<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>These are my notes from installing HS and pf_ring support on RHEL 7.</p>
<p></p>
<h3 class="p2" id="SuricataDocumentation-snortappprod3-InstallwithIntelHyperscanEnabled" style="margin: 30px 0px 0px; padding: 0px; font-size: 16px; line-height: 1.5; font-family: Arial, sans-serif;">
Install with Intel Hyperscan Enabled</h3>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<u><span class="s1">Install pre-requisites</span></u></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">sudo yum install cmake gcc-c++ python-devel</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">Download ragel, unpack, ./configure, make, sudo make install</span></p>
<p class="p2" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<u>Download and compile boost headers</u></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">Download boost 1.60</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">tar xvzf boost_1_60_0.tar.gz</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">cd boost_1_60_0</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">./bootstrap.sh</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">./b2</span></p>
<p class="p2" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<u>Install Hyperscan</u></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">git clone <a href="https://github.com/01org/hyperscan" class="external-link" rel="nofollow" style="color: rgb(50, 108, 166); text-decoration: none;" id="LPlnk963466" previewremoved="true">https://github.com/01org/hyperscan</a></span><br>
</p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">cd hyperscan</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">mkdir build</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">cd build</span></p>
<p class="p3" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s2">cmake -DBUILD_STATIC_AND_SHARED=1 -DBOOST_ROOT=/home/<user>/boost_1_60_0/ ../</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">make</span></p>
<p class="p1" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s1">sudo make install</span></p>
<p class="p2" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<u>Compile Suricate with HS and PF_RING support</u></p>
<p class="p3" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s2">./</span><span class="s3">configure</span><span class="s2"> --prefix=/usr --sysconfdir=/etc --enable-pfring --with-libpfring-includes=/usr/local/include --with-libpfring-libraries=/usr/local/lib --with-libnspr-includes=/usr/include/nspr4/ --with-libnspr-libraries=/usr/include/nspr4/
--with-libcap_ng-libraries=/usr/local/lib --with-libhs-includes=/usr/local/include/hs/ --with-libhs-libraries=/usr/local/lib/</span></p>
<p class="p3" style="margin-top: 10px; margin-right: 0px; margin-left: 0px; padding: 0px; color: rgb(51, 51, 51); font-family: Arial, sans-serif; font-size: 14px;">
<span class="s2">mpm-algo and spm-algo values in suricata.yaml must be set to 'auto' or 'hs'</span></p>
<br>
<p></p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
</div>
</div>
</div>
<br>
<br>
<div style="color: rgb(0, 0, 0);">
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Oisf-users <oisf-users-bounces@lists.openinfosecfoundation.org> on behalf of Cloherty, Sean E <scloherty@mitre.org><br>
<b>Sent:</b> Tuesday, March 28, 2017 12:15 PM<br>
<b>To:</b> oisf-users@lists.openinfosecfoundation.org<br>
<b>Subject:</b> [Oisf-users] Hyperscan on RHEL or CentOS</font>
<div> </div>
</div>
<div>
<div>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
Has anyone got instructions for installing Hyperscan on RHEL/CentOS? I’ve tried a few times now and it seems like I get fairly close, but I’ve not been able to compile Suricata with Hyperscan. I know that it is something I am completing incorrectly but have
not been able to figure it out. Are there files or configuration changes that I can check at the end of the install to see if it was completed correctly prior to compiling Suricata?</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
Thanks.</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
Sean Cloherty</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
InfoSec Engineer/Scientist, Lead</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-family:MITRE; color:#2E74B5">MITRE</span> Corporation</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
office (781) 271-3707</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
cell (781) 697-8043</p>
<p style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
</div>
</div>
</div>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This e-mail message (including any attachments) is for the sole use of<br>
the intended recipient(s) and may contain confidential and privileged<br>
information. If the reader of this message is not the intended<br>
recipient, you are hereby notified that any dissemination, distribution<br>
or copying of this message (including any attachments) is strictly<br>
prohibited.<br>
<br>
If you have received this message in error, please contact<br>
the sender by reply e-mail message and destroy all copies of the<br>
original message (including attachments).<br>
</font>
</body>
</html>