[Oisf-users] Configure IPS and NSM in Suricata.
Kaushal Shriyan
kaushalshriyan at gmail.com
Mon Apr 1 05:44:49 UTC 2019
On Sun, Mar 31, 2019 at 7:26 AM Kaushal Shriyan <kaushalshriyan at gmail.com>
wrote:
>
>
> On Sat, Mar 30, 2019 at 9:14 PM Kaushal Shriyan <kaushalshriyan at gmail.com>
> wrote:
>
>> Hi,
>>
>> I am running Suricata 4.1.3 on CentOS Linux release 7.6.1810 (Core) and
>> have configured Suricata in IDS mode. I will appreciate if you can help me
>> to configure IPS and NSM in Suricata.
>>
>> Thanks in advance and i look forward to hearing from you.
>>
>> Best Regards,
>>
>> Kaushal
>>
>
>
> Hi,
>
> I have the below settings for Suricata
>
> # suricata --build-info
>> This is Suricata version 4.1.3 RELEASE
>> Features: NFQ PCAP_SET_BUFF AF_PACKET HAVE_PACKET_FANOUT LIBCAP_NG
>> LIBNET1.1 HAVE_HTP_URI_NORMALIZE_HOOK PCRE_JIT HAVE_NSS HAVE_LUA
>> HAVE_LIBJANSSON TLS MAGIC RUST
>> SIMD support: none
>> Atomic intrisics: 1 2 4 8 byte(s)
>> 64-bits, Little-endian architecture
>> GCC version 4.8.5 20150623 (Red Hat 4.8.5-36), C version 199901
>> compiled with _FORTIFY_SOURCE=2
>> L1 cache line size (CLS)=64
>> thread local storage method: __thread
>> compiled with LibHTP v0.5.30, linked against LibHTP v0.5.30
>> Suricata Configuration:
>> AF_PACKET support: yes
>> eBPF support: no
>> XDP support: no
>> PF_RING support: no
>> NFQueue support: yes
>> NFLOG support: no
>> IPFW support: no
>> Netmap support: no
>> DAG enabled: no
>> Napatech enabled: no
>> WinDivert enabled: no
>> Unix socket enabled: yes
>> Detection enabled: yes
>> Libmagic support: yes
>> libnss support: yes
>> libnspr support: yes
>> libjansson support: yes
>> liblzma support: no
>> hiredis support: yes
>> hiredis async with libevent: yes
>> Prelude support: yes
>> PCRE jit: yes
>> LUA support: yes
>> libluajit: no
>> libgeoip: yes
>> Non-bundled htp: no
>> Old barnyard2 support: no
>> Hyperscan support: yes
>> Libnet support: yes
>> liblz4 support: yes
>> Rust support: yes (default)
>> Rust strict mode: no
>> Rust debug mode: no
>> Rust compiler: rustc 1.32.0
>> Rust cargo: cargo 1.32.0
>> Install suricatasc: yes
>> Install suricata-update: yes
>> Profiling enabled: no
>> Profiling locks enabled: no
>> Development settings:
>> Coccinelle / spatch: no
>> Unit tests enabled: no
>> Debug output enabled: no
>> Debug validation enabled: no
>> Generic build parameters:
>> Installation prefix: /usr
>> Configuration directory: /etc/suricata/
>> Log directory: /var/log/suricata/
>> --prefix /usr
>> --sysconfdir /etc
>> --localstatedir /var
>> --datarootdir /usr/share
>> Host: x86_64-redhat-linux-gnu
>> Compiler: gcc -std=gnu99 (exec name) /
>> gcc (real)
>> GCC Protect enabled: yes
>> GCC march native enabled: no
>> GCC Profile enabled: no
>> Position Independent Executable enabled: yes
>> CFLAGS -O2 -g -pipe -Wall
>> -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector-strong
>> --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic
>> -I${srcdir}/../rust/gen/c-headers
>> PCAP_CFLAGS
>> SECCFLAGS -fstack-protector
>> -D_FORTIFY_SOURCE=2 -Wformat -Wformat-security
>> #
>
>
> Please comment.
