height=\"817\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-071540.png 532w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-071540-195x300.png 195w\" sizes=\"auto, (max-width: 532px) 100vw, 532px\" \/><\/p>\n<p>In my case, only a few parameters really required special attention.<\/p>\n<h4>\ud83c\udf10 Listening Host<\/h4>\n<pre><code class=\"language-text\">0.0.0.0<\/code><\/pre>\n<p>This value must be retained.<\/p>\n<p>It allows Home Security Assistant to listen to NetFlow streams on all network interfaces of the Home Assistant server.<\/p>\n<p>This is particularly useful when:<\/p>\n<ul>\n<li>Home Assistant has several network interfaces;<\/li>\n<li>flows arrive from other equipment;<\/li>\n<li>telemetry is exported by a remote IDS probe as here with the Raspberry.<\/li>\n<\/ul>\n<h4>\ud83d\udce1 UDP listening port<\/h4>\n<pre><code class=\"language-text\">2055<\/code><\/pre>\n<p>This port must correspond exactly to the one previously configured in softflowd:<\/p>\n<pre><code class=\"language-bash\">softflowd -i eth0 -n 192.168.1.222:2055<\/code><\/pre>\n<p>Port 2055 is a very common standard for NetFlow.<\/p>\n<h4>\ud83c\udfe0 Internal Networks<\/h4>\n<pre><code class=\"language-text\">192.168.0.0\/16,10.0.0.0\/8,172.16.0.0\/12,fd00::\/8,fe80::\/10<\/code><\/pre>\n<p>I voluntarily kept this default configuration.<\/p>\n<p>Even though my current network works mainly by:<\/p>\n<pre><code class=\"language-text\">192.168.1.0\/24<\/code><\/pre>\n<p>The default configuration remains more flexible and scalable.<\/p>\n<p>In particular, it makes it possible to:<\/p>\n<ul>\n<li>the future addition of VLANs;<\/li>\n<li>separation of IoT objects;<\/li>\n<li>management of guest networks;<\/li>\n<li>IPv6 compatibility;<\/li>\n<li>the future development of the infrastructure.<\/li>\n<\/ul>\n<p>In a modern home environment, it is usually best to keep this extensive configuration.<\/p>\n<h4>\ud83d\udd75  Port Scanning Detection Window<\/h4>\n<pre><code class=\"language-text\">600 seconds<\/code><\/pre>\n<p>This value corresponds to:<\/p>\n<ul>\n<li>10 minutes of slippery surveillance;<\/li>\n<li>good detection sensitivity;<\/li>\n<li>a reasonable charge for Home Assistant.<\/li>\n<\/ul>\n<p>The aim is to avoid:<\/p>\n<ul>\n<li>false positives that are too aggressive;<\/li>\n<li>unnecessary warnings;<\/li>\n<li>the overloading of the analysis engine.<\/li>\n<\/ul>\n<p>For a home network, the default value is very correct.<\/p>\n<h4>\ud83d\udeaa Unique Ports Before Scan Alert<\/h4>\n<pre><code class=\"language-text\">100<\/code><\/pre>\n<p>This value determines from how many different ports a device will be considered potentially performing a network scan.<\/p>\n<p>Again, the default value is suitable for domestic use.<\/p>\n<p>Too low a value could cause a lot of false positives with:<\/p>\n<ul>\n<li>Chromecast;<\/li>\n<li>Apple TV;<\/li>\n<li>connected objects;<\/li>\n<li>mDNS;<\/li>\n<li>UPnP;<\/li>\n<li>Automatic network discovery.<\/li>\n<\/ul>\n<h4>\ud83d\udcc8 High outbound traffic threshold<\/h4>\n<pre><code class=\"language-text\">50000000<\/code><\/pre>\n<p>This parameter defines the volume of data considered to be abnormally high over a given period of time.<\/p>\n<p>In my case, I kept the default value.<\/p>\n<p>The main objective is to detect:<\/p>\n<ul>\n<li>compromised equipment;<\/li>\n<li>an unusual massive upload;<\/li>\n<li>data exfiltration;<\/li>\n<li>an extremely talkative IoT device.<\/li>\n<\/ul>\n<h4>\ud83d\udccb Activate Side Panel<\/h4>\n<p>Option left on.<\/p>\n<p>This directly adds Home Security Assistant to the Home Assistant sidebar.<\/p>\n<p>This is extremely convenient.<\/p>\n<h4>\ud83d\udd10 Admin rights for the side panel<\/h4>\n<p>Option also kept enabled.<\/p>\n<p>This limits access to sensitive network information only to Home Assistant administrators.<\/p>\n<p>In a multi-user environment, it is a good security practice.<\/p>\n<h4>\ud83d\udd0e Active Network Scanner<\/h4>\n<p>I left the scanner active.<\/p>\n<p>This component allows Home Security Assistant to:<\/p>\n<ul>\n<li>discover network equipment;<\/li>\n<li>identify the active hosts;<\/li>\n<li>correlate IP addresses;<\/li>\n<li>enrich network information.<\/li>\n<\/ul>\n<p>This feature perfectly complements the passive analyses performed by Suricata.