aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add export of wiki install docs to our doc/ dir.

Browse Source
remotes/origin/master-1.2.x
Victor Julien 15 years ago
parent 0818a151ec
commit 67a4153137
21 changed files with 2149 additions and 0 deletions
Show Stats Download Patch File Download Diff File

99
doc/Basic_Setup.txt
Unescape Escape View File

@ -0,0 +1,99 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Basic_Setup
Basic Setup
When using Debian or FreeBSD, make sure you enter all commands as root/super-
user because for these operating systems it is not possible to use 'sudo'.
Start with creating a directory for Suricata's log information.
sudo mkdir /var/log/suricata
To prepare the system for using it, enter:
cd /etc
Followed by:
sudo mkdir suricata
In this example the directory created is named 'suricata'. It is possible to
choose the name you prefer.
Then enter:
cd ~/suricata/oisf
The next step is to copy classification.config, reference.config and
suricata.yaml from the oisf directory to the /etc/suricata directory. Do so by
entering the following:
sudo cp classification.config /etc/suricata
sudo cp reference.config /etc/suricata
sudo cp suricata.yaml /etc/suricata
Setting variables
Make sure every variable of the vars, address-groups and port-groups in the
yaml file is set correctly for your needs.
You need to set the ip-address(es) of your home network at HOME_NET.
It is recommended to set EXTERNAL_NET to !$HOMENET_NET. This way, every ip-
address but the
one set at HOME_NET will be treated as external.
It is also possible to set EXTERNAL_NET to 'any', only the recommended setting
is more precise and lowers the change that false positives will be generated.
HTTP_SERVERS, SMTP_SERVERS , SQL_SERVERS , DNS_SERVERS and TELNET_SERVERS are
by default set to HOME_NET. AIM_SERVERS is by default set at 'any'. These
variables have to be set for servers on your network.
All settings have to be set precise to let it have a more accurate effect.
Next, make sure the following ports are set to your needs: HTTP_PORTS,
SHELLCODE_PORTS, ORACLE_PORTS and SSH_PORTS.
In the near future you can set the host-os-policy to your needs.
windows:[]
bsd: []
bsd_right: []
old_linux: []
linux: [10.0.0.0/8, 192.168.1.100, "8762:2352:6241:7245:E000:0000:0000:
0000"]
old_solaris: []
solaris: ["::1"]
hpux10: []
hpux11: []
irix: []
macos: []
vista: []
windows2k3: []
Interface cards
To check the available interface cards, enter:
ifconfig
Now you can see which one you would like Suricata to use.
To start the engine and include the interface card of your preference, enter:
sudo suricata -c /etc/suricata/suricata.yaml -i wlan0
Instead of wlan0, you can enter the interface card of your preference.
To see if the engine is working correctly and registrates traffic, enter:
cd /var/log/suricata
Followed by:
tail http.log
And:
tail -n 33 stats.log
To make sure the information displayed is up-dated, enter before http.log and
stats.log:
tail -f http.log

93
doc/CentOS5.txt
Unescape Escape View File

@ -0,0 +1,93 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS5
CentOS5
Pre-installation requirements
You will have to use the Fedora EPEL repository for some packages to enable
this repository. It is the same for i386 and x86_64:
sudo rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/i386/epel-release-
5-3.noarch.rpm
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \
pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \
libyaml-devel zlib zlib-devel
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
If you plan to build Suricata with IPS capabilities via ./configure --enable-
nfqueue, there are no pre-built packages in the CentOS base or EPEL for
libnfnetlink and libnetfilter_queue. If you wish, you may use the rpms in the
Emerging Threats Cent OS 5 repository:
i386
sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/i386/
libnetfilter_queue-0.0.15-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/
libnetfilter_queue-devel-0.0.15-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink-
0.0.30-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink-
devel-0.0.30-1.i386.rpm
x86_64
sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/
x86_64/libnetfilter_queue-0.0.15-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/
libnetfilter_queue-devel-0.0.15-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/
libnfnetlink-0.0.30-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/
libnfnetlink-devel-0.0.30-1.x86_64.rpm
libcap-ng installation
This installation is needed for dropping privileges.
wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.6.4.tar.gz
tar -xzvf libcap-ng-0.6.4.tar.gz
cd libcap-ng-0.6.4
./configure
make
sudo make install
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5
If you are building from Git sources, enter all the following commands:
bash autogen.sh
If you are not building from Git sources, enter only:
./configure
make
sudo make install
Please continue with the Basic_Setup.

93
doc/CentOS_56_Installation.txt
Unescape Escape View File

@ -0,0 +1,93 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_56_Installation
CentOS 5.6 Installation
Pre-installation requirements
You will have to use the Fedora EPEL repository for some packages to enable
this repository. It is the same for i386 and x86_64:
sudo rpm -Uvh http://download.fedora.redhat.com/pub/epel/5/x86_64/epel-
release-5-4.noarch.rpm
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \
pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \
libyaml-devel zlib zlib-devel
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
If you plan to build Suricata with IPS capabilities via ./configure --enable-
nfqueue, there are no pre-built packages in the CentOS base or EPEL for
libnfnetlink and libnetfilter_queue. If you wish, you may use the rpms in the
Emerging Threats Cent OS 5 repository:
i386
sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/i386/
libnetfilter_queue-0.0.15-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/
libnetfilter_queue-devel-0.0.15-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink-
0.0.30-1.i386.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/i386/libnfnetlink-
devel-0.0.30-1.i386.rpm
x86_64
sudo rpm -Uvh http://rules.emergingthreatspro.com/projects/emergingrepo/
x86_64/libnetfilter_queue-0.0.15-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/
libnetfilter_queue-devel-0.0.15-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/
libnfnetlink-0.0.30-1.x86_64.rpm \
http://rules.emergingthreatspro.com/projects/emergingrepo/x86_64/
libnfnetlink-devel-0.0.30-1.x86_64.rpm
libcap-ng installation
This installation is needed for dropping privileges.
wget http://people.redhat.com/sgrubb/libcap-ng/libcap-ng-0.6.4.tar.gz
tar -xzvf libcap-ng-0.6.4.tar.gz
cd libcap-ng-0.6.4
./configure
make
sudo make install
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5
If you are building from Git sources, enter all the following commands:
bash autogen.sh
If you are not building from Git sources, enter only:
./configure
make
sudo make install
Please continue with the Basic_Setup.

65
doc/Debian_Installation.txt
Unescape Escape View File

@ -0,0 +1,65 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Debian_Installation
Debian Installation
Pre-installation requirements
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
Make sure you will enter all the following commands as root/super-user,
otherwise it will not work.
apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-1 libyaml-dev zlib1g zlib1g-dev
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
By default, Suricata works as an IDS. If you want to use it as a IDS and IPS
program, enter:
apt-get -y install libnetfilter-queue-dev libnetfilter-queue1 libnfnetlink-
dev libnfnetlink0
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5/
Compile and install the program
If you plan to build Suricata with IPS capabilities, enter:
./configure --enable-nfqueue
instead of
./configure
Continue with the next commands:
./configure
make
make install
To make sure the existing list with libraries will be updated with the new
library, enter:
ldconfig
Please continue with the Basic_Setup.

