suricata8
Next generation intrusion detection and prevention tool
Usage
suricata [OPTIONS]
[BPF
FILTER]
Overview
suricata is a network Intrusion Detection System (IDS). It is based on rules (and is fully compatible with snort rules) to detect a variety of attacks / probes by searching packet content.
This engine supports Multi-Threading, Automatic Protocol Detection (IP, TCP, UDP, ICMP, HTTP, TLS, FTP and SMB), Gzip Decompression, Fast IP Matching and hardware acceleration on CUDA, OpenCL GPU cards and more.
It supports acquiring packets through AF_PACKET, NFQUEUE, PF_RING, PCAP (live or offline) and more.
Options
-
-c <path> -
Load main configuration file (by default, /etc/suricata/suricata.yaml).
-
-T -
Test configuration file (use with -c).
-i <dev or ip>
|
Run in PCAP live mode. |
|---|---|
-F <bpf filter file>
|
Load BPF filter file. |
-
-r <path> -
Run in PCAP file/offile mode.
-
-q <qid> -
Run in inline NFQUEUE mode.
-
-s <path> -
Load signature file in addition to the main configuration file.
-
-S <path> -
Load signature file exclusively.
-
-l <dir> -
Set log directory (by default /var/log/suricata).
-
-D -
Run as a background daemon (suricata will fork itself).
-
-k [all|none] -
Force checksum cheks (all) or disable it (none).
-
-V -
Print
suricataversion.
-
-v[v] -
Increase default verbosity.
-
--list-app-layer-protos -
Print list of supported app layer protocols.
-
--list-keywords[=all|csv|<kword>] -
List keywords implemented by the engine.
-
--list-runmodes -
List supported runmodes.
-
--runmode <runomde_id> -
Specific runmode in which the engine should run. The argument runmode_id should be the id of the runmode obtained using --list-runmodes.
-
--engine-analysis -
Print reports on analysis of different sections in the engine.
-
--pidfile <path> -
Write PID to the file.
-
--init-errors-fatal -
Enable fatal failure on signature init error.
-
--disable-detection -
Disable detection engine.
-
--dump-config -
Show the running configuration.
-
--build-info -
Display build information.
-
--pacp[=<dev>] -
Run in PCAP mode. No dev value selects interfaces from main configuration file.
-
--pcap-buffer-size -
Size of PCAP buffer. Values from 0 to 2147483647.
-
--af-packet[=<dev>] -
Run in AF_PACKET mode. No dev value selects interfaces from main configuration file.
-
--simulate-ips -
Force engine into IPS mode. Useful for QA.
-
--user <user> -
Run
suricataas this user after init.
-
--group <group> -
Run
suricataas this gorup after init.
-
--unix-socket[=<file>] -
UNIX socket to control
suricatawork fromsuricatasc(1). The default is /var/run/suricata-command.socket.
-
--set name=value -
Set configuration variable name to value.
Examples
To run the engine with default configuration on interface eth0 with signature file "signatiures.rules", run the command as:
% suricata -c suricata.yaml -s signatures.rules -i eth0
Releases
5 releases since Debian 6.0 (Squeeze); the text changed 1 time.
--af-packet since Debian 9 (Stretch);
--build-info since Debian 9 (Stretch);
--disable-detection since Debian 9 (Stretch);
--dump-config since Debian 9 (Stretch);
--engine-analysis since Debian 9 (Stretch);
--group since Debian 9 (Stretch);
--list-app-layer-protos since Debian 9 (Stretch);
--list-keywords since Debian 9 (Stretch);
--list-runmodes since Debian 9 (Stretch);
--pacp since Debian 9 (Stretch);
--pcap-buffer-size since Debian 9 (Stretch);
--pidfile since Debian 9 (Stretch);
--runmode since Debian 9 (Stretch);
--set since Debian 9 (Stretch);
--simulate-ips since Debian 9 (Stretch);
--unix-socket since Debian 9 (Stretch);
--user since Debian 9 (Stretch);
-S since Debian 9 (Stretch);
-T since Debian 9 (Stretch);
-V since Debian 9 (Stretch);
-k since Debian 9 (Stretch);
-v since Debian 9 (Stretch).
-i until Debian 8 (Jessie).