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11318\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-072226.png\" alt=\"\" width=\"535\" height=\"875\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-072226.png 535w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-072226-183x300.png 183w\" sizes=\"auto, (max-width: 535px) 100vw, 535px\" \/><\/p>\n<h4>\u23f1  Active Scan Interval<\/h4>\n<pre><code class=\"language-text\">3000 seconds<\/code><\/pre>\n<p>This value corresponds to approximately:<\/p>\n<pre><code class=\"language-text\">50 minutes<\/code><\/pre>\n<p>Therefore, the active scanner does not run continuously.<\/p>\n<p>This is a great thing in a domestic environment.<\/p>\n<p>This makes it possible to:<\/p>\n<ul>\n<li>limiting network load;<\/li>\n<li>avoid aggressive scans;<\/li>\n<li>not to disrupt certain sensitive IoT objects;<\/li>\n<li>to maintain a discreet approach.<\/li>\n<\/ul>\n<p>For a very dynamic laboratory or professional network, this value could be reduced.<\/p>\n<p>But for a connected home, the default is very reasonable.<\/p>\n<h4>\ud83d\udeaa Ports for Scanning<\/h4>\n<p>The list provided by default can be kept.<\/p>\n<p>It contains the most common ports.<\/p>\n<p>The purpose of the scanner is not to perform a comprehensive offensive security scan, but rather to:<\/p>\n<ul>\n<li>identify the equipment;<\/li>\n<li>to detect the services exposed;<\/li>\n<li>mapping the network;<\/li>\n<li>feed into the safety correlations.<\/li>\n<\/ul>\n<p>In my case, I did not change anything.<\/p>\n<h4>\ud83d\udeab Scanner Exceptions<\/h4>\n<p>This field allows to exclude some IPs from active scans.<\/p>\n<p>By default, it can remain empty.<\/p>\n<p>However, this feature can become useful for:<\/p>\n<ul>\n<li>fragile equipment;<\/li>\n<li>certain printers;<\/li>\n<li>unrobust IoT objects;<\/li>\n<li>industrial equipment;<\/li>\n<li>devices that are very sensitive to network scans.<\/li>\n<\/ul>\n<p>In my environment, no equipment required exclusion.<\/p>\n<h4>\ud83d\udcdb Enable Reverse DNS Resolution<\/h4>\n<p>This option clearly deserves to be activated.<\/p>\n<p>It makes it possible to transform low-sounding IPs into much more readable host names.<\/p>\n<p>For example, instead of displaying:<\/p>\n<pre><code class=\"language-text\">192.168.1.42<\/code><\/pre>\n<p>The Home Security Assistant may sometimes display:<\/p>\n<pre><code class=\"language-text\">nas.maison.local printer.local apple-tv.local<\/code><\/pre>\n<p>This greatly improves:<\/p>\n<ul>\n<li>legibility;<\/li>\n<li>analysis of events;<\/li>\n<li>rapid identification of equipment.<\/li>\n<\/ul>\n<h4>\ud83e\udde0 Threat Intelligence Flow<\/h4>\n<p>The URLs offered by default can be retained.<\/p>\n<p>Home Security Assistant automatically downloads several reputation and blocking lists from recognised sources:<\/p>\n<ul>\n<li>Abuse.ch;<\/li>\n<li>SSLBL;<\/li>\n<li>AdGuard;<\/li>\n<li>other Community flows.<\/li>\n<\/ul>\n<p>These flows are used to:<\/p>\n<ul>\n<li>identify malicious IPs;<\/li>\n<li>identifying suspicious areas;<\/li>\n<li>detect certain known behaviours;<\/li>\n<li>feed security alerts.<\/li>\n<\/ul>\n<p>This is one of the most interesting aspects of integration: it automatically enriches locally collected network data with external intelligence.<\/p>\n<h4>\ud83c\udf0d Proxy DNS<\/h4>\n<p>In my case, this option remained disabled.<\/p>\n<p>The DNS proxy would allow the Home Security Assistant to:<\/p>\n<ul>\n<li>intercept DNS requests;<\/li>\n<li>journaling the domains consulted;<\/li>\n<li>apply DNS blocking;<\/li>\n<li>carry out further analysis.<\/li>\n<\/ul>\n<p>But this implies:<\/p>\n<ul>\n<li>higher network privileges;<\/li>\n<li>a more intrusive architecture;<\/li>\n<li>additional dependence.<\/li>\n<\/ul>\n<p>For a first domestic deployment, I preferred to remain simple and stable.<\/p>\n<h4>\ud83d\udd22 DNS Proxy Port<\/h4>\n<pre><code class=\"language-text\">53<\/code><\/pre>\n<p>Standard value of the DNS protocol.<\/p>\n<p>As the DNS proxy remains disabled, this parameter has no impact.<\/p>\n<h4>\u2601  Upstream DNS resolvers<\/h4>\n<pre><code class=\"language-text\">1.1.1.1<\/code><\/pre>\n<p>Cloudflare is used here as an upstream DNS resolver.<\/p>\n<p>This value can be replaced according to preferences:<\/p>\n<ul>\n<li>Google DNS;<\/li>\n<li>Quad9;<\/li>\n<li>AdGuard DNS;<\/li>\n<li>Pi-hole;<\/li>\n<li>Local unbound.