53
doc/Fedora_Core.txt
Unescape Escape View File

@ -0,0 +1,53 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Fedora_Core
Fedora Core
pre-installation requirements
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
sudo yum -y install libpcap libpcap-devel libnet libnet-devel pcre \
pcre-devel gcc gcc-c++ automake autoconf libtool make libyaml \
libyaml-devel zlib zlib-devel libcap-ng libcap-ng-devel
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
If you plan to build Suricata with IPS capabilities via ./configure --enable-
nfqueue, enter the following:
sudo yum -y install libnfnetlink libnfnetlink-devel \
libnetfilter_queue libnetfilter_queue-devel
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5
If you are building from Git sources, enter all the following commands:
bash autogen.sh
If you are not building from Git sources, enter only the following:
./configure
make
sudo make install
Please continue with the Basic_Setup.

73
doc/FreeBSD_8.txt
Unescape Escape View File

@ -0,0 +1,73 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/FreeBSD_8
FreeBSD 8
Pre-installation requirements
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
Make sure you enter all commands as root/super-user, otherwise it will not
work.
pkg_add -r autoconf262 automake19 gcc45 libyaml pcre libtool \
libnet11 libpcap gmake
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
If you would like to build suricata on FreeBSD with IPS capabilities with IPFW
via --enable-ipfw, enter the following to enable ipfw and divert socket support
before starting the engine with -d:
Edit /etc/rc.conf and add or modify the following lines:
firewall_enable="YES"
firewall_type="open"
Edit /boot/loader.conf and add or modify the following lines:
ipfw_load="YES"
ipfw_nat_load="YES"
ipdivert_load="YES"
dummynet_load="YES"
libalias_load="YES"
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5
If you are building from Git sources, enter all the following commands until
the end of this file:
bash autogen.sh
If you are not building from Git sources, do not enter the above mentioned
commands. Continue enter the following:
./configure
make
make install
zerocopy bpf
mkdir /var/log/suricata/
FreeBSD 8 has support for zerocopy bpf in libpcap. To test this functionality,
issue the following command and then start/restart the engine:
sysctl net.bpf.zerocopy_enable=1
Please continue with the Basic_Setup.

18
doc/HTP_library_installation.txt
Unescape Escape View File

@ -0,0 +1,18 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/HTP_library_installation
HTP library installation
The installation of the HTP library is the same for several operating systems,
except you can not use 'sudo' with Debian and FreeBSD. Using Debian or FreeBSD
you have to Make sure you enter all following commands as root/super-user.
To download and build HTP, enter the following:
wget http://www.openinfosecfoundation.org/download/libhtp-0.2.3.tar.gz
tar -xzvf libhtp-0.2.3.tar.gz
cd libhtp-0.2.3
./configure
make
make install

119
doc/Installation_from_GIT_with_PCRE-JIT.txt
Unescape Escape View File

@ -0,0 +1,119 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PCRE-JIT
Installation from GIT with PCRE-JIT
In this guide will be explained how to install and use the most recent code of
Suricata on Ubuntu together with PCRE with JIT 8.20-RC1 support. The goal of
PCRE-JIT is to improve the pcre pattern matching performance of the pcre
library.
The easiest way to see performance difference is to create a couple of pcre
only rules or use for example the SSN rules from ET, and compare the
performance statistics for rules.
Installing from GIT on other operating systems is basically the same, except
that some commands are Ubuntu-specific (like sudo and apt-get). In case you are
using another operating system, you should replace those commands by your
operating-specific commands.
Pre-installation requirements
Before you can build Suricata with PCRE-JIT for your system, run the following
command to ensure that you have everything you need for the installation.
sudo apt-get -y install build-essential autoconf automake \
libtool libpcap-dev libnet1-dev libyaml-0-2 libyaml-dev \
zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make g++
sudo apt-get install git-core
Depending on the current status of your system, it may take a while to complete
this process.
PCRE with JIT support
Enter the following commands for PCRE JIT installation:
wget ftp://ftp.csx.cam.ac.uk/pub/software/programming/pcre/Testing/pcre-8.20-
RC1.tar.gz
tar -xzvf pcre-8.20-RC1.tar.gz
cd pcre-8.20-RC1
./configure --enable-jit
Make sure you see that JIT compiling support is enabled, see example:
make
sudo make install
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
By default, Suricata works as an IDS. If you want to use it as a IDS and IPS
program, enter:
sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1
libnfnetlink-dev libnfnetlink0
Suricata
First, it is convenient to create a directory for Suricata. Name it 'suricata'
for example. Open the terminal and enter:
mkdir suricata
Followed by:
cd suricata
Next, enter the following line in the terminal:
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf
Followed by:
./autogen.sh
Compile and install
To configure, please enter:
./configure --enable-pcre-jit \
--with-libpcre-includes=/usr/local/include \
--with-libpcre-libraries=/usr/local/lib
After entering the previous, make sure that your screen looks like the
following example and you have PCRE with JIT support:
make
sudo make install
sudo ldconfig
To check the build information you can enter:
suricata --build-info
Please continue with Basic_Setup.
In case you have already made a map for the most recent code, downloaded the
code into that map, and want to download recent code again, please enter:
cd suricata/oisf
next, enter:
git pull
After that, you start again at running autogen.

73
doc/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104.txt
Unescape Escape View File

@ -0,0 +1,73 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_from_GIT_with_PF_RING_on_Ubuntu_server_1104
Installation from GIT with PF RING on Ubuntu server 11.04
This guide is based on using Ubuntu Server 11.04
Linux ubuntu 2.6.38-8-generic x86_64 GNU/Linux
Pre installation requirements
Install the following packages, to make sure you have everything needed for the
installation:
sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make flex bison git subversion
Go to your download directory and get the latest PF_RING:
svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING
Compile and install
Next, enter the following commands for configuration and installation:
cd PF_RING/kernel
make && make install
sudo insmod ./pf_ring.ko
cd ../userland
make && make install
cd /lib
./configure && make && make install
cd ../libpcap
./configure && make && make install
cd /examples
echo "options pf_ring transparent_mode=0 min_num_slots=32768
enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf
To check if you have everything you need, enter:
lsmod |grep pf_ring
sudo modprobe pf_ring
sudo modinfo pf_ring && cat /proc/net/pf_ring/info
To check if PF_RING is functional, enter the following:
./pfcount -i eth0
Suricata
Go to your download directory of choice, and enter:
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf
sudo ./autogen.sh
sudo ./configure --enable-pfring && make && make install
You can always check if PF_RING is build in properly, by entering:
suricata --build-info
To run Suricata with PF_RING, enter:
suricata --pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster-
type=cluster_flow -c /etc/suricata/suricata.yaml
Continue with the Basic_Setup.
Thanks to Peter Manev

146
doc/Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6.txt
Unescape Escape View File

