Suricata 2 配置文件说明

最新推荐文章于 2025-06-08 09:03:57 发布

ly4983

最新推荐文章于 2025-06-08 09:03:57 发布

阅读量335

点赞数 3

CC 4.0 BY-SA版权

文章标签： windows java 服务器

本文链接：https://blog.youkuaiyun.com/ly4983/article/details/148105470

Suricata配置文件说明

1.max-pending-packets 设置了suricata能够同时处理的数据包的数量，最少为1，默认值是1024。

2.runmodes 该选项设置了suricata的运行方式，使用命令./suricata --list-runmodes可以查看所有的运行方式

suricata --list-runmodes
------------------------------------- Runmodes ------------------------------------------
| RunMode Type      | Custom Mode       | Description 
|----------------------------------------------------------------------------------------
| PCAP_DEV          | single            | Single threaded pcap live mode 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded pcap live mode.  Packets from each flow are assigned to a single detect thread, unlike "pcap_live_auto" where packets from the same flow can be processed by any detect thread 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers pcap live mode, each thread does all tasks from acquisition to logging 
|----------------------------------------------------------------------------------------
| PCAP_FILE         | single            | Single threaded pcap file mode 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded pcap file mode.  Packets from each flow are assigned to a single detect thread, unlike "pcap-file-auto" where packets from the same flow can be processed by any detect thread 
|----------------------------------------------------------------------------------------
| PFRING(DISABLED)  | autofp            | Multi threaded pfring mode.  Packets from each flow are assigned to a single detect thread, unlike "pfring_auto" where packets from the same flow can be processed by any detect thread 
|                   ---------------------------------------------------------------------
|                   | single            | Single threaded pfring mode 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers pfring mode, each thread does all tasks from acquisition to logging 
|----------------------------------------------------------------------------------------
| NFQ               | autofp            | Multi threaded NFQ IPS mode with respect to flow 
|                   ---------------------------------------------------------------------
|                   | workers           | Multi queue NFQ IPS mode with one thread per queue 
|----------------------------------------------------------------------------------------
| NFLOG             | autofp            | Multi threaded nflog mode   
|                   ---------------------------------------------------------------------
|                   | single            | Single threaded nflog mode  
|                   ---------------------------------------------------------------------
|                   | workers           | Workers nflog mode          
|----------------------------------------------------------------------------------------
| IPFW              | autofp            | Multi threaded IPFW IPS mode with respect to flow 
|                   ---------------------------------------------------------------------
|                   | workers           | Multi queue IPFW IPS mode with one thread per queue 
|----------------------------------------------------------------------------------------
| ERF_FILE          | single            | Single threaded ERF file mode 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded ERF file mode.  Packets from each flow are assigned to a single detect thread 
|----------------------------------------------------------------------------------------
| ERF_DAG           | autofp            | Multi threaded DAG mode.  Packets from each flow are assigned to a single detect thread, unlike "dag_auto" where packets from the same flow can be processed by any detect thread 
|                   ---------------------------------------------------------------------
|                   | single            | Singled threaded DAG mode   
|                   ---------------------------------------------------------------------
|                   | workers           | Workers DAG mode, each thread does all  tasks from acquisition to logging 
|----------------------------------------------------------------------------------------
| AF_PACKET_DEV     | single            | Single threaded af-packet mode 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers af-packet mode, each thread does all tasks from acquisition to logging 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi socket AF_PACKET mode.  Packets from each flow are assigned to a single detect thread. 
|----------------------------------------------------------------------------------------
| NETMAP(DISABLED)  | single            | Single threaded netmap mode 
|                   ---------------------------------------------------------------------
|                   | workers           | Workers netmap mode, each thread does all tasks from acquisition to logging 
|                   ---------------------------------------------------------------------
|                   | autofp            | Multi threaded netmap mode.  Packets from each flow are assigned to a single detect thread. 
|----------------------------------------------------------------------------------------
| UNIX_SOCKET       | single            | Unix socket mode            
|                   ---------------------------------------------------------------------
|                   | autofp            | Unix socket mode            
|----------------------------------------------------------------------------------------
| WINDIVERT(DISABLED) | autofp            | Multi-threaded WinDivert IPS mode load-balanced by flow

3.default-packet-size

之前的max-pending-packets选项设置了最多同时处理的数据包数量，这些同时处理的数据包都是需要存储在内存中的，所以需要对每个数据包的大小进行限制，而当前选项就是做这个事的。虽然有时候可能需要检测较大的数据包，但是大部分情况下为了性能还是需要做出一定的限制。其配置方式如下，默认值是1514，这也是TCP数据包的最大长度（当数据超过这个长度便会使用TCP报文重组技术）：

default-packet-size: 1514

default-log-dir

Suricata默认的日志存储目录是/var/log/suricata，在配置文件中可以通过当前选项指定，比如程序目录下的log文件夹，也可以在运行时的-l参数指定：

default-log-dir:./log

outputs

outputs选项下有很多可以输出的配置选项，包括警告、检测的数据包、产生的结果等。在配置的过程中并不需要开启每一种输出，根据自己的需求进行配置。

修改配置后，进行规则测试

---------------------------------------------------------------------------------

SURICATA测试模式运行suricata，用以检测配置文件。

suricata.yaml配置完成后，运行suricata -T以测试模式运行suricata，看下suricata.yaml是否有报错，如果有报错，要仔细检查下。要特别注意回车符和空格。若无报错，运行结果如下所示：

[root@nginx-ser rules]# suricata -T
21/5/2025 -- 10:04:01 - <Info> - Running suricata under test mode
21/5/2025 -- 10:04:01 - <Notice> - This is Suricata version 4.1.10 RELEASE
21/5/2025 -- 10:04:02 - <Notice> - Configuration provided was successfully loaded. Exiting.