<\/li>\n<\/ul>\n<p>In my case, I kept the proposed value.<\/p>\n<h4>\ud83d\uddc3  DNS Log Retention<\/h4>\n<pre><code class=\"language-text\">24 hours<\/code><\/pre>\n<p>This value defines how long DNS logs remain stored.<\/p>\n<p>For a domestic environment:<\/p>\n<ul>\n<li>24 hours already provide good visibility;<\/li>\n<li>this limits memory consumption;<\/li>\n<li>this avoids unnecessary accumulation of data.<\/li>\n<\/ul>\n<p>Longer conservation could be relevant in a professional or forensic context.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11319\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-072755.png\" alt=\"\" width=\"533\" height=\"874\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-072755.png 533w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-072755-183x300.png 183w\" sizes=\"auto, (max-width: 533px) 100vw, 533px\" \/><\/p>\n<h4>\ud83d\udeab Sources threat-intel used for blocking<\/h4>\n<p>This field allows to define which intelligence sources will be used to feed the blocking mechanisms.<\/p>\n<p>In my case, I left it empty. I always prefer to start in observer mode before automating countermeasures.<\/p>\n<h4>\u26d4 Blocked DNS Categories<\/h4>\n<p>This field makes it possible to block certain categories of domains:<\/p>\n<ul>\n<li>adults;<\/li>\n<li>gambling;<\/li>\n<li>malware;<\/li>\n<li>tracking;<\/li>\n<li>phishing;<\/li>\n<li>etc.<\/li>\n<\/ul>\n<p>Again, I left it empty for this first deployment.<\/p>\n<p>This feature can be activated later, once the normal behavior of the network is understood.<\/p>\n<p>I already use Safe Access built into my Synology router to filter equipment used by my daughters.<\/p>\n<p>It does this via a very nice graphical interface. We'll see later if I also come here to do DNS blocking.<\/p>\n<h4>\u21aa  Local DNS Redirects<\/h4>\n<p>This feature allows some domains to be redirected to specific IPs.<\/p>\n<p>For example:<\/p>\n<pre><code class=\"language-text\">monservice.local=192.168.1.10<\/code><\/pre>\n<p>or:<\/p>\n<pre><code class=\"language-text\">ads.example.com=0.0.0.0<\/code><\/pre>\n<p>In my case, no redirection was necessary. The field has therefore remained empty.<\/p>\n<h4>\ud83e\udda0 I create a VirusTotal account and get my API key<\/h4>\n<p>VirusTotal enriches security information with reputation data on suspicious IPs, domains, URLs or files.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11356\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-220911.png\" alt=\"\" width=\"713\" height=\"666\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-220911.png 713w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-220911-300x280.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-220911-600x560.png 600w\" sizes=\"auto, (max-width: 713px) 100vw, 713px\" \/><\/p>\n<p>To use it with Home Security Assistant, you must create a free account on:<\/p>\n<pre><code class=\"language-text\">https:\/\/www.virustotal.com<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11357\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221119.png\" alt=\"\" width=\"565\" height=\"769\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221119.png 565w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221119-220x300.png 220w\" sizes=\"auto, (max-width: 565px) 100vw, 565px\" \/><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11358\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221154.png\" alt=\"\" width=\"559\" height=\"109\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221154.png 559w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221154-300x58.png 300w\" sizes=\"auto, (max-width: 559px) 100vw, 559px\" \/><\/p>\n<p>Once connected:<\/p>\n<pre><code class=\"language-text\">User profile \u2192 API key<\/code><\/pre>\n<p>VirusTotal indicates that the public API key is available in the user account menu once logged in. This key must remain private and must obviously never be published in an article, a screenshot or a Git repository.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11359\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221408.png\" alt=\"\" width=\"649\" height=\"164\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221408.png 902w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221408-300x76.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221408-768x194.