@ -0,0 +1,146 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_and_PFRING_on_Scientific_Linux_6
Installation with CUDA and PFRING on Scientific Linux 6
For setup and install you need to be root:
mkdir /root/src
cd /root/src
Pre installation requirements
Install the following packages, to make sure you have everything needed for the
installation:
yum install mpfr-2.4.1-6.el6.x86_64 cpp-4.4.4-13.el6.x86_64 ppl-0.10.2-
11.el6.x86_64 \
cloog-ppl-0.15.7-1.2.el6.x86_64 gcc-4.4.4-13.el6.x86_64 kernel-devel-2.6.32-
131.2.1.el6.x86_64 \
pcre-devel-7.8-3.1.el6.x86_64 libpcap-devel-1.0.0-
6.20091201git117cb5.el6.x86_64 \
yum-plugin-priorities-1.1.26-11.el6.noarch yum-conf-sl6x-1-1.noarch libyaml-
0.1.3-1.el6.rf.x86_64 \
libyaml-devel-0.1.3-1.el6.rf.x86_64 libnet-1.1.2.1-2.2.el6.rf.x86_64 flex-
2.5.35-8.el6.x86_64 \
bison-2.4.1-5.el6.x86_64 gcc-c++-4.4.4-13.el6.x86_64
CUDA
Download and install NVIDIA CUDA drivers:
wget http://us.download.nvidia.com/XFree86/Linux-x86_64/270.41.19/NVIDIA-
Linux-x86_64-270.41.19.run
chmod +x NVIDIA-Linux-x86_64-270.41.19.run
./NVIDIA-Linux-x86_64-270.41.19.run
You also need to download and install the CUDA toolkit for RHEL6 :
wget http://developer.download.nvidia.com/compute/cuda/4_0/toolkit/
cudatoolkit_4.0.17_linux_64_rhel6.0.run
chmod +x cudatoolkit_4.0.17_linux_64_rhel6.0.run
./cudatoolkit_4.0.17_linux_64_rhel6.0.run
Make sure the kernel modules are loaded:
/sbin/modprobe -r nouveau && /sbin/modprobe nvidia
To ensure the proper NVIDIA CUDA modules get loaded on reboot, add the above
line to your /etc/rc.local file.
PF_RING
Get latest PF_RING from http://sourceforge.net/projects/ntop/files/PF_RING/.
For example (v4.7.1 is necessary for Suricata 1.1beta2):
wget http://sourceforge.net/projects/ntop/files/PF_RING/PF_RING-4.7.1.tar.gz/
download
tar -xzvf PF_RING-4.7.1.tar.gz
cd PF_RING-4.7.1/
Next, build & install kernel and userland:
make
cd kernel; make install
cd ../userland/lib; make install
Load the pf_ring kernel module:
/sbin/modprobe pf_ring
To ensure the pf_ring module gets loaded on reboot, add the above line to your
/etc/rc.local file.
Suricata
Download and install Suricata:
wget http://www.openinfosecfoundation.org/download/suricata-1.1beta2.tar.gz
And unpack it:
tar -xvzf suricata-1.1beta2.tar.gz
Change to the unpacked directory:
cd suricata-1.1beta2
Now compile and install Suricata with PF_RING and CUDA support:
./configure --enable-gccprotect --enable-profiling --enable-cuda --with-cuda-
includes=/usr/local/cuda/include \
--with-cuda-libraries=/usr/local/cuda/lib64 --enable-pfring --with-libpfring-
libraries=/usr/local/lib \
--with-libpfring-includes=/usr/local/include --with-libpcap-libraries=/usr/
local/lib --with-libpcap-includes=/usr/local/include
make
make install
Continue with the Basic_Setup
Next, you need to edit max-pending-packets in your /etc/suricata/suricata.yaml.
If you don't have one, download a generic one to get started:
cd /etc/suricata
wget https://rules.emergingthreatspro.com/open-nogpl/suricata/suricata-
open.yaml
Edit your suricata-open.yaml file accordingly.
The number of packets allowed to be processed simultaneously can be whatever
you want but it is recommended that it be 4000 or more.
For example:
max-pending-packets: 12288
Next make sure the following line is present in the multi pattern algorithm
section:
mpm-algo: b2g_cuda
Rules
Read the information in Rule_Management_with_Oinkmaster
Add rules to suricata:
cd /etc/suricata
wget https://rules.emergingthreatspro.com/open-nogpl/suricata/
emerging.rules.tar.gz
tar -xvzf emerging.rules.tar.gz
Make sure your .yaml file includes the /etc/suricata/rules/emerging-*.rules
files (they may need to be uncommented).
Run Suricata as followed:
cd /etc/suricata
/usr/local/bin/suricata -c /etc/suricata/suricata.yaml\
--pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow
touch /var/lock/subsys/local
References
PF_RING
http://www.ntop.org/products/pf_ring/

280
doc/Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104.txt
Unescape Escape View File

