Thank Zhihao Tao for your hard work. The document spent countless nights and weekends, using his hard work to make it convenient for everyone.
If you have any questions, please send a email to zhihao.tao@outlook.com

1. 安装

suricata安装官方文档

1.1 代码下载

[taozhihao@localhost suricata]$ wget https://www.openinfosecfoundation.org/downloads/suricata-5.0.3.tar.gz
[taozhihao@localhost suricata]$ tar -zxvf suricata-5.0.3.tar.gz
[taozhihao@localhost suricata]$ cd suricata-5.0.3

1.2. 环境依赖

[taozhihao@localhost suricata-5.0.3]$ sudo yum install -y epel-release
[taozhihao@localhost suricata-5.0.3]$ sudo yum install -y rustc cargo
[taozhihao@localhost suricata]$ sudo yum -y install gcc libpcap-devel pcre-devel libyaml-devel file-devel \
  zlib-devel jansson-devel nss-devel libcap-ng-devel libnet-devel tar make \
  libnetfilter_queue-devel lua-devel PyYAML libmaxminddb-devel rustc cargo \
  lz4-devel

1.3. 代码编译

[taozhihao@localhost suricata]$ ./configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var --enable-nfqueue --enable-lua
[taozhihao@localhost suricata]$ make
[taozhihao@localhost suricata]$ sudo make install
[taozhihao@localhost suricata]$ sudo ldconfig

1.4. 环境配置

[taozhihao@localhost suricata]$ sudo make install-conf
[taozhihao@localhost suricata]$ sudo make install-rules

1.5. 测试

[root@localhost suricata-5.0.3]# suricata -c /etc/suricata/suricata.yaml -i enp0s3 --init-errors-fatal

• 规则文件路径 /var/lib/suricata/rules/suricata.rules