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-221408-600x152.png 600w\" sizes=\"auto, (max-width: 649px) 100vw, 649px\" \/><\/p>\n<p>In Home Assistant:<\/p>\n<pre><code class=\"language-text\">Settings \u2192 Devices and Services \u2192 Home Security Assistant \u2192 Configure<\/code><\/pre>\n<p>Then I fill in the field:<\/p>\n<pre><code class=\"language-text\">VirusTotal API Key<\/code><\/pre>\n<p>I then kept the proposed daily budget:<\/p>\n<pre><code class=\"language-text\">500<\/code><\/pre>\n<p>For my domestic use, this is more than enough.<\/p>\n<p>The aim is not to constantly query VirusTotal, but only to enrich suspicious elements in order to better understand what Home Security Assistant detects.<\/p>\n<h4>\ud83d\udea8 I create an AbuseIPDB account and get my API key<\/h4>\n<p>AbuseIPDB complements VirusTotal very well.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11360\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222002.png\" alt=\"\" width=\"650\" height=\"390\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222002.png 1149w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222002-300x180.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222002-1024x614.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222002-768x461.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222002-600x360.png 600w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>Where VirusTotal gives a global reputation, AbuseIPDB is particularly useful for identifying known IP addresses for:<\/p>\n<ul>\n<li>network scans;<\/li>\n<li>attempts at brute force;<\/li>\n<li>abusive conduct;<\/li>\n<li>malicious activities reported by the community.<\/li>\n<\/ul>\n<p>I am therefore creating a free account on:<\/p>\n<pre><code class=\"language-text\">https:\/\/www.abuseipdb.com<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11361\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222023.png\" alt=\"\" width=\"577\" height=\"733\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222023.png 577w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222023-236x300.png 236w\" sizes=\"auto, (max-width: 577px) 100vw, 577px\" \/><\/p>\n<p>Once connected:<\/p>\n<pre><code class=\"language-text\">Account \u2192 API \u2192 Create Key<\/code><\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11362\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222257.png\" alt=\"\" width=\"651\" height=\"282\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222257.png 1352w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222257-300x130.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222257-1024x444.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222257-768x333.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222257-600x260.png 600w\" sizes=\"auto, (max-width: 651px) 100vw, 651px\" \/><\/p>\n<p>I give the key a name, for example:<\/p>\n<pre><code class=\"language-text\">Home Security Assistant<\/code><\/pre>\n<p>Then I copy the generated API key.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11363\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222329.png\" alt=\"\" width=\"650\" height=\"284\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222329.png 1354w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222329-300x131.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222329-1024x448.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222329-768x336.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222329-600x262.png 600w\" sizes=\"auto, (max-width: 650px) 100vw, 650px\" \/><\/p>\n<p>As with VirusTotal, this key must remain strictly private. AbuseIPDB also points out that API keys must not be publicly disclosed.<\/p>\n<p>In Home Assistant:<\/p>\n<pre><code class=\"language-text\">Settings \u2192 Devices and Services \u2192 Home Security Assistant \u2192 Configure<\/code><\/pre>\n<p>Then I fill in the field:<\/p>\n<pre><code class=\"language-text\">AbuseIPDB API Key<\/code><\/pre>\n<p>I kept the daily budget:<\/p>\n<pre><code class=\"language-text\">1000<\/code><\/pre>\n<p>And I left the AbuseIPDB confidence threshold before querying VirusTotal on a reasonable value.<\/p>\n<p>The principle is interesting: If AbuseIPDB considers a sufficiently suspicious IP, Home Security Assistant can then enrich the analysis with VirusTotal.