@ -0,0 +1,280 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_and_PF_RING_on_Ubuntu_server_1104
Installation with CUDA and PF RING on Ubuntu server 11.04
THIS WOULD NOT WORK ON A VIRTUAL MACHINE!
This guide is written using:
Ubuntu Server 11.04
Linux ubuntu 2.6.38-8-generic x86_64 GNU/Linux
Pre installation requirements
apt-get update
apt-get upgrade
To get the CUDA toolkit, enter:
http://developer.nvidia.com/cuda-toolkit-40
Pick up the correct NVIDIA drivers for your card and system
http://www.nvidia.com/Download/index.aspx?lang=en-us
Go to your download directory
chmod the 2 *.run files that you just downloaded.
For example:
chmod 655 cudatoolkit_4.0.17_linux_64_ubuntu10.10.run
chmod 655 NVIDIA-Linux-x86_64-280.13.run
sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make flex bison git
Run the cuda toolkit installation package:
sudo ./cudatoolkit_4.0.17_linux_64_ubuntu10.10.run
Close all windows and as you are logged in press:
Ctr+Alt+F1
Log in with your credentials
sudo -i
And enter your password
Stop the x server:
/etc/init.d/gdm stop
Uninstall xserver video drivers:
apt-get remove --purge xserver-xorg-video-nouveau
Go to the directory where you downloaded nvidia/cuda drivers.
Run the NVIDIA*******.run:
./NVIDIA********.run
Ok and yes your way out.
At some point it will ask you to make a special configuration file to disable a
"nouveau"
driver that the system is currently using - say yes!
Reboot:
shutdown -r now
After reboot log in as you would normally do through the GUI
Log in as you would normally.
Go to shell:
Ctrl+Alt+F1
Type in your credentials and pass
sudo -i
Stop the xserver again:
/etc/init.d/gdm stop
Run the NVIDIA driver again.
This time it would finish and be successful....
Reboot:
shutdown -r now
After start you would notice that the display has much better resolution - it
is a good thing.
Log in as you would normally.
Because the 11.04 Ubuntu comes with gcc version 4.5 by default, you need to
install gcc 4.4 since you must use 4.4 for the cuda compilation:
apt-get install gcc-4.4 gcc-4.4-base g++-4.4
Then we switch and make ubuntu use the gcc 4.4 by default:
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.5 40 --
slave /usr/bin/g++ g++ /usr/bin/g++-4.5
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.4 60 --
slave /usr/bin/g++ g++ /usr/bin/g++-4.4
Make sure that this is the case:
sudo update-alternatives --config gcc
""
update-alternatives --config gcc (as root)
There are 2 choices for the alternative gcc (providing /usr/bin/gcc).
Selection Path Priority Status
------------------------------------------------------------
* 0 /usr/bin/gcc-4.4 60 auto mode
1 /usr/bin/gcc-4.4 60 manual mode
2 /usr/bin/gcc-4.5 40 manual mode
Press enter to keep the current choice[*], or type selection number (as
root)
""
PF_RING installation.
Install pre-requisites:
cd /opt
apt-get install subversion gobjc++-4.4-multilib gobjc++-4.4
Get the latest PF_RING:
svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/ PF_RING
Install PF_RING:
cd /kernel
make && make install
sudo insmod ./pf_ring.ko
cd ../userland
make && make install
cd /lib
./configure && make && make install
cd ../libpcap
./configure && make && make install
cd ../examples
echo "options pf_ring transparent_mode=0 min_num_slots=32768
enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf
Check info:
cat /proc/net/pf_ring/info
""
cd ../kernel
cat /proc/net/pf_ring/info
PF_RING Version : 4.7.3 ($Revision: exported$)
Ring slots : 4096
Slot version : 13
Capture TX : Yes [RX+TX]
IP Defragment : No
Socket Mode : Standard
Transparent mode : Yes (mode 0)
Total rings : 0
Total plugins : 0
""
Check functionality:
./pfcount -i eth0
You should see something even if you have no traffic at the moment:
""
cd /opt/PF_RING/userland/examples
./pfcount -i eth0
Using PF_RING v.4.7.3
Capturing from eth0 [88:AE:1D:56:90:FA]
1. Device RX channels: 1
2. Polling threads: 1 =========================
Absolute Stats: [0 pkts rcvd][0 pkts dropped]
Total Pkts=0/Dropped=0.0 %
0 pkts - 0 bytes =========================
=========================
Absolute Stats: [0 pkts rcvd][0 pkts dropped]
Total Pkts=0/Dropped=0.0 %
0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec] =========================
Actual Stats: 0 pkts [1'000.32 ms][0.00 pkt/sec] =========================
^CLeaving... =========================
Absolute Stats: [0 pkts rcvd][0 pkts dropped]
Total Pkts=0/Dropped=0.0 %
0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec] =========================
Actual Stats: 0 pkts [629.37 ms][0.00 pkt/sec] =========================
cd /opt/PF_RING/userland/examples
""
Suricata
Go to directory of your choice and get Suricata:
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf/
Configure:
./autogen.sh
./configure --enable-gccprotect --enable-profiling --enable-cuda --with-cuda-
includes=/usr/local/cuda/include \
--with-cuda-libraries=/usr/local/cuda/lib64 --enable-pfring
You should get at the end:
""
Suricata Configuration:
NFQueue support: no
IPFW support: no
PF_RING support: yes
Prelude support: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no
CUDA enabled: yes
DAG enabled: no
Profiling enabled: yes
GCC Protect enabled: yes
GCC march native enabled: yes
GCC Profile enabled: no
Unified native time: no
Non-bundled htp: no
PCRE sljit: no
""
Install:
make && make install
ldconfig
Verify:
suricata --build-info
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:622) <Info> (main) -- This is
Suricata version 1.1beta2 (rev b3f7e6a)
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:507) <Info> (SCPrintBuildInfo) -
- Features: PCAP_SET_BUFF LIBPCAP_VERSION_MAJOR=1 CUDA PF_RING LIBCAP_NG
LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:521) <Info> (SCPrintBuildInfo) -
- 64-bits, Little-endian architecture
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:523) <Info> (SCPrintBuildInfo) -
- GCC version 4.4.5, C version 199901
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:529) <Info> (SCPrintBuildInfo) -
- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_1
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:532) <Info> (SCPrintBuildInfo) -
- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_2
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:535) <Info> (SCPrintBuildInfo) -
- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_4
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:538) <Info> (SCPrintBuildInfo) -
- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_8
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:541) <Info> (SCPrintBuildInfo) -
- __GCC_HAVE_SYNC_COMPARE_AND_SWAP_16
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:545) <Info> (SCPrintBuildInfo) -
- compiled with -fstack-protector
[1840] 13/8/2011 -- 14:26:39 - (suricata.c:551) <Info> (SCPrintBuildInfo) -
- compiled with _FORTIFY_SOURCE=2
Run Suricata:
suricata -c /etc/suricata/suricata.yaml\
--pfring-int=eth0 --pfring-cluster-id=99 --pfring-cluster-type=cluster_flow

95
doc/Installation_with_CUDA_on_Scientific_Linux_6.txt
Unescape Escape View File

@ -0,0 +1,95 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_on_Scientific_Linux_6
Installation with CUDA on Scientific Linux 6
Hardware used: HP Proliant G7, 16 cores, 30 GB RAM, NVIDIA CUDA Quadro 4000
graphics card
For setup you need to be root. Enter the following:
mkdir /root/src
cd /root/src
Pre installation requirements
Run the following command to ensure that you have everything you need for the
installation:
yum install mpfr-2.4.1-6.el6.x86_64 cpp-4.4.4-13.el6.x86_64 ppl-0.10.2-
11.el6.x86_64 \
cloog-ppl-0.15.7-1.2.el6.x86_64 gcc-4.4.4-13.el6.x86_64 kernel-devel-2.6.32-
131.2.1.el6.x86_64 \
pcre-devel-7.8-3.1.el6.x86_64 libpcap-devel-1.0.0-
6.20091201git117cb5.el6.x86_64 \
yum-plugin-priorities-1.1.26-11.el6.noarch yum-conf-sl6x-1-1.noarch libyaml-
0.1.3-1.el6.rf.x86_64 \
libyaml-devel-0.1.3-1.el6.rf.x86_64 libnet-1.1.2.1-2.2.el6.rf.x86_64 flex-
2.5.35-8.el6.x86_64 \
bison-2.4.1-5.el6.x86_64 gcc-c++-4.4.4-13.el6.x86_64
CUDA
Download and install NVIDIA CUDA drivers:
wget http://us.download.nvidia.com/XFree86/Linux-x86_64/270.41.19/NVIDIA-
Linux-x86_64-270.41.19.run
chmod +x NVIDIA-Linux-x86_64-270.41.19.run
./NVIDIA-Linux-x86_64-270.41.19.run
You also need to download and install the CUDA toolkit for RHEL6 :
wget http://developer.download.nvidia.com/compute/cuda/4_0/toolkit/
cudatoolkit_4.0.17_linux_64_rhel6.0.run
chmod +x cudatoolkit_4.0.17_linux_64_rhel6.0.run
./cudatoolkit_4.0.17_linux_64_rhel6.0.run
Make sure the kernel modules are loaded:
/sbin/modprobe -r nouveau && /sbin/modprobe nvidia
To ensure the proper NVIDIA CUDA modules get loaded on reboot, add the above
line to your /etc/rc.local file.
Suricata
Download and install Suricata:
wget http://www.openinfosecfoundation.org/download/suricata-1.1beta2.tar.gz
And unpack it:
tar -xvzf suricata-1.1beta2.tar.gz
Change to the unpacked directory:
cd suricata-1.1beta2
Compile and install the engine with CUDA support:
./configure --enable-gccprotect --enable-profiling --enable-cuda \
--with-cuda-includes=/usr/local/cuda/include --with-cuda-libraries=/usr/
local/cuda/lib64/
make
make install
Rules
Read the information in Rule_Management_with_Oinkmaster
Add rules to suricata:
cd /etc/suricata
wget https://rules.emergingthreatspro.com/open-nogpl/suricata/
emerging.rules.tar.gz
tar -xvzf emerging.rules.tar.gz
Make sure your .yaml file includes the /etc/suricata/rules/emerging-*.rules
files (they may need to be uncommented).
Run Suricata as followed:
cd /etc/suricata
/usr/local/bin/suricata -c /etc/suricata/suricata.yaml -i eth0