>
> Best Regards,
>
> Kaushal
>
Hi,
# suricata --list-runmodes
------------------------------------- Runmodes
------------------------------------------
| RunMode Type | Custom Mode | Description
|----------------------------------------------------------------------------------------
| PCAP_DEV | single | Single threaded pcap live mode
|
---------------------------------------------------------------------
| | autofp | Multi threaded pcap live mode.
Packets from each flow are assigned to a single detect thread, unlike
"pcap_live_auto" where packets from the same flow can be processed by any
detect thread
|
---------------------------------------------------------------------
| | workers | Workers pcap live mode, each
thread does all tasks from acquisition to logging
|----------------------------------------------------------------------------------------
| PCAP_FILE | single | Single threaded pcap file mode
|
---------------------------------------------------------------------
| | autofp | Multi threaded pcap file mode.
Packets from each flow are assigned to a single detect thread, unlike
"pcap-file-auto" where packets from the same flow can be processed by any
detect thread
|----------------------------------------------------------------------------------------
| PFRING(DISABLED) | autofp | Multi threaded pfring mode.
Packets from each flow are assigned to a single detect thread, unlike
"pfring_auto" where packets from the same flow can be processed by any
detect thread
|
---------------------------------------------------------------------
| | single | Single threaded pfring mode
|
---------------------------------------------------------------------
| | workers | Workers pfring mode, each thread
does all tasks from acquisition to logging
|----------------------------------------------------------------------------------------
| NFQ | autofp | Multi threaded NFQ IPS mode with
respect to flow
|
---------------------------------------------------------------------
| | workers | Multi queue NFQ IPS mode with one
thread per queue
|----------------------------------------------------------------------------------------
| NFLOG | autofp | Multi threaded nflog mode
|
---------------------------------------------------------------------
| | single | Single threaded nflog mode
|
---------------------------------------------------------------------
| | workers | Workers nflog mode
|----------------------------------------------------------------------------------------
| IPFW | autofp | Multi threaded IPFW IPS mode with
respect to flow
|
---------------------------------------------------------------------
| | workers | Multi queue IPFW IPS mode with
one thread per queue
|----------------------------------------------------------------------------------------
| ERF_FILE | single | Single threaded ERF file mode
|
---------------------------------------------------------------------
| | autofp | Multi threaded ERF file mode.
Packets from each flow are assigned to a single detect thread
|----------------------------------------------------------------------------------------
| ERF_DAG | autofp | Multi threaded DAG mode. Packets
from each flow are assigned to a single detect thread, unlike "dag_auto"
where packets from the same flow can be processed by any detect thread
|
---------------------------------------------------------------------
| | single | Singled threaded DAG mode
|
---------------------------------------------------------------------
| | workers | Workers DAG mode, each thread
does all tasks from acquisition to logging
|----------------------------------------------------------------------------------------
| AF_PACKET_DEV | single | Single threaded af-packet mode
|
---------------------------------------------------------------------
| | workers | Workers af-packet mode, each
thread does all tasks from acquisition to logging
|
---------------------------------------------------------------------
| | autofp | Multi socket AF_PACKET mode.
Packets from each flow are assigned to a single detect thread.
|----------------------------------------------------------------------------------------
| NETMAP(DISABLED) | single | Single threaded netmap mode
|
---------------------------------------------------------------------
| | workers | Workers netmap mode, each thread
does all tasks from acquisition to logging
|
---------------------------------------------------------------------
| | autofp | Multi threaded netmap mode.
Packets from each flow are assigned to a single detect thread.
|----------------------------------------------------------------------------------------
| UNIX_SOCKET | single | Unix socket mode
|
---------------------------------------------------------------------
| | autofp | Unix socket mode
|----------------------------------------------------------------------------------------
| WINDIVERT(DISABLED) | autofp | Multi-threaded WinDivert IPS
mode load-balanced by flow
|----------------------------------------------------------------------------------------
Best Regards,
Kaushal
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190401/bb20c0fa/attachment-0001.html>
More information about the Oisf-users
mailing list