<\/p>\n<p>This avoids:<\/p>\n<ul>\n<li>unnecessary API calls;<\/li>\n<li>excessively rapid consumption of quotas;<\/li>\n<li>and enrichments on perfectly banal IPs.<\/li>\n<\/ul>\n<h4>\ud83e\udde0 Why do I add these two services?<\/h4>\n<p>Initially, Home Security Assistant mainly sees:<\/p>\n<ul>\n<li>IPs;<\/li>\n<li>flows;<\/li>\n<li>traffic volumes;<\/li>\n<li>network behaviour.<\/li>\n<\/ul>\n<p>With VirusTotal and AbuseIPDB, this information becomes much more readable.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-11364\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222842.png\" alt=\"\" width=\"648\" height=\"225\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222842.png 700w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222842-300x104.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-222842-600x208.png 600w\" sizes=\"auto, (max-width: 648px) 100vw, 648px\" \/><\/p>\n<p>Instead of simply having:<\/p>\n<pre><code class=\"language-text\">Suspicious IP: 185.xxx.xxx.xxx<\/code><\/pre>\n<p>Home Security Assistant can enrich information with reputational elements:<\/p>\n<ul>\n<li>IP already reported;<\/li>\n<li>confidence score;<\/li>\n<li>threat category;<\/li>\n<li>history of alerts;<\/li>\n<li>security context.<\/li>\n<\/ul>\n<p>For a domestic installation, this allows a better understanding of what is observed, without immediately automating blockages.<\/p>\n<p>And that is exactly the approach I prefer:<\/p>\n<ul>\n<li>observe first;<\/li>\n<li>understand next;<\/li>\n<li>Automate only if it is really necessary.<\/li>\n<\/ul>\n<h4>\ud83c\udfaf Confidence AbuseIPDB before query VirusTotal<\/h4>\n<p>This slider defines from which AbuseIPDB score an IP will be considered suspicious enough to trigger a VirusTotal query.<\/p>\n<p>The principle is intelligent:<\/p>\n<ul>\n<li>avoid unnecessary calls;<\/li>\n<li>reduce API consumption;<\/li>\n<li>Prioritize genuinely suspicious IPs.<\/li>\n<\/ul>\n<h4>\ud83e\uddf9 Retention of own IPs<\/h4>\n<pre><code class=\"language-text\">5 hours<\/code><\/pre>\n<p>IPs considered normal are kept for a short time.<\/p>\n<p>This is consistent:<\/p>\n<ul>\n<li>the legitimate traffic is extremely large;<\/li>\n<li>there is no need to keep it for too long;<\/li>\n<li>it saves memory and storage.<\/li>\n<\/ul>\n<h4>\u26a0  Retention of suspicious IPs<\/h4>\n<pre><code class=\"language-text\">48 hours<\/code><\/pre>\n<p>Suspicious IPs remain visible for longer in order to:<\/p>\n<ul>\n<li>facilitate analysis;<\/li>\n<li>identify repetitive behaviour;<\/li>\n<li>correlate certain events.<\/li>\n<\/ul>\n<p>This value seems to me particularly relevant for domestic use.<\/p>\n<h4>\u2620  Retention of Malicious IPs<\/h4>\n<pre><code class=\"language-text\">168 hours<\/code><\/pre>\n<p>Either:<\/p>\n<pre><code class=\"language-text\">7 days<\/code><\/pre>\n<p>IPs identified as genuinely malicious are kept much longer.<\/p>\n<p>This makes it possible to:<\/p>\n<ul>\n<li>identify repeated attacks;<\/li>\n<li>follow up on certain persistent attempts;<\/li>\n<li>to maintain an exploitable history.<\/li>\n<\/ul>\n<p>For a domestic Raspberry Pi, this value remains reasonable.<\/p>\n<h4>Enrichment Cache TTL \ud83e\udde0<\/h4>\n<pre><code class=\"language-text\">1440 minutes<\/code><\/pre>\n<p>Either:<\/p>\n<pre><code class=\"language-text\">24 hours<\/code><\/pre>\n<p>This parameter avoids re-examination of external intelligence services at all times.<\/p>\n<p>This makes it possible to:<\/p>\n<ul>\n<li>limit API calls;<\/li>\n<li>reduce the load;<\/li>\n<li>make integration more fluid;<\/li>\n<li>avoid certain blockages related to quotas.<\/li>\n<\/ul>\n<p>Again, the default value is very well thought out.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11320\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-073633.png\" alt=\"\" width=\"530\" height=\"662\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-073633.png 530w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-073633-240x300.png 240w\" sizes=\"auto, (max-width: 530px) 100vw, 530px\" \/><\/p>\n<h4>\ud83d\udcca Daily Virus query budgetTotal<\/h4>\n<pre><code class=\"language-text\">500<\/code><\/pre>\n<p>This setting limits the number of daily requests sent to VirusTotal.<\/p>\n<h4>\ud83d\udcc8 Daily budget of AbuseIPDB requests<\/h4>\n<pre><code class=\"language-text\">1000<\/code><\/pre>\n<p>Same logic here. This parameter sets the maximum number of queries to AbuseIPDB.