183
doc/Installation_with_CUDA_on_Ubuntu_server_1104.txt
Unescape Escape View File

@ -0,0 +1,183 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_CUDA_on_Ubuntu_server_1104
Installation with CUDA on Ubuntu server 11.04
THIS WOULD NOT WORK ON A VIRTUAL MACHINE!
This guide is written using:
Ubuntu Server 11.04
Linux ubuntu 2.6.38-8-generic x86_64 GNU/Linux
Pre installation requirements
apt-get update
apt-get upgrade
Get the CUDA toolkit
http://developer.nvidia.com/cuda-toolkit-40
Pick up the correct NVIDIA drivers for your card and system
http://www.nvidia.com/Download/index.aspx?lang=en-us
Go to your download directory
and chmod the 2 *.run files that you just downloaded.
Example:
chmod 655 cudatoolkit_4.0.17_linux_64_ubuntu10.10.run
chmod 655 NVIDIA-Linux-x86_64-280.13.run
sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make flex bison git
Run the cuda toolkit installation package:
sudo ./cudatoolkit_4.0.17_linux_64_ubuntu10.10.run
Close all windows and as you are logged in press:
Ctr+Alt+F1
Log in with your credentials
sudo -i
And enter your password
Stop the x server:
/etc/init.d/gdm stop
Uninstall xserver video drivers:
apt-get remove --purge xserver-xorg-video-nouveau
Go to the directory where you downloaded nvidia/cuda drivers.
Run the NVIDIA*******.run:
./NVIDIA********.run
Ok and yes your way out.
At some point it will ask you to make a special configuration file to disable a
"nouveau"
driver that the system is currently using and prevents the NVIDIA drivers to be
installed - say yes!
Reboot:
shutdown -r now
After reboot log in as you would normally through the GUI
Log in as you would normally.
Go to shell:
Ctrl+Alt+F1
Type in your credentials and pass
sudo -i
Stop the xserver again:
/etc/init.d/gdm stop
Run the NVIDIA driver again.
This time it would finish and be successful....
Reboot:
shutdown -r now
After start you would notice that the display has much better resolution - it
is a good thing.
Log in as you would normally.
Because the 11.04 Ubuntu comes with gcc version 4.5 by default we need to
install gcc 4.4 since we must use 4.4 for the cuda compilation:
apt-get install gcc-4.4 gcc-4.4-base g++-4.4
Then we switch and make ubuntu use the gcc 4.4 by default:
sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.5 40 --
slave /usr/bin/g++ g++ /usr/bin/g++-4.5
udo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-4.4 60 --
slave /usr/bin/g++ g++ /usr/bin/g++-4.4
We make sure that this is the case:
sudo update-alternatives --config gcc
""
update-alternatives --config gcc (as root)
There are 2 choices for the alternative gcc (providing /usr/bin/gcc).
* 0 /usr/bin/gcc-4.4 60 auto mode
1 /usr/bin/gcc-4.4 60 manual mode
2 /usr/bin/gcc-4.5 40 manual mode
Selection Path Priority Status
------------------------------------------------------------
Press enter to keep the current choice[*], or type selection number:
""
Suricata
Enter the following in your download directory:
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf/
./autogen.sh
./configure --enable-gccprotect --enable-profiling --enable-cuda \
--with-cuda-includes=/usr/local/cuda/include --with-cuda-libraries=/usr/
local/cuda/lib64/
After that you should get the following result:
""
Suricata Configuration:
NFQueue support: no
IPFW support: no
PF_RING support: no
Prelude support: no
Unit tests enabled: no
Debug output enabled: no
Debug validation enabled: no
CUDA enabled: yes
DAG enabled: no
Profiling enabled: yes
GCC Protect enabled: yes
GCC march native enabled: yes
GCC Profile enabled: no
Unified native time: no
Non-bundled htp: no
PCRE sljit: no
""
make && make install
ldconfig
Proceed with Basic_Setup
After you start suricata , you should see cuda
example :
""
suricata -c suricata.yaml -i eth0
[12406] 13/8/2011 -- 10:14:39 - (suricata.c:622) <Info> (main) -- This is
Suricata version 1.1beta2 (rev b3f7e6a)
[12406] 13/8/2011 -- 10:14:39 - (util-cpu.c:171) <Info> (UtilCpuPrintSummary)
-- CPUs/cores online: 8
[12406] 13/8/2011 -- 10:14:39 - (util-cuda.c:4504) <Info>
(SCCudaPrintBasicDeviceInfo) -- GPU Device 1: GeForce 310M, 2
Multiprocessors, 1468MHz, CUDA Compute Capability 1.2...................
........................
""