<\/p>\n<h4>\ud83d\uddc3  URL of the NVD API<\/h4>\n<pre><code class=\"language-text\">https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0<\/code><\/pre>\n<p>This URL points to the official NVD database:<\/p>\n<pre><code class=\"language-text\">National Vulnerability Database<\/code><\/pre>\n<p>managed by the American NIST.<\/p>\n<p>It is one of the global benchmarks for:<\/p>\n<ul>\n<li>CVE vulnerabilities;<\/li>\n<li>CVSS scores;<\/li>\n<li>security references;<\/li>\n<li>follow-up of public flaws.<\/li>\n<\/ul>\n<p>Home Security Assistant can use this database to:<\/p>\n<ul>\n<li>identify vulnerable products;<\/li>\n<li>correlate certain equipment;<\/li>\n<li>identify potential risks.<\/li>\n<\/ul>\n<p>The default URL is obviously to be retained.<\/p>\n<h4>NVD Cache TTL \u23f3<\/h4>\n<pre><code class=\"language-text\">12:00<\/code><\/pre>\n<p>This setting defines how often CVE information is refreshed.<\/p>\n<p>Too frequent an update:<\/p>\n<ul>\n<li>would unnecessarily increase traffic;<\/li>\n<li>consume more resources;<\/li>\n<li>would not bring any real benefit.<\/li>\n<\/ul>\n<p>The proposed value represents an excellent compromise.<\/p>\n<h4>\ud83d\udcc5 Minimum VEC year<\/h4>\n<pre><code class=\"language-text\">2020<\/code><\/pre>\n<p>This option is particularly interesting.<\/p>\n<p>It limits the analysis to recent vulnerabilities.<\/p>\n<p>Why is it useful?<\/p>\n<p>Because the CVE database contains tens of thousands of historical entries.<\/p>\n<p>However, in a domestic environment:<\/p>\n<ul>\n<li>very old vulnerabilities are often less relevant;<\/li>\n<li>recent equipment is more affected by modern VECs;<\/li>\n<li>This greatly reduces noise.<\/li>\n<\/ul>\n<p>The 2020 value is therefore consistent:<\/p>\n<ul>\n<li>it retains several years of history;<\/li>\n<li>without unnecessarily overloading the system.<\/li>\n<\/ul>\n<h4>\ud83d\udd0d Search keywords NVD<\/h4>\n<p>This field contains a list of products and services to be monitored in the CVE databases:<\/p>\n<pre><code class=\"language-text\">OpenSSH Android Debug Bridge Apache HTTP Server nginx MySQL MariaDB ...<\/code><\/pre>\n<p>This list allows Home Security Assistant to:<\/p>\n<ul>\n<li>identify certain technologies present on the network;<\/li>\n<li>look for associated vulnerabilities;<\/li>\n<li>to raise contextualized alerts.<\/li>\n<\/ul>\n<p>It brings Home Assistant closer to a logic of:<\/p>\n<ul>\n<li>vulnerability management;<\/li>\n<li>attack surface inventory;<\/li>\n<li>cyber-domestic hygiene.<\/li>\n<\/ul>\n<p>In my case, I kept the list proposed by default.<\/p>\n<p>It already covers many services frequently present in domestic laboratories and self-hosted environments.<\/p>\n<h4>\ud83d\udcc9 Statistics: display the first N entries<\/h4>\n<p>The cursor allows you to choose how many items will be displayed in the statistics and dashboards.<\/p>\n<p>For example:<\/p>\n<ul>\n<li>top active IPs;<\/li>\n<li>Suspicious sources;<\/li>\n<li>most used ports;<\/li>\n<li>vulnerabilities detected;<\/li>\n<li>Important network activities.<\/li>\n<\/ul>\n<p>The default intermediate value proposed is very well balanced:<\/p>\n<ul>\n<li>enough information to be useful;<\/li>\n<li>without overloading the Home Assistant interface.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"%E2%9C%85_Validation_finale_de_la_configuration\"><\/span>\u2705 Final configuration validation<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Once this last page is validated, Home Security Assistant becomes fully operational.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11321\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-074731.png\" alt=\"\" width=\"301\" height=\"475\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-074731.png 301w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-074731-190x300.png 190w\" sizes=\"auto, (max-width: 301px) 100vw, 301px\" \/><\/p>\n<p>A few minutes after starting, the first indicators are already starting to appear in Home Assistant.<\/p>\n<p>This is probably one of the most satisfying moments of the project:<\/p>\n<p><strong>finally see the home network come to life as usable security data.<\/strong><\/p>\n<p>After:<\/p>\n<ul>\n<li>configuration of the mirror port;<\/li>\n<li>the installation of Suricata;<\/li>\n<li>collection of network flows;<\/li>\n<li>the softflowd configuration;<\/li>\n<li>integration into Home Assistant;<\/li>\n<\/ul>\n<p>the system is finally starting to produce a coherent view of home network activity.<\/p>\n<p>Here are, for example, the first sensors that appeared a few moments after starting up:<\/p>\n<ul>\n<li><strong>HSA Active Devices<\/strong> : number of active equipment detected on the network;<\/li>\n<li><strong>HSA High Egress Sources<\/strong> : sources generating an unusually high volume of outbound traffic;<\/li>\n<li><strong>HSA NVD Keywords<\/strong> : keywords and technologies monitored in the NVD vulnerability database;<\/li>\n<li><strong>HSA Open Findings<\/strong> : alerts and security features currently open;<\/li>\n<li><strong>HSA Scanned Devices<\/strong> : number of items of equipment analysed by the active scanner;<\/li>\n<li><strong>HSA Suspicious Sources<\/strong> : network sources considered suspicious according to detection rules and intelligence flows;<\/li>\n<li><strong>HSA Total Flows<\/strong> : total number of network flows observed;<\/li>\n<li><strong>HSA Vulnerabilities<\/strong> : vulnerabilities detected or correlated from the information collected.<\/li>\n<\/ul>\n<p>In my case, the numbers started to climb very quickly. Before writing this page, I let the system run overnight:<\/p>\n<ul>\n<li>more than 150 000 network flows detected;<\/li>\n<li>more than 60 active equipment;<\/li>\n<li>dozens of vulnerabilities identified;<\/li>\n<li>several sources considered suspicious.<\/li>\n<\/ul>\n<p>And this is precisely where the project becomes exciting.<\/p>\n<p>We suddenly realise how much activity a modern home network generates:<\/p>\n<ul>\n<li>connected objects;<\/li>\n<li>voice assistants;<\/li>\n<li>smartphones;<\/li>\n<li>NAS;<\/li>\n<li>cloud services;<\/li>\n<li>Connected TVs;<\/li>\n<li>streaming services;<\/li>\n<li>containers;<\/li>\n<li>home automations.<\/li>\n<\/ul>\n<p>Even in a personal environment, the network surface quickly becomes very complex.<\/p>\n<p>And that is what Home Security Assistant finally makes visible.<\/p>\n<p>I rename all the sensors by giving them titles in French.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11367\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-230838.png\" alt=\"\" width=\"331\" height=\"530\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-230838.png 331w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-230838-187x300.png 187w\" sizes=\"auto, (max-width: 331px) 100vw, 331px\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%91%80_Premieres_impressions_apres_la_mise_en_route\"><\/span>\ud83d\udc40 First impressions after start-up<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>For now, the information in HA is limited to numbers, so I went to the HSA interface.<\/p>\n<p>What struck me immediately was the amount of information available without any additional complex configuration.<\/p>\n<p>Very quickly, Home Assistant displayed:<\/p>\n<ul>\n<li>active appliances;<\/li>\n<li>traffic volumes;<\/li>\n<li>suspicious IPs;<\/li>\n<li>important network exchanges;<\/li>\n<li>legible safety statistics;<\/li>\n<li>the beginnings of threat correlation.<\/li>\n<\/ul>\n<p>Most importantly, all this is directly integrated into the existing home automation ecosystem.<\/p>\n<p>This is probably what makes this project particularly interesting: bring advanced cybersecurity mechanisms into a Home Assistant environment, without having to deploy a heavy and complex professional infrastructure.<\/p>\n<p>The result is both:<\/p>\n<ul>\n<li>pedagogical;<\/li>\n<li>visual;<\/li>\n<li>useful;<\/li>\n<li>evolutionary.<\/li>\n<\/ul>\n<p>At this stage, I am both very happy and extremely curious to continue the discovery of Home Security Assistant.<\/p>\n<p>I can\u2019t even imagine how much time domo-monster spent doing this work, which, once configured, lights up and comes to life almost on its own.<\/p>\n<p>The screen <strong>Map<\/strong> is alive, legible and really impressive to observe.<\/p>\n<p>Frankly: Congratulations.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11322\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-075716.png\" alt=\"\" width=\"1437\" height=\"915\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-075716.png 1437w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-075716-300x191.