207
doc/Installation_with_PF_RING.txt
Unescape Escape View File

@ -0,0 +1,207 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Installation_with_PF_RING
Installation with PF RING
This is the installation guide for Suricata with PF_RING support and a guide to
install PF_RING.
To install DKMS, enter:
sudo apt-get install dkms
To get subversion for checking out the PF_RING code, flex and bison for
libpcap, enter:
sudo apt-get install subversion flex bison
To install the debs needed for Suricata, enter the following:
sudo apt-get install libpcre3-dev libpcap-dev libyaml-dev zlib1g-dev libcap-
ng-dev libnet1-dev
In the example you will build from the GIT repository, so you will need some
extra packages:
sudo apt-get install git-core automake autoconf libtool
To build your modules, please go to:
cd /usr/src/
Checkout the PF_RING code:
sudo svn --force export https://svn.ntop.org/svn/ntop/trunk/PF_RING/
PF_RING_CURRENT_SVN
Create the DKMS build directory and copy files over for the main PF_RING module
by entering the following:
sudo mkdir /usr/src/pf_ring-4
sudo cp -Rf /usr/src/PF_RING_CURRENT_SVN/kernel/* /usr/src/pf_ring-4/
cd /usr/src/pf_ring-4/
Create a file called 'dkms.conf'
sudo nano dkms.conf
and place the following into the file:
PACKAGE_NAME="pf_ring"
PACKAGE_VERSION="4"
BUILT_MODULE_NAME[0]="pf_ring"
DEST_MODULE_LOCATION[0]="/kernel/net/pf_ring/"
AUTOINSTALL="yes"
To close the file, do so by pressing Ctrl and X at the same time, followed by y
and enter.
Build and install the kernel -module of PF_RING:
sudo dkms add -m pf_ring -v 4
sudo dkms build -m pf_ring -v 4
sudo dkms install -m pf_ring -v 4
development headers.(zie aantekeningen)
sudo mkdir -p /opt/PF_RING/{bin,lib,include/linux,sbin}
Next, build and install the userland lib.:
sudo cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /opt/PF_RING/
include/linux/
cd /usr/src/PF_RING_CURRENT_SVN/userland/lib
sudo ./configure
sudo sed -i -e 's/INSTDIR = \${DESTDIR}\/usr\/local/INSTDIR = \$
{DESTDIR}\/opt\/PF_RING/' Makefile
sudo cp -f pfring_e1000e_dna.h /opt/PF_RING/include
sudo make
sudo make install
Enter the following to pull down the latest version of Suricata from the git
repository and build with PF_RING support:
cd /usr/src/PF_RING_CURRENT_SVN/userland/
sudo git clone git://phalanx.openinfosecfoundation.org/oisf.git oisfnew
cd oisfnew
sudo ./autogen.sh
sudo ./configure --enable-pfring --with-libpfring-libraries=/opt/PF_RING/lib
--with-libpfring-includes=/opt/PF_RING/include --with-libpcap-libraries=/opt/
PF_RING/lib --with-libpcap-includes=/opt/PF_RING/include LD_RUN_PATH="/opt/
PF_RING/lib:/usr/lib:/usr/local/lib" --prefix=/opt/PF_RING/
sudo make install
sudo make
sudo mkdir etc/suricata
To make config and log directories for a more complete getting started, see:
Basic_Setup.
sudo mkdir /etc/suricata
sudo cp suricata.yaml /etc/suricata/
sudo cp classification.config /etc/suricata/
sudo mkdir /var/log/suricata
The information about the setup options for when you initialise the module:
min_num_slots:Number of ring slots (uint)
transparent_mode:0=standard Linux, 1=direct2pfring+transparent,
2=direct2pfring+non transparent.
For 1 and 2 you need to use a PF_RING aware driver (uint) .
enable_tx_capture:Set to 1 to capture outgoing packets (uint)
enable_ip_defrag:Set to 1 to enable IP defragmentation(only rx traffic is
defragmentead) (uint)
Enter the following as super-user:
echo "options pf_ring transparent_mode=0 min_num_slots=32768
enable_tx_capture=0" > /etc/modprobe.d/pf_ring.conf
To check the status of PF_RING :
sudo modprobe pf_ring
sudo modinfo pf_ring && cat /proc/net/pf_ring/info
Start up Suricata with PF_RING support:
sudo /opt/PF_RING/bin/suricata --pfring-int=eth0 --pfring-cluster-id=99 --
pfring-cluster-type=cluster_flow -c /etc/suricata/suricata.yaml
If you need to uninstall PF_RING or rollback your PF_RING aware drivers to
their previous state you can do so with the following commands:
sudo dkms remove -m pf_ring -v 4 --all
Optional
The following part is optional.
sudo dkms remove -m e1000e-pf_ring -v 1.0.15 --all
If you issue the following command, you can see that PF_RING should now be
installed as DKMS module:
dkms status
Now go through the steps to build a PF_RING aware driver:
sudo mkdir /usr/src/e1000e-pf_ring-1.0.15
sudo cp -Rf /usr/src/PF_RING_CURRENT_SVN/drivers/intel/e1000e/old/e1000e-
1.0.15/src/* /usr/src/e1000e-pf_ring-1.0.15/
Enter the following so that DKMS can find it for driver rebuilds:
sudo cp -f /usr/src/PF_RING_CURRENT_SVN/kernel/linux/pf_ring.h /usr/src/
e1000e-pf_ring-1.0.15/
cd /usr/src/e1000e-pf_ring-1.0.15/
After that, fix the path to pf_ring.h:
sed -i -e 's/\.\.\/\.\.\/\.\.\/\.\.\/kernel\/linux\/pf\_ring\.h/pf\_ring\.h/
' netdev.c
Then create a file called 'dkms.conf'.
sudo nano dkms.conf
and place the following into the file:
PACKAGE_NAME="e1000e-pf_ring"
PACKAGE_VERSION="1.0.15"
BUILT_MODULE_NAME[0]="e1000e"
DEST_MODULE_LOCATION[0]="/kernel/drivers/net/e1000e/"
AUTOINSTALL="yes"
Build and install the module of the e1000e-pf_ring network driver:
sudo dkms add -m e1000e-pf_ring -v 1.0.15
sudo dkms build -m e1000e-pf_ring -v 1.0.15
sudo dkms install -m e1000e-pf_ring -v 1.0.15
After that, build and install the PF_RING enabled libpcap:
cd /usr/src/PF_RING_CURRENT_SVN/userland/libpcap-1.0.0-ring
./configure
sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/
' Makefile
sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/
' Makefile.in
./configure --prefix=/opt/PF_RING && make && make install
Subsequently, build and install tcpdump using the PF_RING enabled version of
libpcap:
cd /usr/src/PF_RING_CURRENT_SVN/userland/tcpdump-4.0.0
sudo ./configure
sudo sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/
' Makefile
sudo sed -i -e 's/\.\.\/lib\/libpfring\.a/\/opt\/PF_RING\/lib\/libpfring\.a/
' Makefile.in
sudo sed -i -e 's/-I \.\.\/libpcap-1\.0\.0-ring/-I \/opt\/PF_RING\/include/
' Makefile
sudo sed -i -e 's/-I \.\.\/libpcap-1\.0\.0-ring/-I \/opt\/PF_RING\/include/
' Makefile.in
sudo sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring\/-L /\/opt\/PF_RING\/lib\//
' Makefile
sed -i -e 's/-L \.\.\/libpcap-1\.0\.0-ring\/-L /\/opt\/PF_RING\/lib\//
' Makefile.in
sudo ./configure LD_RUN_PATH="/opt/PF_RING/lib:/usr/lib:/usr/local/lib" --
prefix=/opt/PF_RING/ --enable-ipv6 && make && make install

71
doc/Mac_OS_X_106x.txt
Unescape Escape View File

@ -0,0 +1,71 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Mac_OS_X_106x
Mac OS X (10.6.x)
Pre-installation requirements
These instructions have been tested with Mac OS X (10.6.1). To begin, you will
need an essential development environment much like gcc/make. You can download
Xcode from http://developer.apple.com/technology/xcode.html.
MacPorts is required for you to fetch the depends, so you will also need to
install MacPorts, if you have not already done so. The online installation
guide is located at http://guide.macports.org/#installing.
Before you can build Suricata for your system, you must run the following
command to ensure that you have everything you need for the installation.
port install autoconf automake gcc44 make libnet11 libpcap pcre \
libyaml libtool
export AC_PROG_LIBTOOL=$( which libtool )
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
If you would like to have IPS capabilities with IPFW, then you should run
configure like this:
./configure --enable-ipfw
and execute the rest of the commands the same as above.
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5
You will also need to have an ipfw rule set for the engine to see the packets
from ipfw. For example:
ipfw add 100 divert 8000 ip from any to any
The 8000 above should be the same number you pass on the command line of
suricata with the option -d, that is, -d 8000:
suricata -c config_file.yaml -d 8000
You will need a Suricata rule set with IPS options (drop, reject, etc). For
this, please refer to the Emerging Threats rule sets.
If you are building from Git sources, enter the following:
bash autogen.sh
If you are not building from Git sources, enter the following:
./configure
make
sudo make install
Please continue with the Basic_Setup.