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-075716-1024x652.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-075716-768x489.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Capture-decran-2026-05-09-075716-600x382.png 600w\" sizes=\"auto, (max-width: 1437px) 100vw, 1437px\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"%F0%9F%8E%AF_Conclusion\"><\/span>\ud83c\udfaf Conclusion<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This architecture provides a real layer of network visibility:<\/p>\n<ul>\n<li>without complicating the installation;<\/li>\n<li>without changing traffic;<\/li>\n<li>without depending on the router.<\/li>\n<\/ul>\n<p>The couple:<\/p>\n<ul>\n<li><strong>manageable switch + mirroring port + Raspberry Pi<\/strong><\/li>\n<\/ul>\n<p>provides an excellent basis for building a high-performance, fully local domestic SDI.<\/p>\n<p>And above all:<\/p>\n<ul>\n<li>the analysis remains completely passive;<\/li>\n<li>This ensures excellent network stability.<\/li>\n<\/ul>\n<p>For an advanced home automation laboratory or a modern residential network, it is a particularly elegant solution.<\/p>\n<p>I now have plenty of fun for a few \u2026 weekends or nights of insomnia \ud83d\ude04<\/p>\n<p>I honestly did not think that this RetEx would become so long and dense \u2026, but in the end I did.<\/p>\n<p>So if you have read so far: Bravo \ud83d\ude05<\/p>\n<p>I will stop at this point for this article, but it is very likely that I will publish the rest with other RetEx around Home Security Assistant and its day-to-day operation.<\/p>\n<p>And of course, I end with a huge thank you to <strong>domo-monster<\/strong>, which brings us here on a silver platter the fruit of probably very many years of experience and investment in the field of cybersecurity.<\/p>\n<p>The result is really impressive.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-11327\" src=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1.png\" alt=\"\" width=\"1536\" height=\"1024\" srcset=\"https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1.png 1536w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1-300x200.png 300w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1-1024x683.png 1024w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1-768x512.png 768w, https:\/\/www.sigalou-domotique.fr\/wp-content\/uploads\/2026\/05\/Reseau2-1-600x400.png 600w\" sizes=\"auto, (max-width: 1536px) 100vw, 1536px\" \/><\/p>\n<h2><span class=\"ez-toc-section\" id=\"Question_Besoin_daide\"><\/span>Question? Need help?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>I have posted a message on Home assistant\u2019s forum de la communat\u00e9 francophone, do not hesitate to use it to ask me questions or provide your experience:<\/p>\n<ul>\n<li><a href=\"https:\/\/forum.hacf.fr\/t\/article-jai-mis-en-place-une-sonde-de-surveillance-cybersecurite-pour-mon-reseau-domotique\/79578\" target=\"_blank\" rel=\"noopener\">https:\/\/forum.hacf.fr\/t\/article-jai-mis-en-place-une-sonde-de-surveillance-cybersecurite-pour-mon-reseau-domotique\/79578<\/a><\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Home network security has become a real concern. Between connected objects, voice assistants, IP cameras, NAS, smartphones and home automation equipment, our local networks increasingly resemble small business networks. And we will not escape the mass attacks that are launched by [...]<\/p>","protected":false},"author":1,"featured_media":11312,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[70,14,53],"tags":[],"class_list":["post-11302","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurite","category-domotique","category-home-assistant"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11302","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/comments?post=11302"}],"version-history":[{"count":0,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/posts\/11302\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media\/11312"}],"wp:attachment":[{"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/media?parent=11302"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/categories?post=11302"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sigalou-domotique.fr\/en\/wp-json\/wp\/v2\/tags?post=11302"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}