56
doc/OpenBSD_Installation_from_GIT.txt
Unescape Escape View File

@ -0,0 +1,56 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/OpenBSD_Installation_from_GIT
OpenBSD Installation from GIT
Pre-installation Requirements
Before you can build Suricata for your system, run the following commands to
ensure that you have everything you need for the installation.
pkg_add gcc
pkg_add pcre
pkg_add libtool
pkg_add libyaml
pkg_add libnet-1.1.2.1p0
If you would like to build from Git sources, you have to install the following
building tools:
pkg_add git
pkg_add autoconf
pkg_add automake
If you use OpenBSD 4.8, enter the following:
pkg_add git autoconf-2.61p3 automake-1.10.3
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
Suricata
Next, clone the repository and run autogen:
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf
export AUTOCONF_VERSION=2.61
export AUTOMAKE_VERSION=1.10
./autogen.sh
Enter the following to configure:
CPPFLAGS="-I/usr/local/include" CFLAGS="-L/usr/local/lib" ./configure --
prefix=/opt/suricata
To build and install Suricata, enter the following in your command line:
make
make install
Next, continue with the Basic_Setup.
Source: http://home.regit.org/?p=478

83
doc/Setting_up_IPSinline_for_Linux.txt
Unescape Escape View File

@ -0,0 +1,83 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Setting_up_IPSinline_for_Linux
Setting up IPS/inline for Linux
In this guide will be explained how to work with Suricata in inline mode and
how to set iptables for that purpose.
First start with compiling Suricata with NFQ support. For instructions see
Ubuntu_Installation.
For more information about NFQ and iptables, see suricata.yaml.
To check if you have NFQ enabled in your Suricata, enter the following command:
suricata --build-info
and examine if you have NFQ between the features.
To run suricata with the NFQ mode, you have to make use of the -q option. This
option tells Suricata which of the queue numbers it should use.
sudo suricata -c /etc/suricata/suricata.yaml -q 0
Iptables configuration
First of all it is important to know which traffic you would like to send to
Suricata. Traffic that passes your computer or traffic that is generated by
your computer.
If Suricata is running on a gateway and is meant to protect the computers
behind that gateway you are dealing with the first scenario: forward_ing .
If Suricata has to protect the computer it is running on, you are dealing with
the second scenario: host (see drawing 2).
These two ways of using Suricata can also be combined.
The easiest rule in case of the gateway-scenario to send traffic to Suricata
is:
sudo iptables -I FORWARD -j NFQUEUE
In this case, all forwarded traffic goes to Suricata.
In case of the host situation, these are the two most simple iptable rules;
sudo iptables -I INPUT -j NFQUEUE
sudo iptables -I OUTPUT -j NFQUEUE
It is possible to set a queue number. If you do not, the queue number will be 0
by default.
Imagine you want Suricata to check for example just TCP-traffic, or all
incoming traffic on port 80, or all traffic on destination-port 80, you can do
so like this:
sudo iptables -I INPUT -p tcp -j NFQUEUE
sudo iptables -I OUTPUT -p tcp -j NFQUEUE
In this case, Suricata checks just TCP traffic.
sudo iptables -I INPUT -p tcp --sport 80 -j NFQUEUE
sudo iptables -I OUTPUT -p tcp --dport 80 -j NFQUEUE
In this example, Suricata checks all input and output on port 80.
To see if you have set your iptables rules correct make sure Suricata is
running and enter:
sudo iptables -vnL
In the example you can see if packets are being logged.
This description of the use of iptables is the way to use it with IPv4. To use
it with IPv6 all previous mentioned commands have to start with 'ip6tables'. It
is also possible to let Suricata check both kinds of traffic.
There is also a way to use iptables with multiple networks (and interface
cards). Example:
sudo iptables -I FORWARD -i eth0 -o eth1 -j NFQUEUE
sudo iptables -I FORWARD -i eth1 -o eth0 -j NFQUEUE
The options -i (input) -o (output) can be combined with all previous mentioned
options
If you would stop Suricata and use internet, the traffic will not come through.
To make internet work correctly, you have to erase all iptable rules.
To erase all iptable rules, enter:
sudo iptables -F

10
doc/Third_Party_Installation_Guides.txt
Unescape Escape View File

@ -0,0 +1,10 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Third_Party_Installation_Guides
Third Party Installation Guides
On this page you can find links to third party installation guides for
Suricata. Beware that none of these guides is reviewed by us. Feel free to add
a link to your Suricata installation guide.
http://aldeid.com/index.php/Suricata/Installation-and-basic-configuration

60
doc/Ubuntu_Installation.txt
Unescape Escape View File

@ -0,0 +1,60 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Ubuntu_Installation
Ubuntu Installation
Pre-installation requirements
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
By default, Suricata works as an IDS. If you want to use it as a IDS and IPS
program, enter:
sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1
libnfnetlink-dev libnfnetlink0
Suricata
To download and build Suricata, enter the following:
wget http://www.openinfosecfoundation.org/download/suricata-1.0.5.tar.gz
tar -xvzf suricata-1.0.5.tar.gz
cd suricata-1.0.5/
Compile and install the engine
If you plan to build Suricata with IPS capabilities, enter:
./configure --enable-nfqueue
instead of
./configure
Continue with the next commands:
./configure
make
sudo make install
sudo ldconfig
Please continue with Basic_Setup.

89
doc/Ubuntu_Installation_from_GIT.txt
Unescape Escape View File

@ -0,0 +1,89 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Ubuntu_Installation_from_GIT
Ubuntu Installation from GIT
In this document will be explained how to install and use the most recent code
of Suricata on Ubuntu. Installing from GIT on other operating systems is
basically the same, except that some commands are Ubuntu-specific (like sudo
and apt-get). In case you are using another operating system, you should
replace those commands by your operating-specific commands.
Pre-installation requirements
Before you can build Suricata for your system, run the following command to
ensure that you have everything you need for the installation.
sudo apt-get -y install libpcre3 libpcre3-dbg libpcre3-dev \
build-essential autoconf automake libtool libpcap-dev libnet1-dev \
libyaml-0-2 libyaml-dev zlib1g zlib1g-dev libcap-ng-dev libcap-ng0 \
make
sudo apt-get install git-core
Depending on the current status of your system, it may take a while to complete
this process.
HTP
HTP is bundled with Suricata and installed automatically. If you need to
install HTP manually for other reasons, instructions can be found at HTP
library_installation.
IPS
By default, Suricata works as an IDS. If you want to use it as a IDS and IPS
program, enter:
sudo apt-get -y install libnetfilter-queue-dev libnetfilter-queue1
libnfnetlink-dev libnfnetlink0
Suricata
First, it is convenient to create a directory for Suricata. Name it 'suricata'
for example. Open the terminal and enter:
mkdir suricata
Followed by:
cd suricata
Next, enter the following line in the terminal:
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf
Followed by:
./autogen.sh
To configure, please enter:
./configure
To compile, please enter:
make
To install Suricata, enter:
sudo make install
sudo ldconfig
Please continue with Basic_Setup.
In case you have already made a map for the most recent code, downloaded the
code into that map, and want to download recent code again, please enter:
cd suricata/oisf
next, enter:
git pull
After that, you start again at running autogen.

183
doc/Windows.txt
Unescape Escape View File

@ -0,0 +1,183 @@
Autogenerated on 2012-01-11
from - https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Windows
Windows
Preparing the build environment
The instructions below should be followed in the order they appear. If your
configuration requires unique actions to compile the package and/or you
significantly modify the configure shell script, please e-mail the details of
your requirements and/or solution to bugreports@openinfosecfoundation.org.
Set up MinGW environment from http://mingw.org/
Do not use the automatic installer, as it is deprecated. Instead, manually
unpack the following packages to c:\mingw (you may use newer versions if you
prefer):
* binutils
o binutils-2.20-1-mingw32-bin.tar.gz
* mingw-runtime (dev and dll)
o mingwrt-3.17-mingw32-dll.tar.gz
o mingwrt-3.17-mingw32-dev.tar.gz
* w32api
o w32api-3.14-mingw32-dev.tar.gz
* Required runtime libraries for GCC (gmp, libiconv, MPFR and pthreads)
o gmp-4.2.4-mingw32-dll.tar.gz
o libiconv-1.13.1-1-mingw32-dll-2.tar.lzma
o mpfr-2.4.1-mingw32-dll.tar.gz
o pthreads-w32-2.8.0-mingw32-dll.tar.gz
* gcc-core (bin and dll)
o gcc-core-4.4.0-mingw32-bin.tar.gz
o gcc-core-4.4.0-mingw32-dll.tar.gz
* make
o make-3.81-20090914-mingw32-bin.tar.gz
* zlib
o libz-1.2.3-1-mingw32-dll-1.tar.gz
+ libz-1.2.3-1-mingw32-dev.tar.gz
Download MSYS
Get MSYS from http://sourceforge.net/projects/mingw/files/ and install
MSYS-1.0.11.exe (MSYS Base System)
msysDTK-1.0.1.exe (MSYS Suplementary Tools)
autoconf-2.63-1-msys-1.0.11-bin.tar.lzma
automake-1.11-1-msys-1.0.11-bin.tar.lzma
libtool-2.2.7a-1-msys-1.0.11-bin.tar.lzma
MSYS will ask the following questions during installation.
Accept Post Install: [y]
MinGW Installed? : [y]
path to MinGW: [c:/MinGW]
Download pkg-config
Install pkg-config taken from http://wiki.videolan.org/Win32CompileMSYSNew#PKG-
CONFIG
Download and extract the following into c:\Msys\1.0
http://ftp.gnome.org/pub/GNOME/binaries/win32/glib/2.18/glib_2.18.2-
1_win32.zip
ftp://ftp.gnome.org/pub/gnome/binaries/win32/dependencies/pkg-config_0.23-
3_win32.zip
ftp://ftp.gnome.org/pub/gnome/binaries/win32/dependencies/pkg-config-
dev_0.23-3_win32.zip
Set PKG_CONFIG_PATH=/win32/lib/pkgconfig
(e.g. by adding the Windows environment variable PKG_CONFIG_PATH in "Control
Panel"->"System"->"Advanced System Settings"->"Environment Variables" and
setting the value to /win32/lib/pkgconfig)
Download Git sources
Get Git sources from http://code.google.com/p/msysgit/
Unpack to /msys/1.0
Remember to edit ~/.gitconfig to set your username
Download libpcre
Get libpcre from http://www.pcre.org/
./configure --enable-utf8 --disable-cpp --prefix=/mingw
make
make install
Download libyaml
Download libyaml from http://pyyaml.org/wiki/LibYAML
Though libyaml does not support mingw compilation, it does work in static mode.
./configure --prefix=/mingw CFLAGS="-DYAML_DECLARE_STATIC"
make
make install
Download libpcap
Download the developer pack from http://www.winpcap.org/devel.htm
To have the driver in the system, download and install a corresponding
installer package from http://www.winpcap.org/install/default.htm
Copy includes to c:/mingw/include and libs (.a) to c:/mingw/lib
Rename libwpcap.a to libpcap.a
Get and compile Suricata
git clone git://phalanx.openinfosecfoundation.org/oisf.git
cd oisf
Because of an autotools port bug, you will need to do the following:
dos2unix.exe libhtp/configure.ac
dos2unix.exe libhtp/htp.pc.in
dos2unix.exe libhtp/Makefile.am
./autogen.sh
./configure CFLAGS="-DYAML_DECLARE_STATIC"
Add --enable-nfqueue as a configurable parameter to enable inline mode.
make
If the full installation is successful, suricata.exe will be located in
src/.lib. To test your build, you will need libpcre-0.dll, libz-1.dll, and
pthreadGC2.dll, all of which should already be installed under c:/mingw or c:/
msys.
preparing the runtime environment.
To prepare the runtime environment, you must copy the executable and DLLs to a
dedicated directory. Get the classification.config and suricata.yaml, and then
edit suricata.yaml to ensure the directories are correctly identified.
pcap mode
If you have not already done so, install winpcap runtime and its driver. Then,
determine your eth device UUID in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\
suricata.exe -c suricata.yaml -i \device\
In the example above, device should be replaced with your device uuid.
Inline mode
To operate in inline mode, you must download, compile and install
netfilterforwin, which is the netfilter.sys driver and Windows port of the
libnetfilter_queue library.
Download and install the Windows Driver Kit from Microsoft
http://www.microsoft.com/downloads/
details.aspx?displaylang=en&FamilyID=36a2630f-5d56-43b5-b996-7633f2ec14ff
Download netfilterforwin from http://sourceforge.net/projects/netfilterforwin/
Unpack it so the netfilterforwin directory is beside the oisf directory. You
must omit the version from its name.
Compile the driver
Open the correct build environment from your Start menu
Start > All Programs > Windows Driver Kits > WDK xxxx.yyyy.z > Build
Environments > Windows Server 2003 > x86 Free Build Environment
At your command line prompt, enter the following:
cd netfilterforwin/netfilter
nmake
Install the driver
Copy inf/* files and the freshly built netfilter.sys to a separate directory,
and then open the network connections.
Right-click an interface, then select Properties
Click install...
Select Service
Click Add
Click Have disk...
Browse to the directory with the inf files and netfilter.sys, select
netfilter.inf, and then click Ok.
Confirm everything
The driver is now installed.
Run Suricata in inline mode
suricata.exe -c suricata.yaml -q 0
Write Preview
Loading…
Cancel
Save